TI-2026-22705 Aliases CVE-2026-28431

Misskey lacks proper authorization checks and input validation

MEDIUM 45CWE-285Published 2026-03-09 · Updated 2026-03-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-285.

Summary

Misskey is an open source, federated social media platform. All Misskey servers running versions 8.45.0 and later, but prior to 2026.3.1, contain a vulnerability that allows bad actors access to data that they ordinarily wouldn't be able to access due to insufficient permission checks and proper input validation. This vulnerability occurs regardless of whether federation is enabled or not. This vulnerability could lead to a significant data breach. This vulnerability is fixed in 2026.3.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00284 20th percentileScored 2026-11-07

Fix Fixed misskey (misskey-dev): 2026.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
misskey-dev	misskey	8.45.0 to before 2026.3.1	2026.3.1	Patch available	CNA

misskey Vendormisskey-dev Affected 8.45.0 to before 2026.3.1 Fixed in 2026.3.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:misskey:misskey::::::::	8.45.0 to before 2026.3.1	Vulnerable	misskey-dev

cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:* Versions 8.45.0 to before 2026.3.1 Vulnerable ·misskey-dev

Remediation

Fix · CNA misskey (misskey-dev) Fixed in 2026.3.1

Timeline

2026-10-02 Threatist record created from CVE-2026-28431

References

Advisory 1

https://github.com/misskey-dev/misskey/security/advisories/GHSA-r33c-qg3g-v9cr

TI-2025-18599 Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes CVSS 3.1HIGH 8.2
TI-2025-29081 Misskey CSS Style Injection Vulnerability In `MkUrlPreview` CVSS 3.1HIGH 7.2
TI-2025-40906 Misskey has a login rate limit bypass via spoofed X-Forwarded-For header CVSS 4.0MEDIUM 6.9
TI-2025-29276 Misskey Directory Traversal Vulnerability in AiScript via `Mk:api` CVSS 3.1HIGH 7.5
TI-2025-40839 misskey.js's export data contains private post data CVSS 4.0HIGH 7.1
TI-2025-18960 Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes CVSS 3.1CRITICAL 9.3

See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences