Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was added, but it is possible for an attacker to bypass these controls in Mastodon versions prior to 4.4.8 and 4.5.0-beta.2. Mastodon internally treats reblogs as statuses. Since they were not special-treated, an attacker could reblog any post, then quote their reblog, technically quoting themselves, but having the quote feature a preview of the post they did not get authorization for with all of the affordances that would be otherwise denied by the quote controls. This issue has been patched in versions 4.4.8 and 4.5.0-beta.2.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/mastodon/mastodon/commit/2dc4552229b55e2e4adaef675e68ed7ae123d78e Patch
- https://github.com/mastodon/mastodon/commit/405a49df44033e7d179f3d44d59fb68a67d54789 Patch
- https://github.com/mastodon/mastodon/security/advisories/GHSA-8h43-rcqj-wpc6 Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 4.3 · joinmastodonNVD modified 2026-10-19 16:10
Affected (CPE criteria) 2
cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*cpe:2.3:a:joinmastodon:mastodon:4.5.0:beta1:*:*:*:*:*:*
References 5
- https://github.com/mastodon/mastodon/commit/2dc4552229b55e2e4adaef675e68ed7ae123d78e Patch
- https://github.com/mastodon/mastodon/commit/405a49df44033e7d179f3d44d59fb68a67d54789 Patch
- https://github.com/mastodon/mastodon/releases/tag/v4.4.8 Release Notes
- https://github.com/mastodon/mastodon/releases/tag/v4.5.0-beta.2 Release Notes
- https://github.com/mastodon/mastodon/security/advisories/GHSA-8h43-rcqj-wpc6 Vendor Advisory