CVE-2025-24897

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be subject to CSRF attacks. There is a risk of this vulnerability being used for attacks with relatively large impact on availability and integrity, such as the ability to add arbitrary jobs. This vulnerability was fixed in 2025.2.0-alpha.0. As a workaround, block all access to the `/queue` directory with a web application firewall (WAF).

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L

Weakness enumeration

CWE-352 CWE-614 CWE-1275

Affected software

No affected versions have been published.

Timeline

Published: Feb 11, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-248986.3rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions `ssl::select_next_proto` can return a slic CVE-2025-248997.5reNgine is an automated reconnaissance framework for web applications. A vulnerability was discovered in reNgine, where **an insider attacke CVE-2025-24905.4A vulnerability was found in Dromara ujcms 9.7.5. It has been rated as problematic. Affected by this issue is the function uploadZip/upload CVE-2025-249008.6Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Due to a lack of CSRF countermeasures and impr CVE-2025-249018.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `deletar_permissa CVE-2025-249028.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_cargo.php CVE-2025-249038.5libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Sig CVE-2025-249048.5libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Sig CVE-2025-249059.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_codigobarras CVE-2025-249069.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_cob CVE-2025-249076.8Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not prop CVE-2025-249086.8Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not prop