CVE-2024-37903 - CVE House
Back to Database
Status published High CVE-2024-37903

Mastodon has improper authorship check on audience extension for existing posts

Vulnerability Description

Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities, an attacker can extend the audience of a post they do not own to other Mastodon users on a target server, thus gaining access to the contents of a post not intended for them. Versions 4.1.18 and 4.2.10 contain a patch for this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-37903

Credits & Attribution

No credits recorded in the NVD database.

References

More from mastodon

View All →
CVE-2025-67500
Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration
Low 3.7
CVE-2025-62605
Mastodon quotes control can be bypassed
Medium 4.3
CVE-2025-62176
Mastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channels
Medium 4.3
CVE-2025-62175
Mastodon streaming API fails to disconnect disabled and suspended users
Medium 4.3
CVE-2025-62174
Mastodon allows continued access after password reset via CLI
Low 3.5

Affected Vendor

Affected Software

mastodon
Vulnerable Versions:
>= 2.6.0, < 4.1.18, >= 4.2.0, < 4.2.10

Timeline

Official Publish: July 5th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weaknesses (CWE)

CWE-862

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1078 Valid Accounts
Persistence
T1531 Account Access Removal
Impact