CVE-2026-72914 json
Mastodon: Exhausting data by an unauthenticated request to the admin retention API
published 2026-08-10 2 mo ago modified 2026-09-09 2 mo ago also BIT-mastodon-2026-72914 , EUVD-2026-55837 , GHSA-7jvv-fhmg-wpfw
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 57%
- public exploits
- 0
- none known
Summary
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused long-running SQL queries in Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension, allowing repeated requests to exhaust server resources. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.
Patch / fix
- bitnami mastodon 4.4.21, 4.5.14, 4.6.4
- joinmastodon mastodon 4.4.21, 4.5.14, 4.6.4
- github.com/mastodon/mastodon@18c61f2 commit
- github.com/mastodon/mastodon@467c933 commit
- github.com/mastodon/mastodon@930aa9f commit
- github.com/mastodon/mastodon@da47a1b commit
- github.com/mastodon/mastodon/releases/tag/v4.4.21 release
- github.com/mastodon/mastodon/releases/tag/v4.5.14 release
- github.com/mastodon/mastodon/releases/tag/v4.6.4 release
- github.com/mastodon/mastodon/releases/tag/v4.7.0-beta.1 release
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.83% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | mastodon | <4.4.21 >=4.5.0, <4.5.14 >=4.6.0, <4.6.4 |
4.4.21 4.5.14 4.6.4 |
Affected products
- mastodon mastodon
Classification
References
-
github.com
/mastodon/mastodon/commit/18c61f286f1f5718a8f517940ba384866ffa3892
web
-
github.com
/mastodon/mastodon/commit/467c933459c7d0e5513475b9e4888afaedfb1074
web
-
github.com
/mastodon/mastodon/commit/930aa9fee26bf9eaefe27826fa1061288d83373b
web
-
github.com
/mastodon/mastodon/commit/da47a1bd3cd07935d7ca55a1f4f1a76f7f167e0d
web
-
github.com
/mastodon/mastodon/security/advisories/GHSA-7jvv-fhmg-wpfw
web
-
github.com
/mastodon/mastodon/releases/tag/v4.4.21
web
-
github.com
/mastodon/mastodon/releases/tag/v4.5.14
web
-
github.com
/mastodon/mastodon/releases/tag/v4.6.4
web
-
github.com
/mastodon/mastodon/releases/tag/v4.7.0-beta.1
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-72914
web
Sources
- CVE List CVE-2026-72914
- NVD CVE-2026-72914
- OSV BIT-mastodon-2026-72914
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.