CVE-2025-62605: Mastodon Quote Controls Auth Bypass Flaw

CVE-2025-62605 Overview

CVE-2025-62605 is a business logic flaw in Mastodon, the open-source ActivityPub-based social network server. Mastodon 4.4 introduced verifiable quote posts with quote controls that let authors govern who may quote their content. Attackers can bypass these controls in versions prior to 4.4.8 and 4.5.0-beta.2 by reblogging a target post and then quoting their own reblog. Because Mastodon internally treats reblogs as statuses without special-casing them, the resulting quote surfaces a preview of the original post along with all affordances the author explicitly denied.

Critical Impact

Authenticated attackers can circumvent Mastodon quote controls to embed and amplify posts whose authors withheld quote permission, undermining consent-based interaction guarantees.

Affected Products

• Mastodon versions prior to 4.4.8
• Mastodon 4.5.0-beta.1
• Mastodon instances upgraded from 4.4 that have not applied the security patch

Discovery Timeline

• 2025-10-21 - CVE-2025-62605 published to the National Vulnerability Database
• 2025-10-21 - Mastodon Security Advisory GHSA-8h43-rcqj-wpc6 published alongside releases v4.4.8 and v4.5.0-beta.2
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62605

Vulnerability Analysis

The vulnerability is a business logic flaw categorized under [CWE-754] (Improper Check for Unusual or Exceptional Conditions). Mastodon 4.4 added quote controls that let authors set a quote policy per status, restricting who can quote them. The enforcement logic in quote_policy_for_account and the ActivityPub quote request handler validated the target status but did not consider that a reblog is itself a status pointing to another status.

An authenticated user can reblog any visible post and then issue a quote request against their own reblog. The quote request passes policy checks because the reblog belongs to the attacker. Downstream serializers then rendered the wrapped quoted_status as if the original post had been quoted directly, exposing content the author intended to shield from quoting.

Root Cause

The root cause is a missing guard on reblog objects in the quote authorization pipeline. quote_policy_for_account in interaction_policy_concern.rb did not deny reblogs, QuoteRequest in quote_request.rb did not reject reblog targets, and BaseQuoteSerializer continued to expose the nested quoted_status of a reblog. The patched code adds reblog? checks at each of these boundaries.

Attack Vector

Exploitation requires a local Mastodon account and network access to the target instance. The attacker reblogs a post whose author denies quotes, then submits a quote referencing that reblog. Federation propagates the crafted quote to other instances, giving the surfaced preview the same visibility as any legitimate quote post.

# Patch: app/models/concerns/status/interaction_policy_concern.rb
# Returns `:automatic`, `:manual`, `:unknown` or `:denied`
def quote_policy_for_account(other_account, preloaded_relations: {})
-  return :denied if other_account.nil? || direct_visibility?
+  return :denied if other_account.nil? || direct_visibility? || reblog?

  following_author = nil
  followed_by_author = nil

# Patch: app/lib/activitypub/activity/quote_request.rb
quoted_status = status_from_uri(object_uri)
-return if quoted_status.nil? || !quoted_status.account.local? || !quoted_status.distributable?
+return if quoted_status.nil? || !quoted_status.account.local? || !quoted_status.distributable? || quoted_status.reblog?

# Patch: app/serializers/rest/base_quote_serializer.rb
def quoted_status
-  object.quoted_status if object.accepted? && object.quoted_status.present? && !status_filter.filtered_for_quote?
+  object.quoted_status if object.accepted? && object.quoted_status.present? && !object.quoted_status&.reblog? && !status_filter.filtered_for_quote?
end

Source: Mastodon Commit 2dc4552 and Mastodon Commit 405a49d

Detection Methods for CVE-2025-62605

Indicators of Compromise

• Quote status records whose quoted_status_id resolves to a row where reblog_of_id is non-null.
• ActivityPub QuoteRequest activities whose object URI dereferences to an announce (reblog) rather than an original note.
• User reports of surfaced quotes attributed to authors whose quote policy is set to restrict or deny quoting.

Detection Strategies

• Query the quotes table joined against statuses to identify accepted quotes where the target is a reblog and flag them for review.
• Instrument the Quote#accept! code path to log any request whose quoted_status.reblog? returns true after upgrade to confirm the guard rejects prior artifacts.
• Review federation inbox logs for inbound QuoteRequest activities that reference an announce activity URI.

Monitoring Recommendations

• Alert on anomalies where a single account issues sequential reblog and quote actions targeting the same origin status within a short window.
• Track federation error rates for QuoteRequest after patching to validate the new rejection path is exercised.
• Correlate abuse reports mentioning unwanted quotes against the historical quote table to identify pre-patch exploitation.

How to Mitigate CVE-2025-62605

Immediate Actions Required

• Upgrade production Mastodon instances to 4.4.8 or 4.5.0-beta.2 immediately.
• Audit existing quote records for entries whose target is a reblog and remove or unaccept them.
• Notify federated peers of the upgrade so downstream caches are refreshed.

Patch Information

The fix is delivered in Mastodon Release v4.4.8 and Mastodon Release v4.5.0-beta.2. Details are documented in Mastodon Security Advisory GHSA-8h43-rcqj-wpc6. The patches add reblog? guards in quote_policy_for_account, QuoteRequest, and BaseQuoteSerializer, plus a new validate_original_quoted_status model validator.

Workarounds

• No official workaround exists; operators unable to upgrade immediately should disable the quote posts feature at the instance level if configuration permits.
• Manually unaccept quotes whose quoted_status is a reblog until the patched release is deployed.

# Upgrade to the patched Mastodon release
git fetch --tags
git checkout v4.4.8
bundle install --deployment --without development test
yarn install --production --frozen-lockfile
RAILS_ENV=production bundle exec rails db:migrate
RAILS_ENV=production bundle exec rails assets:precompile
systemctl restart mastodon-web mastodon-sidekiq mastodon-streaming