← Vulnerability feed

Vulnerability record · CVE-2023-52139 · published 29 December 2023

CVE-2023-52139: Misskey improper authorization vulnerability

Misskey · Misskey

Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as [kind](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L811) or [secure](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L805) without the user's permission and perform operations such as reading or adding non-public content. As a result, if the user who authenticated the application is an administrator, confidential information such as object storage secret keys and SMTP server passwords will be leaked, and general users can also create invitation codes without permission and leak non-public user information. This is patched in version [2023.12.1](https://github.com/misskey-dev/misskey/commit/c96bc36fedc804dc840ea791a9355d7df0748e64).

9.6 CVSS 3.1 Critical EPSS 0.55% · top 56.3% CWE-285 · Improper authorization
9.6CVSS 3.1 base score
0.55%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as [kind](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L811) or [secure](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L805) without the user's permission and perform operations such as reading or adding non-public content. As a result, if the user who authenticated the application is an administrator, confidential information such as object storage secret keys and SMTP server passwords will be leaked, and general users can also create invitation codes without permission and leak non-public user information. This is patched in version [2023.12.1](https://github.com/misskey-dev/misskey/commit/c96bc36fedc804dc840ea791a9355d7df0748e64).

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/misskey-dev/misskey/commit/c96bc36fedc804dc840ea791a9355d7df0748e64 Patch
https://github.com/misskey-dev/misskey/security/advisories/GHSA-7pxq-6xx9-xpgm Third Party Advisory
https://github.com/misskey-dev/misskey/commit/c96bc36fedc804dc840ea791a9355d7df0748e64 Patch
https://github.com/misskey-dev/misskey/security/advisories/GHSA-7pxq-6xx9-xpgm Third Party Advisory

Track CVE-2023-52139 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-24812Misskey sql injection vulnerabilityMisskey is an open source, decentralized social media platform. In versions prior to 13.3.3 SQL injection is possible due to insufficient parameter v…EPSS 0.71%9.3CVE-2025-25306Misskey origin validation error vulnerabilityMisskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the `id` …EPSS 0.18%9.2CVE-2026-28431Misskey improper authorization vulnerabilityMisskey is an open source, federated social media platform. All Misskey servers running versions 8.45.0 and later, but prior to 2026.3.1, contain a v…EPSS 0.39%8.8CVE-2024-52590Misskey improper input validation vulnerabilityMisskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` allows an attacke…EPSS 0.35%8.8CVE-2024-52591Misskey improper input validation vulnerabilityMisskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` and `HttpRequestS…EPSS 0.32%8.8CVE-2024-25636Misskey unrestricted file upload vulnerabilityMisskey is an open source, decentralized social media platform with ActivityPub support. Prior to version 2024.2.0, when fetching remote Activity Str…EPSS 0.66%8.2CVE-2025-24897Misskey cross-site request forgery vulnerabilityMisskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF…EPSS 0.14%8.1CVE-2025-24896Misskey insufficient session expiration vulnerabilityMisskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, a login token named `…EPSS 0.60%

Source: NIST National Vulnerability Database (record CVE-2023-52139), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.