CVE-2024-52591

CVE-2024-52591 is a critical vulnerability affecting Misskey, an open-source federated social media platform. It stems from missing validation in specific services, allowing attackers to create fake user profiles and forged notes that appear to originate from different instances or users. This enables impersonation and full control over spoofed accounts. The vulnerability has a CVSS score of 9.3 (CRITICAL), indicating a network-exploitable flaw with low attack complexity and high impact on integrity, potentially leading to data compromise. There are no known workarounds. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE. Users are advised to upgrade to version 2024.11.0-alpha.3 or later to mitigate the risk.