misskey.js's export data contains private post data
Priority MEDIUM 64CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.
Summary
Misskey is an open source, federated social media platform. Starting in version 13.0.0-beta.16 and prior to version 2025.12.0, an actor who does not have permission to view favorites or clips can can export the posts and view the contents. Version 2025.12.0 fixes the issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00314 24th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed misskey (misskey-dev): 2025.12.0misskey-js (npm): 2025.12.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| misskey-dev | misskey | 13.0.0-beta.16 to before 2025.12.0 | 2025.12.0 | Patch available | CNA |
| — | misskey-js (npm) | 13.0.0-beta.16 to before 2025.12.0 | 2025.12.0 | Patch available | GHSA-496g-mmpw-j9x3 |
- misskey Vendormisskey-dev Affected 13.0.0-beta.16 to before 2025.12.0 Fixed in 2025.12.0 Patch available CNA
- misskey-js (npm) Vendor— Affected 13.0.0-beta.16 to before 2025.12.0 Fixed in 2025.12.0 Patch available GHSA-496g-mmpw-j9x3
CPE configurations NVD · 37
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:* | 13.1.0 to before 2025.12.0 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:-:*:*:*:*:*:* | 13.0.0 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta16:*:*:*:*:*:* | 13.0.0 beta16 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta21:*:*:*:*:*:* | 13.0.0 beta21 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta22:*:*:*:*:*:* | 13.0.0 beta22 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta23:*:*:*:*:*:* | 13.0.0 beta23 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta24:*:*:*:*:*:* | 13.0.0 beta24 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta25:*:*:*:*:*:* | 13.0.0 beta25 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta26:*:*:*:*:*:* | 13.0.0 beta26 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta27:*:*:*:*:*:* | 13.0.0 beta27 | Vulnerable | misskey-dev |
- cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:* Versions 13.1.0 to before 2025.12.0 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:-:*:*:*:*:*:* Versions 13.0.0 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta16:*:*:*:*:*:* Versions 13.0.0 beta16 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta21:*:*:*:*:*:* Versions 13.0.0 beta21 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta22:*:*:*:*:*:* Versions 13.0.0 beta22 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta23:*:*:*:*:*:* Versions 13.0.0 beta23 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta24:*:*:*:*:*:* Versions 13.0.0 beta24 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta25:*:*:*:*:*:* Versions 13.0.0 beta25 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta26:*:*:*:*:*:* Versions 13.0.0 beta26 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta27:*:*:*:*:*:* Versions 13.0.0 beta27 Vulnerable ·misskey-dev
Show 27 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:misskey:misskey:13.0.0:beta28:*:*:*:*:*:* | 13.0.0 beta28 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta29:*:*:*:*:*:* | 13.0.0 beta29 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta30:*:*:*:*:*:* | 13.0.0 beta30 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta31:*:*:*:*:*:* | 13.0.0 beta31 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta32:*:*:*:*:*:* | 13.0.0 beta32 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta33:*:*:*:*:*:* | 13.0.0 beta33 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta34:*:*:*:*:*:* | 13.0.0 beta34 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta35:*:*:*:*:*:* | 13.0.0 beta35 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta36:*:*:*:*:*:* | 13.0.0 beta36 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta37:*:*:*:*:*:* | 13.0.0 beta37 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta38:*:*:*:*:*:* | 13.0.0 beta38 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta39:*:*:*:*:*:* | 13.0.0 beta39 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta40:*:*:*:*:*:* | 13.0.0 beta40 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta41:*:*:*:*:*:* | 13.0.0 beta41 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta42:*:*:*:*:*:* | 13.0.0 beta42 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta43:*:*:*:*:*:* | 13.0.0 beta43 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:rc1:*:*:*:*:*:* | 