Mastodon’s private address detection logic fails to detect IPv4-compatible IPv6 addresses, allowing an attacker to supply such an address in a request that bypasses the ALLOWED_PRIVATE_ADDRESSES protection. By doing so, the server can be tricked into making HTTP requests to loopback interfaces, potentially exposing internal services and resources that should remain inaccessible. This flaw is a classic SSRF protection bypass but does not grant arbitrary remote code execution. The weakness is captured under CWE-1286 (Inadequate Access Control) and CWE-918 (Server-Side Request Forgery).

The vulnerability impacts any Mastodon installation running a version older than 4.4.21, 4.5.14, 4.6.4, or 4.7.0‑beta.1. The affected product is the Mastodon social network server. All earlier releases in the main line are susceptible unless customized configurations remove the use of IPv4-compatible IPv6 addresses.

The CVSS score of 6.3 indicates moderate severity. Exploitation requires a system that still supports IPv4-compatible IPv6, which is rare in modern deployments, so the practical likelihood is limited but not negligible. The EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not a widely observed or actively exploited threat. Nevertheless, an attacker with network access to a Mastodon instance could craft a request containing an IPv4-compatible IPv6 address to induce internal HTTP traffic to localhost and potentially retrieve sensitive data or call privileged APIs.