Vulnerability · Published Mar 9, 2026 · Assigned by GitHub_M

CVE-2026-28433Misskey lacks resource ownership validation

Low 2.3

In plain English

A low-severity authorization bypass via user-controlled key in misskey from misskey-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 4.0)2.3Low

Exploit odds (30 days)0.2%top 83.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Misskey is an open source, federated social media platform. All Misskey servers running versions 10.93.0 and later, but prior to 2026.3.1, contain a vulnerability that allows importing other users' data due to lack of ownership validation. The impact of this vulnerability is estimated to be relatively low, as bad actors would require the ID corresponding to the target file for import. This vulnerability is fixed in 2026.3.1.

Affected products (as reported)

Vendor	Product	Versions
misskey-dev	misskey	>= 10.93.0, < 2026.3.1

Weakness: CWE-639, CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/misskey-dev/misskey/security/advisories/GHSA-g6hj-33h7-6fq8 x_refsource_CONFIRM