CVE-2023-52139: Improper Authorization

Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as kind or secure without the user's permission and perform operations such as reading or adding non-public content. As a...

Misskey Authorization Issues Vulnerabilities

Misskey is a suite of micro-blogging platforms. An authorization issue vulnerability exists in Misskey versions prior to 2023.12.1, which stems from the ability to access certain endpoints or websocket APIs designated as secure or safe and perform actions such as reading or adding public content...

PT-2023-31930 · Misskey · Misskey

Name of the Vulnerable Software and Affected Versions: Misskey versions prior to 2023.12.1 Description: Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified without the user's...

Design/Logic Flaw

Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs. This allows malicious third-party apps to perform operations such as updating server...

CVE-2023-52077

CVE-2023-52077 concerns Nexkey, a Misskey v12 fork. Before 12.23Q4.5, external apps using administrator/moderator-issued tokens could call admin APIs, enabling operations like updating server settings and risking object storage and email credentials. The issue is patched in 12.23Q4.5. No exploita...

CVE-2023-49079

Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate any remote user. This issue has been patched in version 2023.11.1-beta.1...

Design/Logic Flaw

Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate any remote user. This issue has been patched in version 2023.11.1-beta.1...

CVE-2023-49079

Misskey (open source, decentralized social platform) has a vulnerability due to missing signature validation that allows an arbitrary user to impersonate any remote user. Concrete details across multiple connected sources indicate this affects Misskey versions prior to 2023.11.1-beta.1, with the ...

CVE-2023-49079 Misskey's missing signature validation allows arbitrary users to impersonate any remote user.

Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate any remote user. This issue has been patched in version 2023.11.1-beta.1...

CVE-2023-49079 Misskey's missing signature validation allows arbitrary users to impersonate any remote user.

Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate any remote user. This issue has been patched in version 2023.11.1-beta.1...

CVE-2023-49079: Improper Verification of Cryptographic Signature

Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate any remote user. This issue has been patched in version 2023.11.1-beta.1...

Misskey Data Falsification Issue Vulnerability

Misskey is a suite of micro-blogging platforms. Misskey 2023.11.0 and prior versions suffer from a Data Forgery Issue vulnerability that stems from a lack of signature validation and allows an arbitrary user to impersonate any remote user...

PT-2023-31047 · Misskey · Misskey

Name of the Vulnerable Software and Affected Versions: Misskey versions prior to 2023.11.1-beta.1 Description: Misskey is an open source, decentralized social media platform. The issue allows arbitrary users to impersonate any remote user due to missing signature validation. Recommendations: For...

CVE-2023-43805

Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issue. As a workaround, it may be possibl...

CVE-2023-43793

Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentication of the Bull dashboard, which is the job queue management UI, and access it. Version 2023.9.0 contains a fix. There are no known workarounds...

Authentication flaw

Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issue. As a workaround, it may be possibl...

Authentication flaw

Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentication of the Bull dashboard, which is the job queue management UI, and access it. Version 2023.9.0 contains a fix. There are no known workarounds...

CVE-2023-43805 Nexkey allows users to bypass authentication of Bull dashboard

Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issue. As a workaround, it may be possibl...

CVE-2023-43805

Nexkey (Misskey fork) pre-12.121.9 is vulnerable due to incomplete URL validation, allowing bypass of authentication for access to the job queue dashboard. The issue is fixed in version 12.121.9. As a workaround, operators have used access-blocking measures (e.g., WAF rules like Cloudflare) to mi...

CVE-2023-43805 Nexkey allows users to bypass authentication of Bull dashboard

Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issue. As a workaround, it may be possibl...