CVE-2025-62605

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-62605", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-10-16T19:24:37.267Z", "datePublished": "2025-10-21T16:46:37.879Z", "dateUpdated": "2025-10-21T18:00:16.343Z"}, "containers": {"cna": {"title": "Mastodon quotes control can be bypassed", "problemTypes": [{"descriptions": [{"cweId": "CWE-754", "lang": "en", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-8h43-rcqj-wpc6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-8h43-rcqj-wpc6"}, {"name": "https://github.com/mastodon/mastodon/commit/2dc4552229b55e2e4adaef675e68ed7ae123d78e", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/commit/2dc4552229b55e2e4adaef675e68ed7ae123d78e"}, {"name": "https://github.com/mastodon/mastodon/commit/405a49df44033e7d179f3d44d59fb68a67d54789", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/commit/405a49df44033e7d179f3d44d59fb68a67d54789"}, {"name": "https://github.com/mastodon/mastodon/releases/tag/v4.4.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.4.8"}, {"name": "https://github.com/mastodon/mastodon/releases/tag/v4.5.0-beta.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.5.0-beta.2"}], "affected": [{"vendor": "mastodon", "product": "mastodon", "versions": [{"version": ">= 4.4.0-beta.1, < 4.4.8", "status": "affected"}, {"version": "= 4.5.0-beta.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-21T16:46:37.879Z"}, "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was added, but it is possible for an attacker to bypass these controls in Mastodon versions prior to 4.4.8 and 4.5.0-beta.2. Mastodon internally treats reblogs as statuses. Since they were not special-treated, an attacker could reblog any post, then quote their reblog, technically quoting themselves, but having the quote feature a preview of the post they did not get authorization for with all of the affordances that would be otherwise denied by the quote controls. This issue has been patched in versions 4.4.8 and 4.5.0-beta.2."}], "source": {"advisory": "GHSA-8h43-rcqj-wpc6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-21T17:59:52.795175Z", "id": "CVE-2025-62605", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-21T18:00:16.343Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-62605", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-21T17:59:52.795175Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-21T18:00:13.183Z"}}], "cna": {"title": "Mastodon quotes control can be bypassed", "source": {"advisory": "GHSA-8h43-rcqj-wpc6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "mastodon", "product": "mastodon", "versions": [{"status": "affected", "version": ">= 4.4.0-beta.1, < 4.4.8"}, {"status": "affected", "version": "= 4.5.0-beta.1"}]}], "references": [{"url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-8h43-rcqj-wpc6", "name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-8h43-rcqj-wpc6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mastodon/mastodon/commit/2dc4552229b55e2e4adaef675e68ed7ae123d78e", "name": "https://github.com/mastodon/mastodon/commit/2dc4552229b55e2e4adaef675e68ed7ae123d78e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mastodon/mastodon/commit/405a49df44033e7d179f3d44d59fb68a67d54789", "name": "https://github.com/mastodon/mastodon/commit/405a49df44033e7d179f3d44d59fb68a67d54789", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mastodon/mastodon/releases/tag/v4.4.8", "name": "https://github.com/mastodon/mastodon/releases/tag/v4.4.8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mastodon/mastodon/releases/tag/v4.5.0-beta.2", "name": "https://github.com/mastodon/mastodon/releases/tag/v4.5.0-beta.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was added, but it is possible for an attacker to bypass these controls in Mastodon versions prior to 4.4.8 and 4.5.0-beta.2. Mastodon internally treats reblogs as statuses. Since they were not special-treated, an attacker could reblog any post, then quote their reblog, technically quoting themselves, but having the quote feature a preview of the post they did not get authorization for with all of the affordances that would be otherwise denied by the quote controls. This issue has been patched in versions 4.4.8 and 4.5.0-beta.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-754", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-21T16:46:37.879Z"}}}, "cveMetadata": {"cveId": "CVE-2025-62605", "state": "PUBLISHED", "dateUpdated": "2025-10-21T18:00:16.343Z", "dateReserved": "2025-10-16T19:24:37.267Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-21T16:46:37.879Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "mastodon", "vendor": "mastodon", "versions": [{"status": "affected", "version": ">= 4.4.0-beta.1, < 4.4.8"}, {"status": "affected", "version": "= 4.5.0-beta.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "1E60306E-2AEE-4F99-8430-6075162A4799", "versionEndExcluding": "4.4.8", "versionStartIncluding": "4.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:joinmastodon:mastodon:4.5.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "A3835271-0B04-4DFD-AFA8-4A31AA713B97", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was added, but it is possible for an attacker to bypass these controls in Mastodon versions prior to 4.4.8 and 4.5.0-beta.2. Mastodon internally treats reblogs as statuses. Since they were not special-treated, an attacker could reblog any post, then quote their reblog, technically quoting themselves, but having the quote feature a preview of the post they did not get authorization for with all of the affordances that would be otherwise denied by the quote controls. This issue has been patched in versions 4.4.8 and 4.5.0-beta.2."}, {"lang": "es", "value": "Mastodon es un servidor de red social gratuito y de c\u00f3digo abierto basado en ActivityPub. En la versi\u00f3n 4.4 de Mastodon, se a\u00f1adi\u00f3 soporte para publicaciones de citas verificables con controles de cita, pero es posible que un atacante omita estos controles en versiones de Mastodon anteriores a la 4.4.8 y 4.5.0-beta.2. Mastodon trata internamente los reblogs como estados. Dado que no se les dio un tratamiento especial, un atacante podr\u00eda hacer reblog de cualquier publicaci\u00f3n, luego citar su reblog, t\u00e9cnicamente cit\u00e1ndose a s\u00ed mismo, pero haciendo que la cita muestre una vista previa de la publicaci\u00f3n para la que no obtuvo autorizaci\u00f3n con todas las funcionalidades que de otro modo ser\u00edan denegadas por los controles de cita. Este problema ha sido parcheado en las versiones 4.4.8 y 4.5.0-beta.2."}], "id": "CVE-2025-62605", "lastModified": "2026-10-19T16:10:00.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62605", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-21T17:59:52.795175Z", "version": "2.0.3"}}]}, "published": "2025-10-21T17:15:41.203", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/mastodon/mastodon/commit/2dc4552229b55e2e4adaef675e68ed7ae123d78e"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/mastodon/mastodon/commit/405a49df44033e7d179f3d44d59fb68a67d54789"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.4.8"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.5.0-beta.2"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-8h43-rcqj-wpc6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-754"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-10-23T10:12:49.617536+00:00", "updated": "2025-10-23T10:12:49.617562+00:00", "vendors": ["joinmastodon", "joinmastodon$PRODUCT$mastodon"]}