CVE-2025-62605

Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was added, but it is possible for an attacker to bypass these controls in Mastodon versions prior to 4.4.8 and 4.5.0-beta.2. Mastodon internally treats reblogs as statuses. Since they were not special-treated, an attacker could reblog any post, then quote their reblog, technically quoting themselves, but having the quote feature a preview of the post they did not get authorization for with all of the affordances that would be otherwise denied by the quote controls. This issue has been patched in versions 4.4.8 and 4.5.0-beta.2.

• CWE-754

• https://github.com/mastodon/mastodon/commit/2dc4552229b55e2e4adaef675e68ed7ae123d78ePatch
• https://github.com/mastodon/mastodon/commit/405a49df44033e7d179f3d44d59fb68a67d54789Patch
• https://github.com/mastodon/mastodon/releases/tag/v4.4.8Release Notes
• https://github.com/mastodon/mastodon/releases/tag/v4.5.0-beta.2Release Notes
• https://github.com/mastodon/mastodon/security/advisories/GHSA-8h43-rcqj-wpc6Vendor Advisory

Published

Oct 21, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6260The embedded web server on the thermostat listed version ran…9.8
• CVE-2025-62600eprosima Fast DDS is a C++ implementation of the DDS (Data D…7.5
• CVE-2025-62601Fast DDS is a C++ implementation of the DDS (Data Distributi…7.5
• CVE-2025-62602Fast DDS is a C++ implementation of the DDS (Data Distributi…7.5
• CVE-2025-62603Fast DDS is a C++ implementation of the DDS (Data Distributi…7.5
• CVE-2025-62604MeterSphere is an open source continuous testing platform. P…7.5
• CVE-2025-62606my little forum is a PHP and MySQL based internet forum that…8.8
• CVE-2025-62607Nautobot Single Source of Truth (SSoT) is an app for Nautobo…5.3
• CVE-2025-62608MLX is an array framework for machine learning on Apple sili…9.1
• CVE-2025-62609MLX is an array framework for machine learning on Apple sili…7.5
• CVE-2025-6261The Fleetwire Fleet Management plugin for WordPress is vulne…6.4
• CVE-2025-62610Hono is a Web application framework that provides support fo…8.1