Skip to content
Schedule Social Media
SchedulersNetworksAPI changesGuidesToolsCompareFind your schedulerNews

Press Esc to close.
Security Mastodon Severity: medium

Mastodon 4.2.10 and 4.1.18 fix API permission checks and posts scheduled under 5 minutes ahead

Announced4 Jul 2024
Effective4 Jul 2024
StatusIn effect

What changed

Mastodon 4.2.10 and 4.1.18, released July 4, 2024, fix incorrect permission checking on multiple API endpoints (GHSA-58x8-3qxw-6hm7), incorrect authorship checking when processing some activities (CVE-2024-37903) and ongoing streaming sessions not being invalidated when application tokens are revoked (GHSA-vp5r-5pgw-jwqx). Both also fix scheduled statuses scheduled in less than 5 minutes being immediately published.

What it means

Unpatched servers checked permissions incorrectly on several API endpoints and kept streaming sessions open after an app's token was revoked. Both releases also stop posts scheduled less than 5 minutes ahead from being published at once.

Who is affected

Mastodon server admins, Mastodon clients that use streaming, and scheduling tools that create scheduled posts close to their publish time.

What to do by 4 Jul 2024

Admins should run 4.2.10, 4.1.18 or later. Scheduling tools should send scheduled_at at least 5 minutes in the future, as the API documentation requires.

What this means for you

Mastodon fixed three safety bugs in July 2024. One meant some parts of the system did not check properly who was allowed to do what. Another kept a disconnected app receiving live updates. The same update fixed a scheduling bug: a post planned for less than 5 minutes later could go out straight away. Servers that updated are fine.

The details

  • Released: 4.2.10 and 4.1.18 on July 4, 2024.
  • Security fixes in both:
    • "Fix incorrect permission checking on multiple API endpoints" (GHSA-58x8-3qxw-6hm7). The changelog does not name the endpoints.
    • "Fix incorrect authorship checking when processing some activities" (CVE-2024-37903, GHSA-xjvf-fm67-4qc3).
    • "Fix ongoing streaming sessions not being invalidated when application tokens get revoked" (GHSA-vp5r-5pgw-jwqx).
  • Scheduling fix in both: "Fix scheduled statuses scheduled in less than 5 minutes being immediately published". This concerns POST /api/v1/statuses with scheduled_at, which the API documentation says "Must be at least 5 minutes in the future." The changelog does not say what a server returns for such a request after the fix, so check the response instead of assuming a ScheduledStatus.
  • The advisories hold the details; they were not readable from our checker, so they are not summarised here.

What to do next

  • Business owners: Nothing, if your Mastodon server has updated since July 2024.
  • Marketers and agencies: Schedule Mastodon posts at least 5 minutes ahead to avoid surprises on older servers.
  • Developers: Check the server version from /api/v2/instance and keep scheduled_at at least 5 minutes in the future.

Primary sources

Checked against the source 7 Nov 2026

Get an email when a new API change is added

Follow new entries with the RSS feed. Each platform also has its own feed, for example X or Meta.