CVE-2026-47746: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition in misskey-dev misskey
Misskey versions 12.37.0 up to but not including 2026.5.4 contain a time-of-check to time-of-use (TOCTOU) race condition during JSON-LD signature validation and compaction. This flaw arises because the JSON-LD parsing context is not consistently shared between signature verification and later processing, potentially allowing fraudulent data to be accepted as valid. The issue compromises data integrity and has been resolved in version 2026.5.4.
AI Analysis
Technical Summary
Misskey, an open source federated social media platform, has a TOCTOU race condition vulnerability (CWE-367) affecting versions from 12.37.0 up to 2026.5.4. The vulnerability occurs during JSON-LD signature validation and the compaction process because the parsing context used for signature verification is not shared with subsequent processing. This inconsistency can cause the application to trust manipulated information, leading to acceptance of fraudulent activities. The vulnerability has a CVSS 4.0 score of 8.9 (high severity) and was fixed in version 2026.5.4.
Potential Impact
An attacker could exploit this TOCTOU race condition to have fraudulent JSON-LD data accepted as valid by the application, resulting in a loss of data integrity. This could undermine trust in the platform's data validation processes and potentially allow unauthorized or malicious content to be processed as legitimate.
Mitigation Recommendations
Upgrade affected Misskey instances to version 2026.5.4 or later, where this TOCTOU vulnerability has been fixed. No other mitigation or temporary workaround is documented. Patch status is confirmed by the vendor advisory stating the fix in 2026.5.4.
CVE-2026-47746: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition in misskey-dev misskey
Description
Misskey versions 12.37.0 up to but not including 2026.5.4 contain a time-of-check to time-of-use (TOCTOU) race condition during JSON-LD signature validation and compaction. This flaw arises because the JSON-LD parsing context is not consistently shared between signature verification and later processing, potentially allowing fraudulent data to be accepted as valid. The issue compromises data integrity and has been resolved in version 2026.5.4.
CVSS v4.0
Score 8.9high
Affected software
misskey-dev
misskey
pkg:github/misskey-dev/misskeyRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Misskey, an open source federated social media platform, has a TOCTOU race condition vulnerability (CWE-367) affecting versions from 12.37.0 up to 2026.5.4. The vulnerability occurs during JSON-LD signature validation and the compaction process because the parsing context used for signature verification is not shared with subsequent processing. This inconsistency can cause the application to trust manipulated information, leading to acceptance of fraudulent activities. The vulnerability has a CVSS 4.0 score of 8.9 (high severity) and was fixed in version 2026.5.4.
Potential Impact
An attacker could exploit this TOCTOU race condition to have fraudulent JSON-LD data accepted as valid by the application, resulting in a loss of data integrity. This could undermine trust in the platform's data validation processes and potentially allow unauthorized or malicious content to be processed as legitimate.
Mitigation Recommendations
Upgrade affected Misskey instances to version 2026.5.4 or later, where this TOCTOU vulnerability has been fixed. No other mitigation or temporary workaround is documented. Patch status is confirmed by the vendor advisory stating the fix in 2026.5.4.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-19T22:16:39.504Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a71103cbf32cb7a344d9fc1
Added to database: 08/03/2026, 22:03:40 UTC
Last enriched: 08/11/2026, 18:35:08 UTC
Last updated: 09/17/2026, 22:01:35 UTC
Views: 45
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.