CVE-2026-39386
- EPSS 0.44%
- Veröffentlicht 21.04.2026 00:50:34
- Zuletzt bearbeitet 23.04.2026 18:21:32
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
LoginNeko has Self-service Privilege Escalation for Authenticated Users
Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC In versions 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1, any authenticated user can immediately obtain full administrative control of the entire Neko instance (member management, room settings, broadcast control, session termination, etc.). This results in a complete compromise of the instance. The vulnerability has been patched in v3.0.11 and v3.1.2. If upgrading is not immediately possible, the following mitigations can reduce risk: Restrict access to trusted users only (avoid granting accounts to untrusted parties); ensure all user passwords are strong and only shared with trusted individuals; run the instance only when needed; avoid leaving it continuously exposed; place the instance behind authentication layers such as a reverse proxy with additional access controls; disable or restrict access to the /api/profile endpoint if feasible; and/or monitor for suspicious privilege changes or unexpected administrative actions. Note that these are temporary mitigations and do not fully eliminate the vulnerability. Upgrading is strongly recommended.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.44% | 0.347 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security-advisories@github.com | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.