Critical
Mastodon Remote user impersonation and takeover
Type: advisorySources: OSV
Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is vulnerable, as well as 4.0.x versions prior to 4.0.13, 4.1.x version prior to 4.1.13, and 4.2.x versions prior to 4.2.5.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2024-23832
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 03:05 UTC · Revision 1
Source evidence
Mastodon Remote user impersonation and takeover
core-osv · Original sourcePublished 1 Feb 2024, 16:18 UTC
Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is vulnerable, as well as 4.0.x versions prior to 4.0.13, 4.1.x version prior to 4.1.13, and 4.2.x versions prior to 4.2.5.
osv:CVE-2024-23832
Complete source record
{
"id": "084938d154effe71cd3aa7c6a7a43f5d4fae9ab6635f9982f8d41440c6559cac",
"url": "https://osv.dev/vulnerability/CVE-2024-23832",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Mastodon Remote user impersonation and takeover",
"summary": "Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is vulnerable, as well as 4.0.x versions prior to 4.0.13, 4.1.x version prior to 4.1.13, and 4.2.x versions prior to 4.2.5.",
"evidence": "osv:CVE-2024-23832",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2024-23832",
"aliases": [
"BIT-mastodon-2024-23832",
"CVE-2024-23832",
"GHSA-3fjr-858r-92rw"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/mastodon/mastodon",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "b1ed009c65802b70c9b780f3c7c3a866cba72478"
},
{
"introduced": "fb389bd73c8a4bc2924496f6041c8eee27572d21"
},
{
"fixed": "befd534eb832feedca401f7dd2cb9225d4599213"
},
{
"introduced": "61c5dfb9295ea66c376c452a7ef7379e8c562416"
},
{
"fixed": "5799bc4af76813294a9eee8164d64a96612c0c0d"
},
{
"introduced": "4fcc026f0f1b12a9de21a3af33375a9c8867dd55"
},
{
"fixed": "a6641f828b9e6f5806be01754318279c2532ae82"
},
{
"fixed": "1726085db5cd73dd30953da858f9887bcc90b958"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.5.17"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.13"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1.0"
},
{
"fixed": "4.1.13"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.5"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "1726085db5cd73dd30953da858f9887bcc90b958"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v3.5.16",
"v4.0.12",
"v4.1.12",
"v4.2.4",
"v4.2.3",
"v4.1.11",
"v4.2.2",
"v4.1.10",
"v3.5.15",
"v4.2.1",
"v4.2.0",
"v4.0.11",
"v3.5.14",
"v4.1.9",
"v4.0.10",
"v4.1.8",
"v4.1.7",
"v4.0.9",
"v3.5.13",
"v3.5.12",
"v4.0.8",
"v4.1.6",
"v3.5.11",
"v4.0.7",
