CVE-2026-72914

HIGH 7.5

Mastodon: Exhausting data by an unauthenticated request to the admin retention API

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused long-running SQL queries in Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension, allowing repeated requests to exhaust server resources. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.

CWE	CWE-405 CWE-770
Vendor	mastodon
Product	mastodon
Published	Aug 10, 2026

Stay Ahead of the Next One

Get instant alerts for mastodon mastodon

Be the first to know when new high vulnerabilities affecting mastodon mastodon are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

mastodon / mastodon

< 4.4.21 >= 4.5.0-beta.1, < 4.5.14 >= 4.6.0-beta.1, < 4.6.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