Mastodon CVE-2025-67500

Exploitation requires that the attacker already knows the exact identifier of a specific status they are not authorized to view; the oracle is triggered by sending a request with a non-English Accept-Language header, exploiting a language-dependent error-handling discrepancy. It is unauthenticated (PR:N) and network-reachable, but strongly limited: it only confirms whether the status exists and cannot reveal content, author, or any other property, and it provides no enumeration capability since the identifier must be known in advance. Affects Mastodon versions ≤4.2.27, 4.3.0-beta.1-4.3.14, 4.4.0-beta.1-4.4.9, and 4.5.0-beta.1-4.5.2; fixed in 4.2.28, 4.3.15, 4.4.10, and 4.5.3.

This is a genuinely low-severity issue and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, base 3.7) describes an unauthenticated, network-reachable but high-complexity attack yielding only low confidentiality impact with no integrity or availability effect - matching CWE-204 (Observable Response Discrepancy). The low EPSS score (0.22%, 12th percentile) aligns with the low CVSS and the limited practical value of the flaw. It is NOT in CISA KEV and no public POC is referenced, so there is no evidence of active exploitation. The AC:H rating is well-justified: the attacker must already possess the exact status identifier they are not authorized to view, and the leak only confirms existence - not content, author, or any other property. Net assessment: this is a correctly-rated low-priority information-disclosure oracle, not a high-CVSS-but-low-real-risk mislabel. Patch promptly as routine hygiene, but it does not warrant emergency response. No key data is missing - vendor advisory, patch commit, CVSS, EPSS, and CWE are all present and mutually consistent.

An attacker who has obtained the opaque identifier of a private or otherwise non-visible Mastodon status (e.g. from a leaked link or guessed ID) sends an API request for that status while setting a non-English Accept-Language header. Because error handling differs by language, the differing response lets the attacker confirm whether the status actually exists. No public exploit code is identified at time of analysis, and the technique reveals existence only - never the content.