PT-2026-24122 · Misskey · Misskey

Kakkokari-Gtyih · Published 2026-03-09 · Updated 2026-03-13 · CVE-2026-28433

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Misskey versions 10.93.0 through 2026.3.0

Description Misskey is a federated social media platform. A flaw exists that allows importing data belonging to other users because of insufficient ownership validation. The potential impact is considered low, as exploitation requires knowledge of the target file ID.

Recommendations Update to version 2026.3.1 or later.

Exploit

Fix

Missing Authorization

IDOR

Weakness Enumeration

CWE-862

CWE-639

Related Identifiers

CVE-2026-28433

GHSA-G6HJ-33H7-6FQ8

Affected Products

Misskey

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28433.json · Exploit
• https://github.com/misskey-dev/misskey/security/advisories/GHSA-g6hj-33h7-6fq8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28433 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28433 · Vendor Advisory
• https://twitter.com/oss_security/status/2031085885781946632 · Twitter Post
• https://t.me/cveNotify/155438 · Telegram Post
• https://twitter.com/CVEnew/status/2031122504178122760 · Twitter Post
• https://t.me/cveNotify/154896 · Telegram Post