CVE-2026-46712

Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability where a lack of proper permission checks allows access to certain data points from the Direct Messages (formerly Chat) feature, regardless of account permissions. This vulnerability occurs whether or not federation is enabled. Notes created with "specified" visibility (formerly "direct" visibility) are not affected. This issue has been fixed in version 2026.5.4.

CVSS

No CVSS.

References

Link	Resource
https://github.com/misskey-dev/misskey/releases/tag/2026.5.4
https://github.com/misskey-dev/misskey/security/advisories/GHSA-2m3r-xx7x-63j6

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Misskey es una plataforma de redes sociales de código abierto y federada. Las versiones 2025.3.2 y posteriores, pero anteriores a la 2026.5.4, contienen una vulnerabilidad donde una falta de comprobaciones de permisos adecuadas permite el acceso a ciertos puntos de datos de la función de Mensajes Directos (anteriormente Chat), independientemente de los permisos de la cuenta. Esta vulnerabilidad ocurre ya sea que la federación esté habilitada o no. Las notas creadas con visibilidad ’especificada’ (anteriormente visibilidad ’directa’) no se ven afectadas. Este problema ha sido solucionado en la versión 2026.5.4.

Information

Published : 2026-08-03 22:16

Updated : 2026-10-23 21:10

NVD link : CVE-2026-46712

Mitre link : CVE-2026-46712

CVE.ORG link : CVE-2026-46712

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-46712", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46712", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-04T15:45:45.520135Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "misskey-dev", "product": "misskey", "versions": [{"status": "affected", "version": ">= 2025.3.2, < 2026.5.4"}]}]}], "published": "2026-08-03T22:16:48.863", "references": [{"url": "https://github.com/misskey-dev/misskey/releases/tag/2026.5.4", "source": "security-advisories@github.com"}, {"url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-2m3r-xx7x-63j6", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability where a lack of proper permission checks allows access to certain data points from the Direct Messages (formerly Chat) feature, regardless of account permissions. This vulnerability occurs whether or not federation is enabled. Notes created with \"specified\" visibility (formerly \"direct\" visibility) are not affected. This issue has been fixed in version 2026.5.4."}, {"lang": "es", "value": "Misskey es una plataforma de redes sociales de c\u00f3digo abierto y federada. Las versiones 2025.3.2 y posteriores, pero anteriores a la 2026.5.4, contienen una vulnerabilidad donde una falta de comprobaciones de permisos adecuadas permite el acceso a ciertos puntos de datos de la funci\u00f3n de Mensajes Directos (anteriormente Chat), independientemente de los permisos de la cuenta. Esta vulnerabilidad ocurre ya sea que la federaci\u00f3n est\u00e9 habilitada o no. Las notas creadas con visibilidad \u2019especificada\u2019 (anteriormente visibilidad \u2019directa\u2019) no se ven afectadas. Este problema ha sido solucionado en la versi\u00f3n 2026.5.4."}], "lastModified": "2026-10-23T21:10:00.157", "sourceIdentifier": "security-advisories@github.com"}