Description

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused long-running SQL queries in Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension, allowing repeated requests to exhaust server resources. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T22:17:10.193Z",
  "pubdate": "2026-08-10T22:17:10.193Z",
  "executiveSummary": "A denial of service vulnerability exists within Mastodon administrative statistics endpoints, specifically handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController. The vulnerability stems from improper authorization enforcement, where access control checks are performed only after the initiation of computationally expensive database operations. Anonymous threat actors can exploit this flaw by submitting targeted parameters, such as keys, start_at, and end_at, which trigger long-running SQL queries across Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension. By issuing repeated requests, an attacker can exhaust server database and CPU resources, causing service degradation or complete availability loss for legitimate users. No prior authentication or administrative privileges are required to initiate these resource-intensive queries over the network. The vulnerability affects Mastodon versions prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1. Mitigation requires applying the official software updates provided by the vendor.",
  "technicalDetails": "The vulnerability is rooted in a flawed execution order within the authorization and request handling lifecycle of administrative statistics endpoints in Mastodon. Specifically, the affected controllers Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController fail to validate the caller's authorization credentials prior to dispatching requests to the underlying metrics processing classes: Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension. Because authentication and privilege checks are deferred until after resource allocation and calculation have commenced, unauthenticated, anonymous network callers can interact with these endpoints.\nThe attack vector involves supplying arbitrary query parameters—namely keys, start_at, and end_at—via HTTP requests to the vulnerable administrative endpoints. These input parameters dictate the scope and granularity of metrics generation, compelling the database abstraction layer to construct and execute complex, highly resource-intensive SQL queries. These queries involve heavy aggregations, joins, and range scans over large datasets related to platform usage and user retention.\nThe step-wise attack flow proceeds as follows: First, an anonymous attacker transmits a crafted HTTP request containing heavy query parameters to the unprotected administrative statistics endpoints. Second, the Mastodon application routes the request to the respective measure or retention controllers. Third, instead of immediately validating the session token or administrative role, the application instantiates the metric calculation logic and executes the expensive SQL queries against the database backend. Fourth, the database server expends significant CPU, memory, and I/O resources processing the heavy query workload. Fifth, by concurrently or repeatedly flooding the endpoint with such requests, the attacker induces resource exhaustion, resulting in connection pool saturation, thread starvation, and application-wide denial of service.\nThe vulnerable components comprise Api::V1::Admin::MeasuresController, Api::V1::Admin::RetentionController, Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension. The affected software versions include all instances of Mastodon prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1. Exploitation requires network access to the Mastodon server instance but requires no authentication or administrative privileges."
}