CVE-2025-27399: Mastodon Information Disclosure Flaw

CVE-2025-27399 Overview

CVE-2025-27399 is an information disclosure vulnerability in Mastodon, a self-hosted federated microblogging platform. The flaw affects instances where administrators configured domain block visibility to users ("To logged-in users"). Unapproved users can read domain block reasons intended to remain restricted to fully approved accounts. The issue exists in the domain blocks controller, which enforces user_signed_in? without confirming the account is functional. Mastodon versions prior to 4.1.23, 4.2.16, and 4.3.4 are affected. This weakness is categorized under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Instance administrators who chose to restrict domain block reasons to logged-in users can have those reasons disclosed to pending, unapproved accounts.

Affected Products

Mastodon versions prior to 4.1.23
Mastodon versions prior to 4.2.16 (4.2.x branch)
Mastodon versions prior to 4.3.4 (4.3.x branch)

Discovery Timeline

2025-02-27 - CVE-2025-27399 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27399

Vulnerability Analysis

The vulnerability resides in app/controllers/api/v1/instances/domain_blocks_controller.rb. When the show_domain_blocks setting is set to users, the API returns domain block data to any signed-in session. The controller only verified that the requester was authenticated, not that the account had passed the approval workflow. On instances requiring administrator approval or email confirmation, pending users could still call the domain blocks endpoint and receive the block reasons. This exposes moderation decisions that administrators expected to remain internal to the approved user community.

Root Cause

The root cause is an incomplete authorization check. The show_domain_blocks_to_user? method used user_signed_in? as the sole gating condition beyond the setting value. Mastodon's account lifecycle includes states such as pending approval, unconfirmed email, suspended, and moved. The original check did not exclude these non-functional states, allowing accounts that had not yet reached full membership to consume the API.

Attack Vector

An attacker registers an account on a Mastodon instance that requires approval and has show_domain_blocks set to users. Without waiting for approval, the attacker authenticates and issues a request to the domain blocks API endpoint. The controller returns the full list of blocked domains along with the free-text reasons provided by moderators. No user interaction from a legitimate user is required.

ruby

   end
 
   def show_domain_blocks_to_user?
-    Setting.show_domain_blocks == 'users' && user_signed_in?
+    Setting.show_domain_blocks == 'users' && user_signed_in? && current_user.functional_or_moved?
   end
 
   def set_domain_blocks

Source: Mastodon commit 6b519cf

The patch adds current_user.functional_or_moved? to the guard, restricting the endpoint to accounts that have completed the approval and confirmation process.

Detection Methods for CVE-2025-27399

Indicators of Compromise

Requests to /api/v1/instance/domain_blocks from accounts whose approved or confirmed_at fields are still null.
Elevated read volume against the domain blocks endpoint shortly after new account registrations.
Access log entries showing authenticated calls to the domain blocks API from IPs also seen in registration events.

Detection Strategies

Review Rails production logs for GET /api/v1/instance/domain_blocks requests correlated to user IDs in a pending state.
Query the users table for accounts that queried the endpoint before approved = true or confirmed_at IS NOT NULL.
Deploy a reverse proxy rule that logs and flags calls to the domain blocks endpoint made with tokens tied to unapproved accounts.

Monitoring Recommendations

Enable audit logging for API access to moderation endpoints and forward the events to a centralized SIEM.
Alert on new account registrations that are followed within minutes by domain blocks API queries.
Track the show_domain_blocks setting in configuration management to ensure administrators know when disclosure risk applies.

How to Mitigate CVE-2025-27399

Immediate Actions Required

Upgrade to Mastodon 4.1.23, 4.2.16, or 4.3.4 depending on the deployed release branch.
Audit prior API access to /api/v1/instance/domain_blocks from unapproved accounts and rotate exposed moderation notes if warranted.
Review the show_domain_blocks administration setting and confirm it reflects the intended disclosure posture.

Patch Information

The fix landed in commit 6b519cfefa93a923b19d0f20c292c7185f8fd5f5 and is included in Mastodon 4.1.23, 4.2.16, and 4.3.4. Full details are documented in the GitHub Security Advisory GHSA-94h4-fj37-c825. Administrators running from source should rebase onto the patched tag and restart the Rails and Sidekiq processes.

Workarounds

Change the show_domain_blocks setting from users to disabled until the patched release can be deployed.
Temporarily disable open registration or require administrator approval before any API tokens are issued.
Front the API with a reverse proxy rule that rejects requests to the domain blocks endpoint from accounts lacking a functional state claim.

bash

# Upgrade example for a source install
cd /home/mastodon/live
git fetch --tags
git checkout v4.3.4  # or v4.2.16 / v4.1.23
bundle install
yarn install --frozen-lockfile
RAILS_ENV=production bundle exec rails db:migrate
RAILS_ENV=production bundle exec rails assets:precompile
sudo systemctl restart mastodon-web mastodon-sidekiq mastodon-streaming