Misskey lacks resource ownership validation
Priority LOW 12CWE-639Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
Misskey is an open source, federated social media platform. All Misskey servers running versions 10.93.0 and later, but prior to 2026.3.1, contain a vulnerability that allows importing other users' data due to lack of ownership validation. The impact of this vulnerability is estimated to be relatively low, as bad actors would require the ID corresponding to the target file for import. This vulnerability is fixed in 2026.3.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00249 16th percentileScored 2026-11-07
Fix Fixed misskey (misskey-dev): 2026.3.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| misskey-dev | misskey | 10.93.0 to before 2026.3.1 | 2026.3.1 | Patch available | CNA |
- misskey Vendormisskey-dev Affected 10.93.0 to before 2026.3.1 Fixed in 2026.3.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:* | 10.93.0 to before 2026.3.1 | Vulnerable | misskey-dev |
- cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:* Versions 10.93.0 to before 2026.3.1 Vulnerable ·misskey-dev
Remediation
- Fix · CNA misskey (misskey-dev) Fixed in 2026.3.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-28433
References
More misskey-dev Misskey vulnerabilities
- TI-2025-18599 Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes CVSS 3.1HIGH 8.2
- TI-2025-29081 Misskey CSS Style Injection Vulnerability In `MkUrlPreview` CVSS 3.1HIGH 7.2
- TI-2025-40906 Misskey has a login rate limit bypass via spoofed X-Forwarded-For header CVSS 4.0MEDIUM 6.9
- TI-2025-29276 Misskey Directory Traversal Vulnerability in AiScript via `Mk:api` CVSS 3.1HIGH 7.5
- TI-2025-40839 misskey.js's export data contains private post data CVSS 4.0HIGH 7.1
- TI-2026-22705 Misskey lacks proper authorization checks and input validation CVSS 4.0CRITICAL 9.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences