GHSA-2gw9-c2r2-f5qf

Source

https://github.com/advisories/GHSA-2gw9-c2r2-f5qf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-2gw9-c2r2-f5qf/GHSA-2gw9-c2r2-f5qf.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-2gw9-c2r2-f5qf

Aliases

Published

2026-04-21T17:24:42Z

Modified

2026-06-09T10:52:18Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Neko has a Self-service Privilege Escalation for Authenticated Users

Details

Impact

Any authenticated user can immediately obtain full administrative control of the entire Neko instance (member management, room settings, broadcast control, session termination, etc.). This results in a complete compromise of the instance.

Patches

The vulnerability has been patched in the following releases:

v3.0.11 (backport release)
v3.1.2 (latest stable release)

Users should upgrade to v3.0.11 or later (for the 3.0 branch) or v3.1.2 or later.

Workarounds

If upgrading is not immediately possible, the following mitigations can reduce risk:

Restrict access to trusted users only (avoid granting accounts to untrusted parties)
Run the instance only when needed; avoid leaving it continuously exposed
Disable or restrict access to the /api/profile endpoint if feasible
Monitor for suspicious privilege changes or unexpected administrative actions

Note: These are temporary mitigations and do not fully eliminate the vulnerability. Upgrading is strongly recommended.

Credits

Neko thanks @blitzkrieg-patch for responsibly disclosing this vulnerability and reaching out directly. This contribution helped strengthen the project, and the whole community benefits from it.

Database specific

{
    "cwe_ids": [
        "CWE-20",
        "CWE-269",
        "CWE-284",
        "CWE-639",
        "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-21T17:24:42Z",
    "nvd_published_at": "2026-04-21T01:16:06Z",
    "severity": "HIGH"
}

References

Affected packages

Go / github.com/m1k1o/neko/server

Package

Name: github.com/m1k1o/neko/server; View open source insights on deps.dev
Purl: pkg:golang/github.com/m1k1o/neko/server

Affected ranges

Type: SEMVER
Events: Introduced

3.0.0

Fixed

3.0.11

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-2gw9-c2r2-f5qf/GHSA-2gw9-c2r2-f5qf.json"

Go / github.com/m1k1o/neko/server

Package

Name: github.com/m1k1o/neko/server; View open source insights on deps.dev
Purl: pkg:golang/github.com/m1k1o/neko/server

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-20250322225643-212bf8a60756

Fixed

0.0.0-20260406184107-c54bcf1ee211

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-2gw9-c2r2-f5qf/GHSA-2gw9-c2r2-f5qf.json"