CVE-2025-24897HIGH 8.2EPSS p2.6%

CVE-2025-24897CVE-2025-24897

Description

Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be subject to CSRF attacks. There is a risk of this vulnerability being used for attacks with relatively large impact on availability and integrity, such as the ability to add arbitrary jobs. This vulnerability was fixed in 2025.2.0-alpha.0. As a workaround, block all access to the `/queue` directory with a web application firewall (WAF).

Scoring

CVSS 3.18.2 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L
EPSS0.13% probability of exploitation · percentile 2.6% · 2026-06-19T12:03:05Z
Published2025-02-11
Last modified2025-11-26

Underlying weaknesses· 3

CWE-352CWE-614CWE-1275

References

  1. https://github.com/misskey-dev/misskey/commit/77e421029cb564a97f42b6e41c9edce49f79cecd
  2. https://github.com/misskey-dev/misskey/security/advisories/GHSA-38w6-vx8g-67pp

3

TypeTargetConfidenceTier
WeaknessSensitive Cookie with Improper SameSite Attributecwe-12750%live
WeaknessCross-Site Request Forgery (CSRF)cwe-3520%live
WeaknessSensitive Cookie in HTTPS Session Without 'Secure' Attributecwe-6140%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-24896
CVE
CVE-2025-25306
CVE
CVE-2025-24900
CVE
CVE-2025-30967
CVE
CVE-2025-26963
CVE
CVE-2026-28741
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.