I *think* I've found a little security bug in Mastodon.

Responsibly disclosed it as GHSA-8982-p7pm-7mqw.