Misskey ActivityPub Object Forgery Vulnerability

A vulnerability in Misskey's ActivityPub implementation allows for the forgery of objects by improperly validating the relationship between the 'id' and 'url' fields. This issue is present in Misskey versions through 2025.2.0. An attacker can exploit this vulnerability to claim authority in the 'url' field, even when the ActivityPub object type requires authority in the 'id' field. This flaw arises from an incomplete patch for a previous vulnerability, CVE-2024-52591.

Impact

Exploitation of this vulnerability could lead to unauthorized manipulation of ActivityPub objects, allowing attackers to falsely assert authority over certain content.

Remediation

Users can upgrade to Misskey version 2025.2.1 to address this vulnerability.