PatchTheCVECVE-2024-32983: Misskey is an open source, decentralized microblogging platform
CVE-2024-32983 is a high-severity flaw (CVSS 8.2) affecting misskey. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoming signed ActivityPub activity objects before processing them, allowing threat actors to spoof the contents of signed activities and impersonate the authors of the original activities. This vulnerability is fixed in 2024.5.0.
Why this priority
- High severity
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.2 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 66%) |
| CISA exploited list | No |
| Weakness | CWE-863 |
| Published | 2024-06-03 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-32983?
misskey: upgrade to 2024.5.0. Exact commands for each OS are on this page.
Is CVE-2024-32983 being exploited?
CVE-2024-32983 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-32983 affect?
CVE-2024-32983 affects misskey. Severity is high (CVSS 8.2). Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoming signed ActivityPub activity objects before processing them, allowing threat actors to spoof the
How urgent is CVE-2024-32983?
Priority 47/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2025-66482 MEDIUM 6.5 UPGRADE Misskey is an open source, federated social media platform
- CVE-2025-66402 MEDIUM 6.5 UPGRADE Misskey is an open source, federated social media platform
- CVE-2026-28433 MEDIUM 4.3 UPGRADE Misskey is an open source, federated social media platform
- CVE-2026-28432 HIGH 7.5 UPGRADE Misskey is an open source, federated social media platform
- CVE-2026-28431 HIGH 7.5 UPGRADE Misskey is an open source, federated social media platform