CVE-2023-52139 Misskey vulnerable to improper authorization when accessing with third-party application
Third-party apps can access unauthorized endpoints to leak secrets or create invitations, requiring a patch to Misskey.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-52139?
CVE-2023-52139 is a critical missing authorization vulnerability in misskey-dev misskey, published on 29 Dec 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as [kind](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L811) or [secure](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L805) without the user's permission and perform operations such as reading or adding non-public content. As a result, if the user who authenticated the application is an administrator, confidential information such as object storage secret keys and SMTP server passwords will be leaked, and general users can also create invitation codes without permission and leak non-public user information. This is patched in version [2023.12.1](https://github.com/misskey-dev/misskey/commit/c96bc36fedc804dc840ea791a9355d7df0748e64).
Weakness: CWE-285
Which versions are affected by CVE-2023-52139?
It affects 1 product.
Products include Misskey Misskey.
How do I fix CVE-2023-52139?
No fix has been published for CVE-2023-52139 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-52139 being exploited?
There is no known exploitation of CVE-2023-52139 in the wild and no public exploit code.
Other vulnerabilities in misskey-dev misskey
- CVE-2025-25306 Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes
- CVE-2023-49079 Misskey's missing signature validation allows arbitrary users to impersonate any remote user.
- CVE-2026-28431 Misskey lacks proper authorization checks and input validation
- CVE-2024-52590 Missing validation allows spoofed profiles in Misskey
- CVE-2024-52591 Missing validation allows spoofed profiles and notes in Misskey
Sources
Also known as GHSA-7pxq-6xx9-xpgm.