Mastodon versions 4.4.0 through 4.4.13 and 4.5.0 through 4.5.6 allow unapproved freeloading active subscriptions proposals (FASP) to register and request content backfill. The failure to verify that the FASP account is fully approved leads to small but public URI leaks, and repeated calls can overload the sidekiq worker that handles the fasp queue, causing a denial of service. This weakness falls under improper authorization.

The affected software is Mastodon, specifically the release series 4.4.x up to 4.4.13 and 4.5.x up to 4.5.6. Only servers that have enabled the experimental FASP feature via the environment variable EXPERIMENTAL_FEATURES that includes fasp are impacted; servers that do not enable this flag are not at risk.

The CVSS score is 4.8, EPSS is less than 1%, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalogue. The attack vector is likely remote, as an attacker can trigger the vulnerable endpoints without local access. Because the flaw permits repeated subscription creation and content backfill without authorization, exploitation could lead to minor information disclosure and, with enough repeated requests, denial of service against the sidekiq stack. Admins using the experimental fasp flag should prioritize the patch or mitigation to reduce risk.