"v4.1.5",
"v4.0.6",
"v3.5.10",
"v4.1.4",
"v4.1.3",
"v4.0.5",
"v3.5.9",
"v3.5.8",
"v4.0.4",
"v4.1.2",
"v4.1.1",
"v4.0.3",
"v3.5.7",
"v3.5.6",
"v4.0.2",
"v4.1.0",
"v3.5.5",
"v4.0.1",
"v3.5.4",
"v4.0.0",
"v3.5.3",
"v3.5.2",
"v3.5.1",
"v3.5.0",
"v3.5.0rc3",
"v3.5.0rc2",
"v3.5.0rc1",
"v3.3.0",
"v3.4.1",
"v3.4.0",
"v3.4.0rc2",
"v3.4.0rc1",
"v3.3.0rc3",
"v3.3.0rc2",
"v3.3.0rc1",
"v3.2.0",
"v3.2.0rc2",
"v3.2.0rc1",
"v3.1.4",
"v3.1.3",
"v3.1.2",
"v3.0.1",
"v3.1.1",
"v3.1.0",
"v3.1.0rc2",
"v3.1.0rc1",
"v3.0.0",
"v3.0.0rc3",
"v3.0.0rc2",
"v3.0.0rc1",
"v2.9.2",
"v2.9.1",
"v2.9.0",
"v2.9.0rc2",
"v2.9.0rc1",
"v2.8.2",
"v2.8.1",
"v2.8.0",
"v2.8.0rc3",
"v2.8.0rc2",
"v2.8.0rc1",
"v2.7.1",
"v2.7.0",
"v2.7.0rc3",
"v2.7.0rc2",
"v2.7.0rc1",
"v2.6.1",
"v2.6.0",
"v2.6.0rc4",
"v2.6.0rc3",
"v2.6.0rc2",
"v2.6.0rc1",
"v2.5.0",
"v2.5.0rc2",
"v2.5.0rc1",
"v2.4.3",
"v2.4.3rc3",
"v2.4.3rc2",
"v2.4.3rc1",
"v2.4.2",
"v2.4.2rc3",
"v2.4.2rc2",
"v2.4.2rc1",
"v2.4.1",
"v2.4.1rc4",
"v2.4.1rc3",
"v2.4.1rc2",
"v2.4.1rc1",
"v2.4.0",
"v2.4.0rc5",
"v2.4.0rc4",
"v2.4.0rc3",
"v2.4.0rc2",
"v2.4.0rc1",
"v2.3.2",
"v2.3.2rc5",
"v2.3.2rc4",
"v2.3.2rc3",
"v2.3.2rc2",
"v2.3.2rc1",
"v2.3.1",
"v2.3.1rc3",
"v2.3.1rc2",
"v2.3.1rc1",
"v2.3.0",
"v2.3.0rc3",
"v2.3.0rc2",
"v2.3.0rc1",
"v2.2.0",
"v2.2.0rc2",
"v2.2.0rc1",
"v2.1.3",
"v2.1.2",
"v2.1.1",
"v2.1.0",
"v2.1.0rc6",
"v2.1.0rc5",
"v2.1.0rc4",
"v2.1.0rc3",
"v2.1.0rc2",
"v2.1.0rc1",
"v2.0.0",
"v2.0.0rc4",
"v2.0.0rc3",
"v2.0.0rc2",
"v2.0.0rc1",
"v1.6.1",
"v1.6.0",
"v1.6.0rc5",
"v1.6.0rc4",
"v1.6.0rc3",
"v1.6.0rc2",
"v1.6.0rc1",
"v1.5.1",
"v1.5.0",
"v1.5.0rc3",
"v1.5.0rc2",
"v1.5.0rc1",
"v1.4.7",
"v1.4.6",
"v1.4.5",
"v1.4.4",
"v1.4.3",
"v1.4.2",
"v1.4.1",
"v1.4rc6",
"v1.4rc5",
"v1.4rc4",
"v1.4rc3",
"v1.4rc2",
"v1.4rc1",
"v1.3.2",
"v1.3.1",
"v1.3",
"v1.2.2",
"v1.2.1",
"v1.2",
"v1.1.2",
"v1.1.1",
"v1.1",
"v1.0",
"v0.9.9",
"v0.9",
"v0.8",
"v0.7",
"v0.6",
"v0.1.2",
"v0.1.1",
"v0.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23832.json"
}
}
],
"modified": "2026-10-28T02:30:33.004961460Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23832.json",
"https://github.com/mastodon/mastodon/security/advisories/GHSA-3fjr-858r-92rw",
"https://nvd.nist.gov/vuln/detail/CVE-2024-23832",
"https://github.com/mastodon/mastodon/commit/1726085db5cd73dd30953da858f9887bcc90b958"
],
"provider_metadata": {
"cwe_ids": [
"CWE-290"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23832.json"
}
},
"related_cves": [
{
"value": "CVE-2024-23832",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 499895,
"published_at": "2024-02-01T16:18:03.528+00:00"
}