BIT-mastodon-2025-62605

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/mastodon/BIT-mastodon-2025-62605.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-mastodon-2025-62605
Aliases
Published
2025-10-23T08:44:09.997Z
Modified
2025-10-23T09:27:18.632529Z
Summary
Mastodon quotes control can be bypassed
Details

Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was added, but it is possible for an attacker to bypass these controls in Mastodon versions prior to 4.4.8 and 4.5.0-beta.2. Mastodon internally treats reblogs as statuses. Since they were not special-treated, an attacker could reblog any post, then quote their reblog, technically quoting themselves, but having the quote feature a preview of the post they did not get authorization for with all of the affordances that would be otherwise denied by the quote controls. This issue has been patched in versions 4.4.8 and 4.5.0-beta.2.

Database specific 
{
    "severity": "Medium",
    "cpes": [
        "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*"
    ]
}
References

Affected packages

Bitnami / mastodon

Package

Name
mastodon
Purl
pkg:bitnami/mastodon

Severity

  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
4.4.0-beta.1
Fixed
4.4.8
Introduced
4.5.0-beta.1
Fixed
4.5.0-beta.2