{"id":"GHSA-2gw9-c2r2-f5qf","revision":"80082cd0f9f3481eb6d27982041b379d","records":[{"revision":"80082cd0f9f3481eb6d27982041b379d","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-2gw9-c2r2-f5qf","aliases":["CVE-2026-39386","GO-2026-4960"],"title":"Neko has a Self-service Privilege Escalation for Authenticated Users","description":"### Impact\n\nAny authenticated user can immediately obtain full administrative control of the entire Neko instance (member management, room settings, broadcast control, session termination, etc.). This results in a complete compromise of the instance.\n\n### Patches\n\nThe vulnerability has been patched in the following releases:\n\n- [v3.0.11](https://github.com/m1k1o/neko/releases/tag/v3.0.11) (backport release)\n- [v3.1.2](https://github.com/m1k1o/neko/releases/tag/v3.1.2) (latest stable release)\n\nUsers should upgrade to [v3.0.11](https://github.com/m1k1o/neko/releases/tag/v3.0.11) or later (for the 3.0 branch) or [v3.1.2](https://github.com/m1k1o/neko/releases/tag/v3.1.2) or later.\n\n### Workarounds\n\nIf upgrading is not immediately possible, the following mitigations can reduce risk:\n\n- Restrict access to trusted users only (avoid granting accounts to untrusted parties)\n- Run the instance only when needed; avoid leaving it continuously exposed\n- Disable or restrict access to the `/api/profile` endpoint if feasible\n- Monitor for suspicious privilege changes or unexpected administrative actions\n\nNote: These are temporary mitigations and do not fully eliminate the vulnerability. Upgrading is strongly recommended.\n\n### Credits\nNeko thanks @blitzkrieg-patch for responsibly disclosing this vulnerability and reaching out directly. This contribution helped strengthen the project, and the whole community benefits from it.","state":0,"publishedAt":"2026-04-21T17:24:42+00:00","modifiedAt":"2026-06-09T10:52:18+00:00","affected":[{"ecosystem":"Go","name":"github.com/m1k1o/neko/server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.0.11"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/m1k1o/neko/server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-20250322225643-212bf8a60756"},{"kind":"fixed","version":"0.0.0-20260406184107-c54bcf1ee211"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/m1k1o/neko/security/advisories/GHSA-2gw9-c2r2-f5qf","https://nvd.nist.gov/vuln/detail/CVE-2026-39386","https://github.com/m1k1o/neko/commit/6b561feb9016badea99ae7305091c0ff55e1d114","https://github.com/m1k1o/neko/commit/c54bcf1ee211e28104a2bb6db59583a39c4a4d6e","https://github.com/m1k1o/neko","https://github.com/m1k1o/neko/releases/tag/v3.0.11","https://github.com/m1k1o/neko/releases/tag/v3.1.2"],"sourceUrl":"https://github.com/advisories/GHSA-2gw9-c2r2-f5qf","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-2gw9-c2r2-f5qf","identifiers":["GHSA-2gw9-c2r2-f5qf","CVE-2026-39386","GO-2026-4960"]},"retained":false,"historicalAffected":[]}],"coverage":[]}