UpHeron
All vulnerabilities

Servers and applications

CVE-2025-62605

Quotes control bypass

Severity
Medium 4.3
Published
21 Oct 2025
Last changed
19 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.4.8
Also known as
GHSA-8h43-rcqj-wpc6
Sources
NVD, Project advisories (GitHub)

Description

Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was added, but it is possible for an attacker to bypass these controls in Mastodon versions prior to 4.4.8 and 4.5.0-beta.2. Mastodon internally treats reblogs as statuses. Since they were not special-treated, an attacker could reblog any…

Affected software

SoftwareAffected versions
MastodonServers and applications · cpe:a:joinmastodon:mastodon
  • From 4.4.0 before 4.4.8
  • Version 4.5.0-beta1
MastodonServers and applications · github:mastodon/mastodon
  • Every version before 4.4.8

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-62605
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-62605
  • GitHub Advisory Database https://github.com/advisories/GHSA-8h43-rcqj-wpc6
  • github.com https://github.com/mastodon/mastodon/security/advisories/GHSA-8h43-rcqj-wpc6