Misskey, an open source federated social media platform, has a vulnerability in versions from 12.0.0 through 13.14.2, from 2023.9.0-beta.1 up to but not including 2025.4.1, and from 2025.5.0 up to but not including 2026.7.0. The issue involves incomplete cleanup during file uploads, which can lead to exhaustion of storage or file descriptors, causing a denial of service. This vulnerability is fixed in version 2026.7.0.
Misskey versions from 12.0.0 through 13.14.2 and from 2023.9.0-beta.1 up to but not including 2026.7.0 have a vulnerability in the unauthenticated fetch-rss API. This API lacks rate limiting and response size restrictions and performs synchronous XML parsing. An attacker can exploit this to cause unbounded outbound HTTP requests and synchronous parsing, leading to resource exhaustion on the instance, amplification of requests toward third-party servers, or probing of network-reachable services even if federation is disabled. The issue is fixed in version 2026.7.0.
Misskey versions from 12.0.0 up to but not including 2026.7.0 contain a cross-site scripting (XSS) vulnerability in their RSS components. The issue arises because feed item links are displayed without verifying their URL schemes, allowing attackers controlling feed content to inject unsafe links that execute scripts when clicked in an RSS widget. This vulnerability is fixed in version 2026.7.0.
Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Misskey web client to slow down or crash when it applies a malformed theme. This issue has been fixed in version 2026.5.4.
Misskey versions 12.37.0 up to but not including 2026.5.4 contain a time-of-check to time-of-use (TOCTOU) race condition during JSON-LD signature validation and compaction. This flaw arises because the JSON-LD parsing context is not consistently shared between signature verification and later processing, potentially allowing fraudulent data to be accepted as valid. The issue compromises data integrity and has been resolved in version 2026.5.4.
Misskey versions 12.37.0 up to but not including 2026.5.4 contain a vulnerability in the JSON-LD signature validation and compaction process. This flaw allows spoofed activities to be accepted as valid due to improper verification of cryptographic signatures. The issue is fixed in version 2026.5.4. The vulnerability has a high severity with a CVSS 4.0 score of 9.2, indicating critical impact if exploited.
Misskey versions from 2025.3.2 up to but not including 2026.5.4 contain an authorization bypass vulnerability in the Direct Messages feature. This flaw allows access to certain data points without proper permission checks, regardless of account permissions or federation settings. Notes with specified (formerly direct) visibility are not affected. The issue is fixed in version 2026.5.4.
Misskey is an open source, federated social media platform. All Misskey servers running versions 2024.5.0 and later, but prior to 2026.5.4, contain a vulnerability in the Server Announcements API where insufficient permission checks allow attackers to access limited portions of data that they normally couldn't view. This vulnerability occurs whether or not federation is enabled. This issue has been fixed in version 2026.5.4.
Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a vulnerability in Time-based One-Time Password (TOTP) authentication in UserAuthService where insufficient validation of used tokens allows the reuse of a single-use code within its valid time step. If both credentials and a TOTP code are obtained concurrently, an attacker may reuse the code to perform unauthorized actions, potentially leading to account takeover. This issue is fixed in version 2026.6.0.
Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a Server-Side Request Forgery (SSRF) vulnerability in URL preview functionality in UrlPreviewService. Due to missing network restrictions before establishing outbound connections, a remote attacker can cause the Misskey server to initiate HTTP requests to loopback, private, or link-local services. Because IP address validation takes place after the request has been sent and the process is subsequently rejected, no sensitive internal data is believed to be transmitted back or exposed to the attacker. This issue is fixed in version 2026.6.0.
Misskey is an open source, federated social media platform. All Misskey servers running versions 10.93.0 and later, but prior to 2026.3.1, contain a vulnerability that allows importing other users' data due to lack of ownership validation. The impact of this vulnerability is estimated to be relatively low, as bad actors would require the ID corresponding to the target file for import. This vulnerability is fixed in 2026.3.1.
Misskey is an open source, federated social media platform. All Misskey servers prior to 2026.3.1 contain a vulnerability that allows bypassing HTTP signature verification. Although this is a vulnerability related to federation, it affects all servers regardless of whether federation is enabled or disabled. This vulnerability is fixed in 2026.3.1.
Misskey is an open source, federated social media platform. All Misskey servers running versions 8.45.0 and later, but prior to 2026.3.1, contain a vulnerability that allows bad actors access to data that they ordinarily wouldn't be able to access due to insufficient permission checks and proper input validation. This vulnerability occurs regardless of whether federation is enabled or not. This vulnerability could lead to a significant data breach. This vulnerability is fixed in 2026.3.1.
Misskey is an open source, federated social media platform. Attackers who use an untrusted reverse proxy or not using a reverse proxy at all can bypass IP rate limiting by adding a forged X-Forwarded-For header. Starting with version 2025.9.1, an option (`trustProxy`) has been added in config file to prevent this from happening. However, it is initialized with an insecure default value before version 2025.12.0-alpha.2, making it still vulnerable if the configuration is not set correctly. This is patched in v2025.12.0-alpha.2 by flipping default value of `trustProxy` to `false`. Users of a trusted reverse proxy who are unsure if they manually overode this value should check their config for optimal behavior. Users are running Misskey with a trusted reverse proxy should not be affected by this vulnerability. From v2025.9.1 to v2025.11.1, workaround is available. Set `trustProxy: false` in config file.
Misskey is an open source, federated social media platform. Starting in version 13.0.0-beta.16 and prior to version 2025.12.0, an actor who does not have permission to view favorites or clips can can export the posts and view the contents. Version 2025.12.0 fixes the issue.