External apps using tokens issued by administrators and moderators can call admin APIs

CVE-2023-52077

What is CVE-2023-52077?

Nexkey, a lightweight variant of Misskey designed for small to medium-sized servers, is vulnerable due to improper handling of tokens for admin API access. Before version 12.23Q4.5, the application allowed external apps, which were issued tokens by administrators or moderators, to execute admin-level actions. This flaw could lead to unauthorized changes in server configurations and the potential leakage of sensitive credentials, including object storage and email server information. Users are strongly recommended to update to the patched version to mitigate these risks.

References