PT-2026-24120 · Misskey · Misskey

49016 + 1 · Published 2026-03-09 · Updated 2026-03-13 · CVE-2026-28431

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Misskey versions 8.45.0 through 2026.3.0

Description Misskey, an open source, federated social media platform, has an issue where insufficient permission checks and proper input validation can allow unauthorized access to data. This can occur regardless of federation status and could lead to a significant data breach.

Recommendations Update to version 2026.3.1 or later.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-28431

GHSA-R33C-QG3G-V9CR

Affected Products

Misskey

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28431.json · Exploit
• https://github.com/misskey-dev/misskey/security/advisories/GHSA-r33c-qg3g-v9cr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28431 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28431 · Security Note
• https://twitter.com/oss_security/status/2031085885781946632 · Twitter Post
• https://twitter.com/0dayPublishing/status/2031122581240066145 · Twitter Post
• https://t.me/cveNotify/155436 · Telegram Post
• https://twitter.com/CVEnew/status/2031122506405265865 · Twitter Post
• https://t.me/cveNotify/154894 · Telegram Post