CVE-2023-52077

CRITICO 9.8CVE-2023-52077 · Published 27/12/2023 · updated 17/06/2026

In breve

CVE-2023-52077 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda nexkey (nexryai).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.69%, superiore al 53.1% delle vulnerabilità.
Correzione: aggiornare a 12.23q4.5 o successiva.

Package	Affected versions	Patched versions
nexkey nexryai	`< 12.23q4.5`	`12.23q4.5`

Description

Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs. This allows malicious third-party apps to perform operations such as updating server settings, as well as compromise object storage and email server credentials. This issue has been patched in 12.23Q4.5.

References

mei23/misskey-v12 commit 78173e3 · Patch
misskey-dev/misskey commit 5150053 · Patch
nexryai/nexkey commit a4e4c9c · Patch
nexryai/nexkey security advisory · Vendor Advisory

Altre vulnerabilità di nexkey

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free