CVE-2023-52077

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs. This allows malicious third-party apps to perform operations such as updating server settings, as well as compromise object storage and email server credentials. This issue has been patched in 12.23Q4.5.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Dec 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-520796.5msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users ca CVE-2023-520807.7IEIT NF5280M6 UEFI firmware through 8.4 has a pool overflow vulnerability, caused by improper use of the gRT->GetVariable() function. Attack CVE-2023-520815.3ffcss is a CLI interface to apply and configure Firefox CSS themes. Prior to 0.2.0, the function `lookupPreprocess()` is meant to apply some CVE-2023-520829.8Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. T CVE-2023-520834.8Winter is a free, open-source content management system. Prior to 1.2.4, users with the `media.manage_media` permission can upload files to CVE-2023-520845.4Winter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormW CVE-2023-520855.4Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provid CVE-2023-520868.1resumable.php (aka PHP backend for resumable.js) 0.1.4 before 3c6dbf5 allows arbitrary file upload anywhere in the filesystem via ../ in mul CVE-2023-52094.8The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its settings, which cou CVE-2023-520907.8A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected instal CVE-2023-520917.8An anti-spyware engine link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected CVE-2023-520927.8A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected instal