CSRF Vulnerability in Misskey's Bull Dashboard Affecting Multiple Versions

CVE-2025-24897

What is CVE-2025-24897?

Misskey, an open-source federated social media platform, has a vulnerability in its Bull's dashboard prior to version 2025.2.0-alpha.0 that exposes certain APIs to Cross-Site Request Forgery (CSRF) attacks. This situation arises from insufficient CSRF protection combined with inadequate security attributes in authentication cookies. Attackers could exploit this vulnerability, potentially impacting the integrity and availability of the service by triggering arbitrary jobs. Users are strongly encouraged to update to the latest version to mitigate risks. As an interim solution, they should consider blocking all access to the /queue directory using a web application firewall (WAF).

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References