Loading...
Skip to main content
GeekWala

CVE-2026-39386 — Vulnerability in github.com/m1k1o/neko/server —...

HIGH

Neko has a Self-service Privilege Escalation for Authenticated Users

Published April 21, 2026Updated June 9, 2026Source: osv

Summary

### Impact Any authenticated user can immediately obtain full administrative control of the entire Neko instance (member management, room settings, broadcast control, session termination, etc.). This results in a complete compromise of the instance. ### Patches The vulnerability has been patched in the following releases: - [v3.0.11](https://github.com/m1k1o/neko/releases/tag/v3.0.11) (backport release) - [v3.1.2](https://github.com/m1k1o/neko/releases/tag/v3.1.2) (latest stable release) Users should upgrade to [v3.0.11](https://github.com/m1k1o/neko/releases/tag/v3.0.11) or later (for the 3.0 branch) or [v3.1.2](https://github.com/m1k1o/neko/releases/tag/v3.1.2) or later. ### Workarounds If upgrading is not immediately possible, the following mitigations can reduce risk: - Restrict access to trusted users only (avoid granting accounts to untrusted parties) - Run the instance only when needed; avoid leaving it continuously exposed - Disable or restrict access to the `/api/profile` endpoint if feasible - Monitor for suspicious privilege changes or unexpected administrative actions Note: These are temporary mitigations and do not fully eliminate the vulnerability. Upgrading is strongly recommended. ### Credits Neko thanks @blitzkrieg-patch for responsibly disclosing this vulnerability and reaching out directly. This contribution helped strengthen the project, and the whole community benefits from it.

Advisory Timeline

  • First published April 21, 2026 (174 days ago).
  • Last revised June 9, 2026 — 49 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Go
Update github.com/m1k1o/neko/server to 0.0.0-20260406184107-c54bcf1ee211 or later
go get github.com/m1k1o/neko/server@v0.0.0-20260406184107-c54bcf1ee211
Go
Update github.com/m1k1o/neko/server to 3.0.11 or later
go get github.com/m1k1o/neko/server@v3.0.11

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: go (1).

PackageEcosystemAffectedFixed In
github.com/m1k1o/neko/server
go
All versions0.0.0-20260406184107-c54bcf1ee211
github.com/m1k1o/neko/server
go
All versions3.0.11

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-39386?
Neko has a Self-service Privilege Escalation for Authenticated Users This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2026-39386?
CVE-2026-39386 affects github.com/m1k1o/neko/server. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-39386 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-2gw9-c2r2-f5qf
GO-2026-4960

Related CVEs

  • CVE-2026-107809
    HIGH

    Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

  • CVE-2026-107813
    HIGH

    Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies