Mastodon CVE-2025-62605

Requires an authenticated account (PR:L) on a Mastodon instance running a vulnerable version (prior to 4.4.8 or 4.5.0-beta.2) that supports the quote-posts-with-quote-controls feature introduced in 4.4. The concrete prerequisite is a two-step action: the attacker must first reblog the target post, then create a quote referencing that reblog, exploiting Mastodon's internal treatment of reblogs as ordinary statuses. Limiting factors: exploitation is impossible on instances not running the 4.4 quote-controls feature or already on 4.4.8/4.5.0-beta.2+, and it requires a valid account; no victim user interaction is needed. Impact is limited to defeating the quote-authorization control (showing an unauthorized preview) rather than data exposure or takeover.

This is a low-to-moderate priority issue, consistent with its CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). The vector indicates network-reachable, low-complexity exploitation but requires an authenticated account (PR:L) and yields only a low integrity impact with no confidentiality or availability loss - the flaw lets an attacker defeat quote controls by reblogging a post and then quoting their own reblog, surfacing an unauthorized quote preview rather than exposing secret data or granting code execution. Supporting signals reinforce low urgency: EPSS is 0.29% at the 20th percentile (low exploitation probability), the CVE is NOT on the CISA KEV list, and no public exploit code is referenced in the provided data. There is no SSVC decision data supplied. The source-code evidence (added validate_original_quoted_status rejecting reblog quoted_statuses, and reblog guards in the serializer and ActivityPub verify/import services) confirms the root cause is an improper condition check (CWE-754) on reblog-type statuses, matching the description precisely. Signals are internally consistent - there is no conflict between CVSS, EPSS, and KEV - so this is a genuine but low-severity integrity/trust issue, not a high-risk security emergency.

An attacker with an ordinary account on a vulnerable Mastodon instance reblogs a post whose author has restricted or denied quoting, then creates a quote post referencing that reblog. Because Mastodon failed to specially treat reblogs, the quote is accepted and renders a full preview of the victim's post with affordances the quote controls were meant to prevent. No public exploit code is identified at time of analysis, and exploitation is low-complexity but requires an authenticated account.