Threat Intelligence Database

Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Misskey web client to slow down or crash when it applies a malformed theme. This issue has been fixed in version 2026.5.4.

Misskey versions 12.37.0 up to but not including 2026.5.4 contain a time-of-check to time-of-use (TOCTOU) race condition during JSON-LD signature validation and compaction. This flaw arises because the JSON-LD parsing context is not consistently shared between signature verification and later processing, potentially allowing fraudulent data to be accepted as valid. The issue compromises data integrity and has been resolved in version 2026.5.4.

Misskey versions 12.37.0 up to but not including 2026.5.4 contain a vulnerability in the JSON-LD signature validation and compaction process. This flaw allows spoofed activities to be accepted as valid due to improper verification of cryptographic signatures. The issue is fixed in version 2026.5.4. The vulnerability has a high severity with a CVSS 4.0 score of 9.2, indicating critical impact if exploited.

Misskey versions from 2025.3.2 up to but not including 2026.5.4 contain an authorization bypass vulnerability in the Direct Messages feature. This flaw allows access to certain data points without proper permission checks, regardless of account permissions or federation settings. Notes with specified (formerly direct) visibility are not affected. The issue is fixed in version 2026.5.4.

Misskey is an open source, federated social media platform. All Misskey servers running versions 2024.5.0 and later, but prior to 2026.5.4, contain a vulnerability in the Server Announcements API where insufficient permission checks allow attackers to access limited portions of data that they normally couldn't view. This vulnerability occurs whether or not federation is enabled. This issue has been fixed in version 2026.5.4.

Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a vulnerability in Time-based One-Time Password (TOTP) authentication in UserAuthService where insufficient validation of used tokens allows the reuse of a single-use code within its valid time step. If both credentials and a TOTP code are obtained concurrently, an attacker may reuse the code to perform unauthorized actions, potentially leading to account takeover. This issue is fixed in version 2026.6.0.

Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a Server-Side Request Forgery (SSRF) vulnerability in URL preview functionality in UrlPreviewService. Due to missing network restrictions before establishing outbound connections, a remote attacker can cause the Misskey server to initiate HTTP requests to loopback, private, or link-local services. Because IP address validation takes place after the request has been sent and the process is subsequently rejected, no sensitive internal data is believed to be transmitted back or exposed to the attacker. This issue is fixed in version 2026.6.0.

Misskey is an open source, federated social media platform. All Misskey servers running versions 10.93.0 and later, but prior to 2026.3.1, contain a vulnerability that allows importing other users' data due to lack of ownership validation. The impact of this vulnerability is estimated to be relatively low, as bad actors would require the ID corresponding to the target file for import. This vulnerability is fixed in 2026.3.1.

LowVulnerabilityUnited StatesJapanGermany+7#cve#cve-2026-28433#cwe-639

Misskey is an open source, federated social media platform. All Misskey servers prior to 2026.3.1 contain a vulnerability that allows bypassing HTTP signature verification. Although this is a vulnerability related to federation, it affects all servers regardless of whether federation is enabled or disabled. This vulnerability is fixed in 2026.3.1.

HighVulnerabilityUnited StatesJapanGermany+7#cve#cve-2026-28432#cwe-347

Misskey is an open source, federated social media platform. All Misskey servers running versions 8.45.0 and later, but prior to 2026.3.1, contain a vulnerability that allows bad actors access to data that they ordinarily wouldn't be able to access due to insufficient permission checks and proper input validation. This vulnerability occurs regardless of whether federation is enabled or not. This vulnerability could lead to a significant data breach. This vulnerability is fixed in 2026.3.1.

CriticalVulnerabilityUnited StatesGermanyJapan+7#cve#cve-2026-28431#cwe-285