External apps using tokens issued by administrators and moderators can call admin APIs

published 2023-12-27 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-56756

cvss: 8.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits: 0; none known

Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs. This allows malicious third-party apps to perform operations such as updating server settings, as well as compromise object storage and email server credentials. This issue has been patched in 12.23Q4.5.

Patch / fix

fixed in 1 links 3

nexryai nexkey 12.23q4.5

github.com/mei23/misskey-v12@78173e3 commit
github.com/misskey-dev/misskey@5150053 commit
github.com/nexryai/nexkey@a4e4c9c commit

Exploit prediction

0.69% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

nexryai nexkey

Classification

Weakness

CWE-863 Incorrect Authorization

References

Sources

CVE List CVE-2023-52077
NVD CVE-2023-52077

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary