Mastodon, a decentralized social network server, contains an insecure direct object reference that permits any authenticated user to alter another user's web push subscription settings when the numeric subscription ID is known. This flaw allows an attacker to disrupt or modify the delivery policy of a victim's push notifications and to leak the subscription endpoint to the attacker. The weakness is rooted in improper access control over the subscription object and is classified under CWE‑639 and CWE‑863.

Mastodon servers running versions earlier than 4.3.18, 4.4.12, or 4.5.5 are vulnerable. Any user who has a web push subscription is potentially at risk because other authenticated users can guess or obtain subscription identifiers and modify their settings.

The flaw requires the attacker to be authenticated to the Mastodon instance and to guess or otherwise acquire a subscription ID, so it is not publicly exploitable. The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but the impact can be significant for users relying on push notifications. Given the moderate severity and access requirement, the overall risk for impacted servers is moderate.