Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes

Description

Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the `id` and `url` fields of ActivityPub objects. An attacker can forge an object where they claim authority in the `url` field even if the specific ActivityPub object type require authority in the `id` field. Version 2025.2.1 addresses the issue.

Scores

EPSS (exploitation in 30 days)

0.18% · top 92% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.

Weakness

• CWE-346: Origin Validation Error (opens in a new tab)All about CWE-346 and its CVEs
• CWE-441: Unintended Proxy or Intermediary ('Confused Deputy') (opens in a new tab)All about CWE-441 and its CVEs
• CWE-1025: Comparison Using Wrong Factors (opens in a new tab)All about CWE-1025 and its CVEs

Affected products

• misskey-dev · misskey

  • affected < 2025.2.1

References (2)

• https://github.com/misskey-dev/misskey/security/advisories/GHSA-6w2c-vf6f-xf26 (opens in a new tab)x_refsource_CONFIRM
• https://github.com/misskey-dev/misskey/releases/tag/2025.2.1 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-25306](https://trackcve.app/badge/CVE-2025-25306.svg)](https://trackcve.app/cve/CVE-2025-25306)

Record last updated 12 Mar 2025, 19:49 UTC.