EUVD-2026-55837Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-accessible admin API endpoint, no authentication required, no user interaction; impact is exclusively availability via database resource exhaustion with no confidentiality or integrity effect.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused long-running SQL queries in Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension, allowing repeated requests to exhaust server resources. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.
AnalysisAI
Unauthenticated denial-of-service in Mastodon's admin statistics API allows any remote caller to exhaust server database resources by submitting crafted requests to the measures and retention endpoints before authorization is enforced. Mastodon instances on versions prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1 are exposed; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, authentication-free exploitation at network range. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The /api/v1/admin/measures and /api/v1/admin/retention endpoints are accessible on the default network interface of any publicly deployed Mastodon instance - no special configuration is required to expose them. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the trivially low attack complexity: any unauthenticated network actor can send repeated POST requests to the admin statistics endpoints and force expensive database work. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a publicly reachable Mastodon instance and scribes repeated POST requests to /api/v1/admin/measures supplying a start_at value set years in the past and an end_at in the present, maximizing the SQL query scan range. Each request causes the Mastodon application to execute expensive aggregate queries against the PostgreSQL database before checking whether the caller holds admin privileges. … |
| Remediation | Upgrade to Mastodon 4.4.21, 4.5.14, 4.6.4, or 4.7.0-beta.1 depending on the installed branch; release artifacts and changelogs are available at https://github.com/mastodon/mastodon/releases/tag/v4.4.21, https://github.com/mastodon/mastodon/releases/tag/v4.5.14, and https://github.com/mastodon/mastodon/releases/tag/v4.6.4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Mastodon deployments to identify instances running vulnerable versions (pre-4.4.21, pre-4.5.14, pre-4.6.4, pre-4.7.0) by checking version endpoints or admin interfaces. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today