CVE-2025-67500: 
NixOS vulnerability analysis and mitigation

CVE-2025-67500 is an information disclosure vulnerability in Mastodon, the open-source federated social network server, caused by inconsistent error handling that allows unauthenticated attackers to confirm the existence of private or restricted statuses. Affected versions include all releases prior to 4.2.28, 4.3.0 through 4.3.14, 4.4.0 through 4.4.9, and 4.5.0 through 4.5.2. The vulnerability was published on December 8–10, 2025, and carries a CVSS v3.1 base score of 3.7 (Low) (GitHub Advisory, Feedly).

The root cause is an Observable Response Discrepancy (CWE-204) in Mastodon's error handling logic when re-fetching already-known statuses. When a request is made with a non-English Accept-Language header to retrieve a status the requester is not authorized to view, the server returns a discernibly different error response compared to a request for a status that does not exist at all. This behavioral difference allows an attacker who already knows a status identifier to probe whether that status exists, without gaining access to its content or metadata. The fix, merged in PR #37077, corrects the STATUS_FETCH_FAIL reducer to use a removeStatusStub function that preserves existing status stubs rather than unconditionally deleting them, eliminating the observable discrepancy (GitHub Advisory, GitHub Patch).

Exploitation allows an unauthenticated attacker to enumerate the existence of specific statuses (posts) on a Mastodon instance that they are not permitted to view, such as followers-only or private posts. The attacker cannot access the content, author, timestamp, or any other property of the status — only its existence can be confirmed. While the direct impact is limited to a low confidentiality breach, this could be used to infer user activity patterns or confirm the presence of sensitive content on an instance (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The attack requires no authentication and no user interaction, but does require the attacker to already know the identifier of the target status, raising the practical bar for exploitation. The EPSS score is 0.028% (0.000280), reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Obtain a status identifier: The attacker must already know the numeric or alphanumeric identifier of a Mastodon status they are not authorized to view (e.g., obtained through a public reference, federated activity, or prior enumeration).
2. Craft a request with a non-English Accept-Language header: Send an HTTP GET request to the Mastodon instance's status endpoint (e.g., /api/v1/statuses/<id>) including a non-English Accept-Language header (e.g., Accept-Language: fr).
3. Observe the error response: Compare the server's response to the crafted request against the response for a known non-existent status ID. A discrepancy in the error type or message indicates the target status exists, even if its content is not returned.
4. Enumerate status existence: Repeat the process across multiple known or guessed status identifiers to map which private or restricted statuses exist on the instance (GitHub Advisory, GitHub Patch).

• Network: Repeated unauthenticated HTTP GET requests to /api/v1/statuses/<id> endpoints with non-English Accept-Language headers (e.g., Accept-Language: fr, Accept-Language: de) from a single IP or user agent.
• Logs: Web server or application logs showing high volumes of 404/403 responses to status API endpoints from unauthenticated clients, particularly with varied status IDs and non-English language headers.
• Behavioral: Systematic sequential or pattern-based probing of status IDs suggesting automated enumeration rather than organic user activity.

Mastodon has released patched versions addressing this vulnerability: 4.2.28, 4.3.15, 4.4.10, and 4.5.3. Instance administrators should upgrade to the appropriate patched release as the primary remediation. For instances unable to patch immediately, monitoring for unusual probing of the status API with non-English Accept-Language headers and implementing rate limiting on unauthenticated API requests can reduce exposure (GitHub Advisory).

The vulnerability was reported by security researcher sugar700 and the advisory was published by Mastodon maintainer renchap on December 8, 2025. The severity was assessed as Low (3.7), and community reaction has been minimal given the limited practical impact — an attacker can only confirm existence, not access content. No significant media coverage or notable researcher commentary beyond the official advisory has been observed (GitHub Advisory).