Mastodon CVE-2025-62176

Exploitation requires the attacker to hold an otherwise-valid OAuth access token on the target instance, but that token may carry an insufficient scope (lacking read:statuses) - the streaming server failed to enforce scope on public channels (public, public:media, public:local, public:local:media, public:remote, public:remote:media, hashtag, hashtag:local). Limiting factors: a valid token is mandatory (PR:L, no fully anonymous access), and the exposed data is only NEW public posts published after subscription, not historical content, DMs, or private posts. The condition that elevates real impact is a limited-federation deployment, where 'public' posts are intended to remain within a restricted server set; on an ordinary open instance the exposed posts are already publicly visible, so practical confidentiality loss is minimal. Affected only on versions before 4.4.6, 4.3.14, and 4.2.27; no workaround exists other than upgrading.

This is a low-severity information-disclosure issue (vendor/NVD CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) that is genuinely low priority, and the multiple signals agree rather than conflict. EPSS is 0.27% (18th percentile), consistent with the low CVSS and the limited, read-only impact. The flaw is NOT in CISA KEV and there is no public exploit code identified - the only 'exploit' artifact is the vendor's own regression test and the remediating commit, which demonstrate the bug but do not constitute a weaponized POC. The CVSS vector requires PR:L, meaning an attacker must already possess a valid OAuth token for the instance; the vulnerability only lets such a token bypass the read:statuses scope requirement to subscribe to public streaming channels. Confidentiality impact is correctly scored Low because the data exposed is public posts (already broadly visible), with the one meaningful exception the vendor flags: in a limited-federation deployment, 'public' posts are intended to stay within a restricted set of servers, so scope-bypass subscription could leak posts to token holders who should not see them. No SSVC decision data was supplied in the input, so exploitation/automatable/technical-impact cannot be independently cited here. Bottom line: a real but minor defensive-depth bug, not an urgent patch-now emergency - schedule it in normal patch cadence, prioritizing limited-federation instances.

An attacker registers or obtains any OAuth application token on a target Mastodon instance with only a minimal scope (e.g. 'profile', lacking read:statuses), then connects to the streaming server and subscribes to a public channel such as 'public:local'. Because the server skipped scope enforcement for public channels, the client receives a live feed of new public posts it should not have been authorized to read - most impactful on a limited-federation instance where those posts were meant to stay internal. No public exploit code exists, though the vendor's patch commit and its regression tests precisely document the subscribe-and-receive steps.