CVE-2025-27399

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is set to "users" (localized English string: "To logged-in users"), users that are not yet approved can view the block reasons. Instance admins that do not want their domain blocks to be public are impacted. Versions 4.1.23, 4.2.16, and 4.3.4 fix the issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-285

Affected software

No affected versions have been published.

Timeline

Published: Feb 27, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-27407.3A vulnerability classified as critical has been found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of t CVE-2025-274002.9Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commer CVE-2025-274014.6Tuleap is an Open Source Suite to improve management of software developments and collaboration. In a standard usages of Tuleap, the issue h CVE-2025-274024.6Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protections on track CVE-2025-274037.2Ratify is a verification engine as a binary executable and on Kubernetes which enables verification of artifact security metadata and admits CVE-2025-274046.1Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 a CVE-2025-274056.1Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 a CVE-2025-274067.6Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. A v CVE-2025-274079.0graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14,CVE-2025-274084.8Manifest offers users a one-file micro back end. Prior to version 4.9.2, Manifest employs a weak password hashing implementation that uses S CVE-2025-274097.5Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to CVE-2025-274106.5PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal