Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2025-67500

Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration

Low3.7EPSS 0.22%
Published
Updated
Reserved
Assigned by
GitHub_M

Description

Mastodon is a free, open-source social network server based on ActivityPub. Versions 4.2.27 and prior, 4.3.0-beta.1 through 4.3.14, 4.4.0-beta.1 through 4.4.9, 4.5.0-beta.1 through 4.5.2 have discrepancies in error handling which allow checking whether a given status exists by sending a request with a non-English Accept-Language header. Using this behavior, an attacker who knows the identifier of a particular status they are not allowed to see can confirm whether this status exists or not. This cannot be used to learn the contents of the status or any other property besides its existence. This issue is fixed in versions 4.2.28, 4.3.15, 4.4.10 and 4.5.3.

Timeline

  1. ID reserved

    By GitHub_M

  2. · 1 day later

    Published

  3. · 30 days later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2025-67500, by who scored it
Scored byCVSSScoreVector
GitHub_MCNA (assigner)3.1Low3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
NVDNVD · Analyzed3.1Low3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS (exploitation in 30 days)
0.22% · top 87% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.7.

Weakness

Affected products

  • mastodon · mastodon

    • affected < 4.2.28
    • affected >= 4.3.0-beta.1, < 4.3.15
    • affected >= 4.4.0-beta.1, < 4.4.10
    • affected >= 4.5.0-beta.1, < 4.5.3

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2025-67500 badge
[![CVE-2025-67500](https://trackcve.app/badge/CVE-2025-67500.svg)](https://trackcve.app/cve/CVE-2025-67500)

Record last updated .