Vulnerability · Published Dec 15, 2025 · Assigned by GitHub_M
CVE-2025-66402misskey.js's export data contains private post data
High 7.1
In plain English
A high-severity missing authorization in misskey from misskey-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)7.1High
Exploit odds (30 days)0.3%top 75.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Misskey is an open source, federated social media platform. Starting in version 13.0.0-beta.16 and prior to version 2025.12.0, an actor who does not have permission to view favorites or clips can can export the posts and view the contents. Version 2025.12.0 fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | misskey-js | 2025.12.0 | GHSA-496g-mmpw-j9x3 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| misskey-dev | misskey | >= 13.0.0-beta.16, < 2025.12.0 |
Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N