On October 22, we identified and fixed an authorization flaw in our support ticket system that could allow signed-in users with support access to view or modify tickets belonging to other accounts.
Our investigation to date indicates that some support tickets may have been accessed without authorization. Logs also show successful requests to update some of these tickets. We are continuing to review the scope of access and any unauthorized changes.
The information available through these tickets included first names and the contents of support conversations. Our review found email addresses, customer IP addresses, the last few digits of payment card numbers, and one historical server password in ticket content. We have not found an active instance associated with that password, but this does not establish whether the credential remains in use elsewhere.
Protected attachments have separate authorization checks, which this ticket vulnerability did not bypass. We have not confirmed unauthorized downloads of those files. Publicly accessible external links included in ticket content could still be opened.
As a precaution, we have temporarily deployed additional security measures, which may occasionally block legitimate access. If you are unable to access the control panel, please contact us at [support@misaka.io](mailto:support@misaka.io).
What you should do
If you shared passwords, API keys, tokens, or other credentials in a support ticket, rotate any that remain in use, including credentials reused on other services.
Review access logs for those services for unusual activity.
Check your support history for unrecognized replies or status changes, and report anything unexpected to our support team.
Be cautious of any ticket reply asking for credentials or payment details, or containing unexpected links. Do not share passwords or other secrets in support tickets.
We will contact affected account holders directly as we confirm their individual impact and provide further updates on our status page.
We apologize for this failure and the risk it has created for our customers.
Investigating
On October 22, we identified and fixed an authorization flaw in our support ticket system that could allow signed-in users with support access to view or modify tickets belonging to other accounts.
Our investigation to date indicates that some support tickets may have been accessed without authorization. Logs also show successful requests to update some of these tickets. We are continuing to review the scope of access and any unauthorized changes.
The information available through these tickets included first names and the contents of support conversations. Our review found email addresses, customer IP addresses, the last few digits of payment card numbers, and one historical server password in ticket content. We have not found an active instance associated with that password, but this does not establish whether the credential remains in use elsewhere.
Protected attachments have separate authorization checks, which this ticket vulnerability did not bypass. We have not confirmed unauthorized downloads of those files. Publicly accessible external links included in ticket content could still be opened.
As a precaution, we have temporarily deployed additional security measures, which may occasionally block legitimate access. If you are unable to access the control panel, please contact us at [support@misaka.io](mailto:support@misaka.io).
What you should do
If you shared passwords, API keys, tokens, or other credentials in a support ticket, rotate any that remain in use, including credentials reused on other services.
Review access logs for those services for unusual activity.
Check your support history for unrecognized replies or status changes, and report anything unexpected to our support team.
Be cautious of any ticket reply asking for credentials or payment details, or containing unexpected links. Do not share passwords or other secrets in support tickets.
We will contact affected account holders directly as we confirm their individual impact and provide further updates on our status page.
We apologize for this failure and the risk it has created for our customers.