The vulnerability exists in Mastodon's administrative statistics endpoints, which perform lengthy SQL queries without checking authorization until after the expensive calculations begin. An unauthenticated user can supply arbitrary key, start_at, and end_at parameters that trigger these queries, which can consume a large amount of CPU, memory, and I/O. The result is a denial‑of‑service condition, allowing an attacker to exhaust server resources and potentially disrupt service availability.

Affected servers run Mastodon up to and including the unstable release 4.7.0-beta.1 and the stable releases 4.4.20, 4.5.13, and 4.6.3. Any instance that has not yet applied the patches found in releases 4.4.21, 4.5.14, 4.6.4, or 4.7.0-beta.1 is vulnerable. The issue is triggered through the publicly reachable /api/v1/admin/measures and /api/v1/admin/retention endpoints.

The CVSS base score of 7.5 classifies the vulnerability as high severity. While an EPSS score is not available, the lack of a KEV listing does not preclude exploitation; the attacker only needs network access to the targeted API. Because the vulnerability can be invoked from the internet without prior authentication, the likelihood of exploitation is significant for exposed instances, especially those with loosened rate‑limiting or no ingress protection. Mitigating the risk requires patching or restricting network access to these endpoints.