VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Dec 18, 2024· Updated Jun 17, 2026

CVE-2024-52592

CVE-2024-52592

Description

Misskey is an open source, federated social media platform. In affected versions missing validation in ApInboxService.update allows an attacker to modify the result of polls belonging to another user. No authentication is required, except for a valid signature from any actor on any remote instance. Vulnerable Misskey instances will accept spoofed updates for remote polls. Local polls are unaffected. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • Misskey Dev/Misskey6 versions
    cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:*+ 5 more
    • cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:*range: >=10.92.1,<2024.11.0
    • cpe:2.3:a:misskey:misskey:2024.11.0:alpha0:*:*:*:*:*:*
    • cpe:2.3:a:misskey:misskey:2024.11.0:alpha1:*:*:*:*:*:*
    • cpe:2.3:a:misskey:misskey:2024.11.0:alpha2:*:*:*:*:*:*
    • (no CPE)range: <2024.11.0-alpha.3
    • (no CPE)range: >= 10.92.1, < 2024.11.0-alpha.3

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.