CVE-2024-25636

Misskey is an open source, decentralized social media platform with ActivityPub support. Prior to version 2024.2.0, when fetching remote Activity Streams objects, Misskey doesn't check that the response from the remote server has a Content-Type header value of the Activity Streams media type, whi...

Design/Logic Flaw

Misskey is an open source, decentralized social media platform with ActivityPub support. Prior to version 2024.2.0, when fetching remote Activity Streams objects, Misskey doesn't check that the response from the remote server has a Content-Type header value of the Activity Streams media type, whi...

CVE-2024-25636 Lack of media type verification of Activity Streams objects allows impersonation and takeover of remote accounts

Misskey is an open source, decentralized social media platform with ActivityPub support. Prior to version 2024.2.0, when fetching remote Activity Streams objects, Misskey doesn't check that the response from the remote server has a Content-Type header value of the Activity Streams media type, whi...

CVE-2024-25636 Lack of media type verification of Activity Streams objects allows impersonation and takeover of remote accounts

Misskey is an open source, decentralized social media platform with ActivityPub support. Prior to version 2024.2.0, when fetching remote Activity Streams objects, Misskey doesn't check that the response from the remote server has a Content-Type header value of the Activity Streams media type, whi...

CVE-2024-25636 Lack of media type verification of Activity Streams objects allows impersonation and takeover of remote accounts

Misskey is an open source, decentralized social media platform with ActivityPub support. Prior to version 2024.2.0, when fetching remote Activity Streams objects, Misskey doesn't check that the response from the remote server has a Content-Type header value of the Activity Streams media type, whi...

CVE-2024-25636

Misskey prior to version 2024.2.0 is affected by a vulnerability where remote Activity Streams objects are fetched without verifying the Content-Type header for the Activity Streams media type. This flaw allows an attacker to upload a crafted Activity Streams document to a remote server and, if t...

PT-2024-21056 · Misskey · Misskey

Name of the Vulnerable Software and Affected Versions: Misskey versions prior to 2024.2.0 Description: Misskey is an open source, decentralized social media platform with ActivityPub support. The issue arises when fetching remote Activity Streams objects, as Misskey doesn't check that the respons...

Misskey Code Issues Vulnerabilities

Misskey is a suite of micro-blogging platforms. A code issue vulnerability exists in Misskey versions prior to 2024.2.0. An attacker exploited the vulnerability to impersonate and take over an account on a remote server...

CVE-2023-52139

Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as kind or secure without the user's permission and perform operations such as reading or adding non-public content. As a...

Design/Logic Flaw

Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as kind or secure without the user's permission and perform operations such as reading or adding non-public content. As a...

CVE-2023-52139 Misskey vulnerable to improper authorization when accessing with third-party application

Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as kind or secure without the user's permission and perform operations such as reading or adding non-public content. As a...

CVE-2023-52139

Misskey (open source decentralized social platform) has an improper authorization risk where third‑party apps can access certain endpoints/Websocket APIs without user consent, potentially leaking confidential data (object storage secrets, SMTP passwords) if the authenticating user is an administr...

CVE-2023-52139 Misskey vulnerable to improper authorization when accessing with third-party application

Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as kind or secure without the user's permission and perform operations such as reading or adding non-public content. As a...

Misskey Authorization Issues Vulnerabilities

Misskey is a suite of micro-blogging platforms. An authorization issue vulnerability exists in Misskey versions prior to 2023.12.1, which stems from the ability to access certain endpoints or websocket APIs designated as secure or safe and perform actions such as reading or adding public content...

PT-2023-31930 · Misskey · Misskey

Name of the Vulnerable Software and Affected Versions: Misskey versions prior to 2023.12.1 Description: Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified without the user's...

Design/Logic Flaw

Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs. This allows malicious third-party apps to perform operations such as updating server...

CVE-2023-52077

CVE-2023-52077 concerns Nexkey, a Misskey v12 fork. Before 12.23Q4.5, external apps using administrator/moderator-issued tokens could call admin APIs, enabling operations like updating server settings and risking object storage and email credentials. The issue is patched in 12.23Q4.5. No exploita...

CVE-2023-49079

Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate any remote user. This issue has been patched in version 2023.11.1-beta.1...

Design/Logic Flaw

Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate any remote user. This issue has been patched in version 2023.11.1-beta.1...

CVE-2023-49079

Misskey (open source, decentralized social platform) has a vulnerability due to missing signature validation that allows an arbitrary user to impersonate any remote user. Concrete details across multiple connected sources indicate this affects Misskey versions prior to 2023.11.1-beta.1, with the ...