TI-2023-28521 Aliases CVE-2023-52077

External apps using tokens issued by administrators and moderators can call admin APIs

MEDIUM 43CWE-863Published 2023-12-27 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.

Summary

Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs. This allows malicious third-party apps to perform operations such as updating server settings, as well as compromise object storage and email server credentials. This issue has been patched in 12.23Q4.5.

Why it matters now

EPSS 0.00693 53rd percentileScored 2026-11-07

Fix Fixed nexkey (nexryai): 12.23Q4.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
nexryai	nexkey	before 12.23Q4.5	12.23Q4.5	Patch available	CNA

nexkey Vendornexryai Affected before 12.23Q4.5 Fixed in 12.23Q4.5 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nexryai:nexkey::::::node.js::*	before 12.23q4.5	Vulnerable	nexryai

cpe:2.3:a:nexryai:nexkey:*:*:*:*:*:node.js:*:* Versions before 12.23q4.5 Vulnerable ·nexryai

Remediation

Fix · CNA nexkey (nexryai) Fixed in 12.23Q4.5

Timeline

2026-10-02 Threatist record created from CVE-2023-52077

References

Patch 3

Advisory 1

https://github.com/nexryai/nexkey/security/advisories/GHSA-pjj7-7hcj-9cpc

TI-2023-26760 nexkey allows arbitrary users to impersonate any remote user due to missing signature validation CVSS 3.1HIGH 8.6
TI-2023-23496 Nexkey allows users to bypass authentication of Bull dashboard CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences