SNS

mastodon/mastodon

Your self-hosted, globally interconnected microblogging community

#mastodon#docker#microblog#activity-stream#webfinger#social-network#activitypub#fediverse#social-web

スコア

/ 100

Star

49,952

Fork

7,438

Open Issue

4,242

サイズ

372MB

言語

Ruby

最終push

0 日前

Docker

🐳 両方 ★

採点内訳

過去CVE 18件 (やや多い)

✓

直近 push: 0 日前

✓

得意言語 (Ruby)

—

オープンissue 4242件

✓

大規模 (372MB)

—

Docker 対応 (Dockerfile + compose)

✓

10k–50k: 中級 (★49,952)

—

※ 各項目の重みは「採点ルール」を参照。合計は 0 で底打ち。

過去の SecurityAdvisory (20 件)

HIGHGHSA-5r37-qpwq-2jhh CVE-2026-412592026/4/15
Insufficient verification of email addresses
MEDIUMGHSA-q4g8-82c5-9h33 CVE-2026-338692026/3/25
Denial of service for quote authorization
MEDIUMGHSA-xqw8-4j56-5hj6 CVE-2026-338682026/3/25
GET-Based Open Redirect via '/web/%2F<domain>'
HIGHGHSA-qgmm-vr4c-ggjg CVE-2026-274682026/2/24
Allowing unconfirmed FASP to make subscriptions
LOWGHSA-46w6-g98f-wxqm2026/2/24
SSRF via unvalidated FASP Provider base_url
MEDIUMGHSA-ccpr-m53r-mfwr CVE-2026-255402026/2/3
Signature-dependent ActivityPub collection responses cached under signature-independent keys
HIGHGHSA-gg8q-rcg7-p79g CVE-2026-239622026/1/20
Denial of Service from a single post (client/server)
MEDIUMGHSA-f3q8-7vw3-69v4 CVE-2026-239642026/1/20
Insufficient access control to push notification settings
MEDIUMGHSA-5h2f-wg8j-xqwp CVE-2026-239612026/1/20
Remote suspension bypass
MEDIUMGHSA-ww85-x9cp-5v24 CVE-2026-222462026/1/7
Local users can enumerate and access severed relationships of every other local user
HIGHGHSA-xfrj-c749-jxxq CVE-2026-222452026/1/7
SSRF Protection bypass
LOWGHSA-gwhw-gcjx-72v8 CVE-2025-675002025/12/8
Inconsistent error handling allows anonymously checking existence of known private posts
MEDIUMGHSA-8h43-rcqj-wpc6 CVE-2025-626052025/10/21
Quotes control bypass
MEDIUMGHSA-r2fh-jr9c-9pxh CVE-2025-621752025/10/13
Disabled and suspended user accounts stay connected to the streaming API and can connect afterwards
LOWGHSA-f3q3-rmf7-9655 CVE-2025-621742025/10/13
Changing a user's password via CLI does not revoke sessions & access tokens
MEDIUMGHSA-7gwh-mw97-qjgp CVE-2025-621762025/10/13
Streaming server allows OAuth clients without the `read` scope to subscribe to public channels
MEDIUMGHSA-84ch-6436-c7mg CVE-2025-548792025/8/5
Mastodon confirmation e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails
LOWGHSA-x2rc-v5wx-g3m52025/5/6
Lack of sanitization of user-facing URLs for remote objects can lead to XSS in misconfigured servers
MEDIUMGHSA-v39f-c9jj-8w7h CVE-2025-271572025/2/27
Missing rate-limit on sign-up email verification
MEDIUMGHSA-94h4-fj37-c825 CVE-2025-273992025/2/27
Domain blocks & rationales ignore user approval when visibility set as "users"