CVE-2024-52591

Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` and `HttpRequestService.getActivityJson` allows an attacker to create fake user profiles and forged notes. The spoofed users will appear to be from a different instance than the one where they actually exist, and the forged notes will appear to be posted by a different user. Vulnerable Misskey instances will accept the spoofed objects as valid, allowing an attacker to impersonate other users and instances. The attacker retains full control of the spoofed user / note and can interact like a real account. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-20

• https://github.com/misskey-dev/misskey/security/advisories/GHSA-m2gq-69fp-6hv4Third Party Advisory

Published

Dec 18, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-52586eLabFTW is an open source electronic lab notebook for resear…7.8
• CVE-2024-52587StepSecurity's Harden-Runner provides network egress filteri…8.8
• CVE-2024-52588Strapi is an open-source content management system. Prior to…7.5
• CVE-2024-52589Discourse is an open source platform for community discussio…2.7
• CVE-2024-5259The MultiVendorX Marketplace – WooCommerce MultiVendor Marke…5.4
• CVE-2024-52590Misskey is an open source, federated social media platform. …6.5
• CVE-2024-52592Misskey is an open source, federated social media platform. …5.3
• CVE-2024-52593Misskey is an open source, federated social media platform.I…5.3
• CVE-2024-52594Gomatrixserverlib is a Go library for matrix federation. Gom…4.3
• CVE-2024-52595lxml_html_clean is a project for HTML cleaning functionaliti…6.1
• CVE-2024-52596SimpleSAMLphp xml-common is a common classes for handling XM…8.8
• CVE-2024-525972FAuth is a web app to manage Two-Factor Authentication (2FA…6.1