The vulnerability allows a registered local user to retrieve the list of users that were lost followers or followed as a result of any severance event. Although the account name that lost follows or followers is not disclosed, the attack reveals the scope of the moderation action, leaking sensitive user relationship data. The flaw is a failure to enforce proper ownership checks on the severed relationship download API, corresponding to CWE-201 (Access Control Failure).

Mastodon servers running the free, open‑source social network software, specifically versions 4.3 through 4.3.16, 4.4.0–4.4.10, and 4.5.0–4.5.3 are affected. The issue is resolved in Mastodon v4.3.17, v4.4.11, and v4.5.4. Any registered local user on a vulnerable instance can exploit the flaw.

The CVSS score is 6.5, indicating moderate severity. EPSS is below 1%, showing a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only local access to the server’s API and does not rely on remote code execution or elevated privileges, making it relatively straightforward for an authenticated user to enumerate severance events.