What’s Vulnerable › Vulnerabilities

CVE-2023-52077: External apps using tokens issued by administrators and moderators can call admin APIs

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-12-27 · updated 2026-06-17
• Weakness: CWE-863

Description

Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs. This allows malicious third-party apps to perform operations such as updating server settings, as well as compromise object storage and email server credentials. This issue has been patched in 12.23Q4.5.

Affected products

• nexryai nexkey: before 12.23q4.5 — fixed in 12.23q4.5

How to fix

Upgrade to a fixed version: nexryai nexkey 12.23q4.5. Check the vendor advisory for mitigations.

References

• https://github.com/mei23/misskey-v12/commit/78173e376f14fcc1987b02196f5538bf5b18225c
• https://github.com/misskey-dev/misskey/commit/5150053275594278e9eb23e72d98b16593c4c230
• https://github.com/nexryai/nexkey/commit/a4e4c9c47c5f84ec7ccd309bde59d4ae5d7e5a98
• https://github.com/nexryai/nexkey/security/advisories/GHSA-pjj7-7hcj-9cpc
• https://github.com/mei23/misskey-v12/commit/78173e376f14fcc1987b02196f5538bf5b18225c
• https://github.com/misskey-dev/misskey/commit/5150053275594278e9eb23e72d98b16593c4c230
• https://github.com/nexryai/nexkey/commit/a4e4c9c47c5f84ec7ccd309bde59d4ae5d7e5a98
• https://github.com/nexryai/nexkey/security/advisories/GHSA-pjj7-7hcj-9cpc

Get alerted when CVE-2023-52077 or the next vulnerability affects your stack