Vulnerability · Published Aug 3, 2026 · Assigned by GitHub_M

CVE-2026-46712Misskey: Lack of proper permission checks in Direct Messaging feature

Low 2.3

In plain English

A low-severity authorization bypass via user-controlled key in misskey from misskey-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 4.0)2.3Low

Exploit odds (30 days)0.4%top 69.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability where a lack of proper permission checks allows access to certain data points from the Direct Messages (formerly Chat) feature, regardless of account permissions. This vulnerability occurs whether or not federation is enabled. Notes created with "specified" visibility (formerly "direct" visibility) are not affected. This issue has been fixed in version 2026.5.4.

Affected products (as reported)

Vendor	Product	Versions
misskey-dev	misskey	>= 2025.3.2, < 2026.5.4

Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/misskey-dev/misskey/security/advisories/GHSA-2m3r-xx7x-63j6 x_refsource_CONFIRM
https://github.com/misskey-dev/misskey/releases/tag/2026.5.4 x_refsource_MISC