CVE-2022-48364: Joinmastodon Mastodon

Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days.

The undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon 3.5.x before 3.5.3 does not use the server's representative account, resulting in moderator identity disclosure when a moderator approves the appeal of a user whose status update was marked as sensitive.

Affected products

• Joinmastodon Mastodon: from 3.5.0, before 3.5.3 (fixed in 3.5.3)

Published 2023-03-06. Last modified 2026-06-17.