CVE-2024-52592: Missing validation allows spoofed poll updates in Misskey
Misskey is an open source, federated social media platform. In affected versions missing validation in ApInboxService.update allows an attacker to modify the result of polls belonging to another user. No authentication is required, except for a valid signature from any actor on any remote instance. Vulnerable Misskey instances will accept spoofed updates for remote polls. Local polls are unaffected. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52592?
CVE-2024-52592 is categorized as a high severity vulnerability due to the potential for unauthorized poll modifications.
How do I fix CVE-2024-52592?
To fix CVE-2024-52592, upgrade to the latest version of Misskey beyond 2024.11.0-alpha.3 where the vulnerability is resolved.
What versions of Misskey are affected by CVE-2024-52592?
CVE-2024-52592 affects all Misskey versions up to and excluding 2024.11.0-alpha.3.
What is the impact of CVE-2024-52592 on users?
The impact of CVE-2024-52592 allows an attacker to modify results of polls belonging to other users, potentially misleading them.
Is authentication required to exploit CVE-2024-52592?
No, exploiting CVE-2024-52592 does not require authentication, only a valid signature from any actor.