13.0.0 rc1 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:rc10:*:*:*:*:*:* | 13.0.0 rc10 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:rc11:*:*:*:*:*:* | 13.0.0 rc11 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:rc2:*:*:*:*:*:* | 13.0.0 rc2 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:rc3:*:*:*:*:*:* | 13.0.0 rc3 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:rc4:*:*:*:*:*:* | 13.0.0 rc4 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:rc5:*:*:*:*:*:* | 13.0.0 rc5 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:rc6:*:*:*:*:*:* | 13.0.0 rc6 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:rc7:*:*:*:*:*:* | 13.0.0 rc7 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:rc8:*:*:*:*:*:* | 13.0.0 rc8 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:rc9:*:*:*:*:*:* | 13.0.0 rc9 | Vulnerable | misskey-dev |
- cpe:2.3:a:misskey:misskey:13.0.0:beta28:*:*:*:*:*:* Versions 13.0.0 beta28 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta29:*:*:*:*:*:* Versions 13.0.0 beta29 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta30:*:*:*:*:*:* Versions 13.0.0 beta30 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta31:*:*:*:*:*:* Versions 13.0.0 beta31 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta32:*:*:*:*:*:* Versions 13.0.0 beta32 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta33:*:*:*:*:*:* Versions 13.0.0 beta33 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta34:*:*:*:*:*:* Versions 13.0.0 beta34 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta35:*:*:*:*:*:* Versions 13.0.0 beta35 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta36:*:*:*:*:*:* Versions 13.0.0 beta36 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta37:*:*:*:*:*:* Versions 13.0.0 beta37 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta38:*:*:*:*:*:* Versions 13.0.0 beta38 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta39:*:*:*:*:*:* Versions 13.0.0 beta39 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta40:*:*:*:*:*:* Versions 13.0.0 beta40 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta41:*:*:*:*:*:* Versions 13.0.0 beta41 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta42:*:*:*:*:*:* Versions 13.0.0 beta42 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta43:*:*:*:*:*:* Versions 13.0.0 beta43 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:rc1:*:*:*:*:*:* Versions 13.0.0 rc1 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:rc10:*:*:*:*:*:* Versions 13.0.0 rc10 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:rc11:*:*:*:*:*:* Versions 13.0.0 rc11 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:rc2:*:*:*:*:*:* Versions 13.0.0 rc2 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:rc3:*:*:*:*:*:* Versions 13.0.0 rc3 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:rc4:*:*:*:*:*:* Versions 13.0.0 rc4 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:rc5:*:*:*:*:*:* Versions 13.0.0 rc5 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:rc6:*:*:*:*:*:* Versions 13.0.0 rc6 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:rc7:*:*:*:*:*:* Versions 13.0.0 rc7 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:rc8:*:*:*:*:*:* Versions 13.0.0 rc8 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:rc9:*:*:*:*:*:* Versions 13.0.0 rc9 Vulnerable ·misskey-dev
Remediation
- Fix · CNA misskey (misskey-dev) Fixed in 2025.12.0
- Fix · GHSA-496g-mmpw-j9x3 misskey-js (npm) Fixed in 2025.12.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-66402
- 2026-10-03 Alias added: GHSA-496g-mmpw-j9x3
References
More misskey-dev Misskey vulnerabilities
- TI-2025-18599 Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes CVSS 3.1HIGH 8.2
- TI-2025-29081 Misskey CSS Style Injection Vulnerability In `MkUrlPreview` CVSS 3.1HIGH 7.2
- TI-2025-40906 Misskey has a login rate limit bypass via spoofed X-Forwarded-For header CVSS 4.0MEDIUM 6.9
- TI-2025-29276 Misskey Directory Traversal Vulnerability in AiScript via `Mk:api` CVSS 3.1HIGH 7.5
- TI-2026-22705 Misskey lacks proper authorization checks and input validation CVSS 4.0CRITICAL 9.2
- TI-2025-18960 Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes CVSS 3.1CRITICAL 9.3
Sources
- CVE-2025-66402 · CVE Program
- CVE-2025-66402 · NVD
- FIRST EPSS
- GHSA-496g-mmpw-j9x3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences