Log in Start free

Vulnerability · Published Aug 10, 2026 · Assigned by GitHub_M

CVE-2026-72914Mastodon: Exhausting data by an unauthenticated request to the admin retention API

High 7.5

In plain English

A high-severity resource allocation without limits in mastodon from mastodon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.8%top 42.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused long-running SQL queries in Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension, allowing repeated requests to exhaust server resources. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.

Affected products (as reported)

VendorProductVersions
mastodon mastodon < 4.4.21>= 4.5.0-beta.1, < 4.5.14>= 4.6.0-beta.1, < 4.6.4

Weakness: CWE-405, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References