Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

Mastodon: Impersonation and Takeover of Remote Accounts

CVE-2024-23832 · published 2 years ago
Summary

Old versions of Mastodon's social network software allow attackers to pretend to be other users and take control of their accounts. This is a significant risk because it could be used to spread misinformation or steal sensitive information. Update to the latest version of Mastodon to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
joinmastodon mastodon < 3.5.17
>= 4.0.0, < 4.0.13
>= 4.1.0, < 4.1.13
>= 4.2.0, < 4.2.5
cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*
Original advisory text
Mastodon Remote user impersonation and takeover
Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is vulnerable, as well as 4.0.x versions prior to 4.0.13, 4.1.x version prior to 4.1.13, and 4.2.x versions prior to 4.2.5.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.4 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-290Authentication Bypass by Spoofing
Timeline
Published1 Feb 2024
Updated29 Oct 2026
First seen5 Aug 2026
Sources
CVE-2024-23832 · OSV
GHSA-3fjr-858r-92rw · GHSA
CVE-2024-23832 · NVD
Track software like this
Free during beta