Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2025-62176

Mastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channels

Medium4.3EPSS 0.27%
Published
Updated
Reserved
Assigned by
GitHub_M

Description

Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, the streaming server accepts serving events for public timelines to clients using any valid authentication token, even if those tokens lack the read:statuses scope. This allows OAuth clients without the read scope to subscribe to public channels and receive public timeline events. The impact is limited, as this only affects new public posts published on the public timelines and requires an otherwise valid token, but this may lead to unexpected access to public posts in a limited-federation setting. This issue has been patched in versions 4.4.6, 4.3.14, and 4.2.27. No known workarounds exist.

Timeline

  1. ID reserved

    By GitHub_M

  2. · 6 days later

    Published

  3. · 1 day later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2025-62176, by who scored it
Scored byCVSSScoreVector
GitHub_MCNA (assigner)3.1Medium4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVDNVD · Analyzed3.1Medium4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS (exploitation in 30 days)
0.27% · top 80% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

Affected products

  • mastodon · mastodon

    • affected >= 4.4.0-beta.1, < 4.4.6
    • affected >= 4.3.0-beta.1, < 4.3.14
    • affected < 4.2.27

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2025-62176 badge
[![CVE-2025-62176](https://trackcve.app/badge/CVE-2025-62176.svg)](https://trackcve.app/cve/CVE-2025-62176)

Record last updated .