CVE-2022-24307

CRITICAL 9.8CVE-2022-24307 · Published 03/02/2022 · updated 17/06/2026

In short

CVE-2022-24307 is a CRITICAL (CVSS 9.8) vulnerability affecting mastodon (joinmastodon).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 73.4% of all vulnerabilities.
Fix: update to 3.4.6, 3.3.2 or later.

Package	Affected versions	Patched versions
mastodon joinmastodon	`≥ 3.4.0, < 3.4.6< 3.3.2`	`3.4.63.3.2`

Description

Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not compact incoming signed JSON-LD activities. (JSON-LD signing has been supported since version 1.6.0.)

References

mastodon/mastodon release v3.3.2 · Release Notes
mastodon/mastodon release v3.4.6 · Release Notes

More vulnerabilities in mastodon

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mastodon

joinmastodon

≥ 3.4.0, < 3.4.6< 3.3.2

3.4.63.3.2

More vulnerabilities in mastodon

See all →