What’s Vulnerable › Vulnerabilities
CVE-2026-28433: Misskey lacks resource ownership validation
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-10 · updated 2026-06-17
- Weakness: CWE-639
Description
Misskey is an open source, federated social media platform. All Misskey servers running versions 10.93.0 and later, but prior to 2026.3.1, contain a vulnerability that allows importing other users' data due to lack of ownership validation. The impact of this vulnerability is estimated to be relatively low, as bad actors would require the ID corresponding to the target file for import. This vulnerability is fixed in 2026.3.1.
Affected products
- misskey-dev misskey: from 10.93.0 before 2026.3.1 — fixed in 2026.3.1
How to fix
Upgrade to a fixed version: misskey-dev misskey 2026.3.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-28433 or the next vulnerability affects your stack