{"id":"CVE-2026-39386","aliases":["GHSA-2gw9-c2r2-f5qf","GO-2026-4960"],"url":"https://o3.security/vulnerability/CVE-2026-39386","summary":"Neko has Self-service Privilege Escalation for Authenticated Users","details":"### Impact\n\nAny authenticated user can immediately obtain full administrative control of the entire Neko instance (member management, room settings, broadcast control, session termination, etc.). This results in a complete compromise of the instance.\n\n### Patches\n\nThe vulnerability has been patched in the following releases:\n\n- [v3.0.11](https://github.com/m1k1o/neko/releases/tag/v3.0.11) (backport release)\n- [v3.1.2](https://github.com/m1k1o/neko/releases/tag/v3.1.2) (latest stable release)\n\nUsers should upgrade to [v3.0.11](https://github.com/m1k1o/neko/releases/tag/v3.0.11) or later (for the 3.0 branch) or [v3.1.2](https://github.com/m1k1o/neko/releases/tag/v3.1.2) or later.\n\n### Workarounds\n\nIf upgrading is not immediately possible, the following mitigations can reduce risk:\n\n- Restrict access to trusted users only (avoid granting accounts to untrusted parties)\n- Run the instance only when needed; avoid leaving it continuously exposed\n- Disable or restrict access to the `/api/profile` endpoint if feasible\n- Monitor for suspicious privilege changes or unexpected administrative actions\n\nNote: These are temporary mitigations and do not fully eliminate the vulnerability. Upgrading is strongly recommended.\n\n### Credits\nNeko thanks @blitzkrieg-patch for responsibly disclosing this vulnerability and reaching out directly. This contribution helped strengthen the project, and the whole community benefits from it.","published":"2026-04-21T00:50:34.656Z","modified":"2026-10-28T02:30:54.101536359Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.00437,"percentile":0.36212,"asOf":"2026-08-13"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/m1k1o/neko/server","fixedVersion":"3.0.11"},{"ecosystem":"Go","name":"github.com/m1k1o/neko/server","fixedVersion":"0.0.0-20260406184107-c54bcf1ee211"}],"fix":{"url":"https://github.com/m1k1o/neko/commit/6b561feb9016badea99ae7305091c0ff55e1d114","label":"m1k1o/neko@6b561fe"},"references":[{"type":"WEB","url":"https://github.com/m1k1o/neko/releases/tag/v3.0.11"},{"type":"WEB","url":"https://github.com/m1k1o/neko/releases/tag/v3.1.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39386.json"},{"type":"ADVISORY","url":"https://github.com/m1k1o/neko/security/advisories/GHSA-2gw9-c2r2-f5qf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39386"},{"type":"WEB","url":"https://github.com/m1k1o/neko/commit/6b561feb9016badea99ae7305091c0ff55e1d114"},{"type":"WEB","url":"https://github.com/m1k1o/neko/commit/c54bcf1ee211e28104a2bb6db59583a39c4a4d6e"},{"type":"PACKAGE","url":"https://github.com/m1k1o/neko"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:54.101536359Z"}}