{"cve":"CVE-2023-52077","nvd":{"published":"2023-12-27T19:15:07.763","modified":"2026-06-17T06:42:01.713","status":"Modified","description":"Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs.  This allows malicious third-party apps to perform operations such as updating server settings, as well as compromise object storage and email server credentials. This issue has been patched in 12.23Q4.5.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-863"],"references":["https://github.com/mei23/misskey-v12/commit/78173e376f14fcc1987b02196f5538bf5b18225c","https://github.com/misskey-dev/misskey/commit/5150053275594278e9eb23e72d98b16593c4c230","https://github.com/nexryai/nexkey/commit/a4e4c9c47c5f84ec7ccd309bde59d4ae5d7e5a98","https://github.com/nexryai/nexkey/security/advisories/GHSA-pjj7-7hcj-9cpc","https://github.com/mei23/misskey-v12/commit/78173e376f14fcc1987b02196f5538bf5b18225c"],"products":["nexryai:nexkey"],"source":"nvd","synced_at":"2026-10-19T21:43:38.875533635+00:00"},"epss":{"cve":"CVE-2023-52077","score":0.00693,"percentile":0.52923,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}