Improper Authorization in Mastodon Social Network Server
CVE-2026-72914
7.5HIGH
What is CVE-2026-72914?
Mastodon, an open-source social networking server, is impacted by a vulnerability in its administrative statistics endpoints. Before versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController did not adequately verify authorization prior to executing costly calculations. This flaw allowed unauthorized users to submit specific parameters that could trigger extensive SQL queries, potentially leading to server resource exhaustion. Mitigation has been implemented in the mentioned versions.
Affected Version(s)
mastodon < 4.4.21 < 4.4.21
mastodon >= 4.5.0-beta.1, < 4.5.14 < 4.5.0-beta.1, 4.5.14
mastodon >= 4.6.0-beta.1, < 4.6.4 < 4.6.0-beta.1, 4.6.4