Mastodon prior to versions 4.3.19, 4.4.13, and 4.5.6 stored content retrieved from the ActivityPub endpoints for pinned posts and featured hashtags in an internal cache that ignores the signature of the requesting actor. If an actor is blocked, the cached response may be an empty or incomplete payload; if an actor is authorized, the cached response may contain content intended for other actors. The vulnerability allows legitimate users to receive incorrect or potentially sensitive data, undermining the integrity of the content served and exposing the platform to information leakage.

Mastodon, the open‑source social network server based on ActivityPub. All releases before 4.3.19, 4.4.13, and 4.5.6 are affected. The vulnerability manifests when the AUTHORIZED_FETCH setting is enabled and the Rails cache is used for ActivityPub collection responses.

The CVSS score of 6.5 reflects moderate impact, while the EPSS score of less than 1% indicates a low probability of ongoing exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the issue by making requests to the pinned posts or featured hashtags endpoints while signed as an actor whose cache key is shared across different actors. If the attacker controls a blocked actor account, they may receive empty responses, and if they control a non‑blocked actor, they may obtain content meant for other actors. The attack requires authentication to sign requests but can be performed either by a legitimate user or a compromised account. Because the cache persists across requests, the exploit can affect many users until the cache is purged or the application is updated.