Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as [kind](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L811) or [secure](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L805) without the user's permission and perform operations such as reading or adding non-public content. As a result, if the user who authenticated the application is an administrator, confidential information such as object storage secret keys and SMTP server passwords will be leaked, and general users can also create invitation codes without permission and leak non-public user information. This is patched in version [2023.12.1](https://github.com/misskey-dev/misskey/commit/c96bc36fedc804dc840ea791a9355d7df0748e64).
Some API endpoints and Websocket API were incorrectly marked as requiring permissions of type 'kind' or 'secure', which in practice does not enforce proper authorization verification against external applications. A third-party application, authenticated by a user, can call these endpoints and perform operations that exceed the scope of permissions granted by the user. Depending on the role of the logged-in user, the application may read or create non-public content, generate invitation codes, and access sensitive system configuration data.
An attacker can gain access to sensitive configuration information (object storage secret keys, SMTP passwords) in the case of an administrator account, and for regular users — read non-public information about other users and create invitation codes without appropriate permissions.
Update Misskey to version 2023.12.1, in which the vulnerability has been patched (commit c96bc36fedc804dc840ea791a9355d7df0748e64). Additionally, it is recommended to change passwords and access keys to external services (object storage, SMTP) on instances that may have been exposed.
Misskey — versions prior to 2023.12.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HMisskey
APPMisskey< 2023.12.1
Related vulnerabilities
Niewystarczająca weryfikacja uprawnień w Misskey — nieautoryzowany dostęp do danych
Misskey: niewystarczająca walidacja obiektów ActivityPub (bypass patcha CVE-2024-52591)
Misskey: brak weryfikacji podpisu umożliwia podszywanie się pod użytkowników
Misskey is an open source, federated social media platform. All Misskey servers prior to 2026.3.1 contain a vu...
Misskey is an open source, federated social media platform. Starting in version 13.0.0-beta.16 and prior to ve...