Misskey vulnerable to improper authorization when accessing with third-party application

CVE-2023-52139

What is CVE-2023-52139?

The Misskey social media platform has an access control vulnerability that allows unauthorized third-party applications to exploit certain endpoints or Websocket APIs. This flaw permits these applications to perform actions such as reading or adding non-public content without user authorization. Consequently, if the authenticated user is an administrator, sensitive information—including object storage secret keys and SMTP server passwords—may be leaked. Additionally, general users may create invitation codes without permission and disclose private user information. This vulnerability has been addressed in version 2023.12.1.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References