Mastodon Domain Block Visibility Vulnerability for Unapproved Users

A vulnerability exists in Mastodon, a self-hosted microblogging platform, in versions prior to 4.1.23, 4.2.16, and 4.3.4. When domain block visibility is set to 'users', unapproved and unconfirmed users can still view block reasons. This issue affects instance admins who wish to keep domain blocks private.

Impact

This vulnerability allows unapproved and unconfirmed users to access domain block information, which could lead to unintended exposure of moderation decisions.

Reproduction

To reproduce this vulnerability, set the domain block visibility to 'users'. Then, log in with an account that is unapproved and has not confirmed the email address. The domain block reasons can be accessed through the API, despite the account's status.

Remediation

Users can update to Mastodon versions 4.1.23, 4.2.16, or 4.3.4 to address this vulnerability.