BIT-mastodon-2025-62605

    Dashboard / Vulnerabilities / BIT-mastodon-2025-62605

    BIT-mastodon-2025-62605

    Published: 23 Oct 2025Last Modified: 8 Sept 2026

    Summary: Mastodon quotes control can be bypassed

    Details: Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was added, but it is possible for an attacker to bypass these controls in Mastodon versions prior to 4.4.8 and 4.5.0. Mastodon internally treats reblogs as statuses. Since they were not special-treated, an attacker could reblog any post, then quote their reblog, technically quoting themselves, but having the quote feature a preview of the post they did not get authorization for with all of the affordances that would be otherwise denied by the quote controls. This issue has been patched in versions 4.4.8 and 4.5.0.

    References: https://github.com/mastodon/mastodon/commit/2dc4552229b55e2e4adaef675e68ed7ae123d78e, https://github.com/mastodon/mastodon/commit/405a49df44033e7d179f3d44d59fb68a67d54789, https://github.com/mastodon/mastodon/releases/tag/v4.4.8, https://github.com/mastodon/mastodon/releases/tag/v4.5.0-beta.2, https://github.com/mastodon/mastodon/security/advisories/GHSA-8h43-rcqj-wpc6, https://nvd.nist.gov/vuln/detail/CVE-2025-62605

    Affected packages

    Package

    Name: mastodon

    Purl: pkg:bitnami/mastodon

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 4.4.0
    Fixed -4.4.8

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-mastodon-2025-62605 | CVE-DB