Neko has a Self-service Privilege Escalation for Authenticated Users
Exact source revision recorded 24 Oct 2026 13:19:41 UTC. It does not establish the source's current position. Latest evidence.
osv · GHSA-2gw9-c2r2-f5qf
Published### Impact Any authenticated user can immediately obtain full administrative control of the entire Neko instance (member management, room settings, broadcast control, session termination, etc.). This results in a complete compromise of the instance. ### Patches The vulnerability has been patched in the following releases: - [v3.0.11](https://github.com/m1k1o/neko/releases/tag/v3.0.11) (backport release) - [v3.1.2](https://github.com/m1k1o/neko/releases/tag/v3.1.2) (latest stable release) Users should upgrade to [v3.0.11](https://github.com/m1k1o/neko/releases/tag/v3.0.11) or later (for the 3.0 branch) or [v3.1.2](https://github.com/m1k1o/neko/releases/tag/v3.1.2) or later. ### Workarounds If upgrading is not immediately possible, the following mitigations can reduce risk: - Restrict access to trusted users only (avoid granting accounts to untrusted parties) - Run the instance only when needed; avoid leaving it continuously exposed - Disable or restrict access to the `/api/profile` endpoint if feasible - Monitor for suspicious privilege changes or unexpected administrative actions Note: These are temporary mitigations and do not fully eliminate the vulnerability. Upgrading is strongly recommended. ### Credits Neko thanks @blitzkrieg-patch for responsibly disclosing this vulnerability and reaching out directly. This contribution helped strengthen the project, and the whole community benefits from it.
- Source published
- 21 Apr 2026 17:24:42 UTC
- Source modified
- 9 Jun 2026 10:52:18 UTC
- Observed here
- 24 Oct 2026 13:19:41 UTC
- Source terms
- GitHub Advisory Database · CC-BY-4.0
Original source record · Cite this exact observation · Complete original publisher JSON
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.
CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Publisher rating · HIGH