CVE-2026-46712 in Misskey
Summary
by MITRE • 08/04/2026
Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability where a lack of proper permission checks allows access to certain data points from the Direct Messages (formerly Chat) feature, regardless of account permissions. This vulnerability occurs whether or not federation is enabled. Notes created with "specified" visibility (formerly "direct" visibility) are not affected. This issue has been fixed in version 2026.5.4.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
This vulnerability exists within the Misskey federated social media platform where insufficient authorization controls permit unauthorized access to direct message data points across all account permission levels. The flaw specifically affects versions between 2025.3.2 and 2026.5.3, inclusive, while leaving the platform secure in version 2026.5.4 and later releases. The vulnerability impacts the core messaging functionality regardless of whether the instance has federation enabled or disabled, indicating a fundamental flaw in the access control implementation that affects all deployment configurations. The issue stems from inadequate permission validation mechanisms within the direct messaging subsystem where users can potentially retrieve messages intended for other users without proper authentication or authorization checks.
The technical implementation of this vulnerability demonstrates a clear failure in the principle of least privilege enforcement and privilege separation within the application's security model. This represents a classic access control vulnerability that allows lateral movement and information disclosure across user boundaries, with potential implications for user privacy and data confidentiality. The flaw exists at the application layer where API endpoints or internal data access methods fail to properly validate user permissions before returning sensitive direct message content. The vulnerability is particularly concerning because it affects all account types regardless of their permission levels, meaning even restricted accounts can potentially access messages intended for other users.
From an operational perspective, this vulnerability creates significant risks for user privacy and platform integrity as it allows unauthorized data access that could expose personal communications, sensitive information exchanges, or potentially malicious activities within the direct messaging system. The impact extends beyond individual user privacy concerns to potential abuse of the federated network where compromised instances could serve as entry points for broader reconnaissance activities. Attackers could leverage this vulnerability to gather intelligence about user relationships, communication patterns, and potentially identify other users within the network through message content analysis. This issue affects the fundamental trust model of federated social platforms where users expect their private communications to remain confidential between intended participants.
The resolution in version 2026.5.4 addresses the root cause by implementing proper authorization checks that verify user permissions before granting access to direct message data points. This fix aligns with security best practices for access control implementations and demonstrates the importance of continuous security auditing in federated systems where vulnerabilities in one instance can potentially impact the broader network. Organizations running affected versions should immediately implement mitigation strategies including upgrading to version 2026.5.4 or later, monitoring for unauthorized access attempts, and reviewing existing user permissions to minimize potential exploitation windows. The vulnerability classification aligns with CWE-284 (Improper Access Control) and could be categorized under ATT&CK technique T1078 (Valid Accounts) as it allows unauthorized access through legitimate account mechanisms without requiring additional credential compromise.
This vulnerability highlights the critical importance of robust access control implementation in federated systems where multiple instances interact and share user data. The flaw demonstrates how seemingly isolated functionality can create widespread security implications when proper authorization boundaries are not maintained. Security practitioners should consider this vulnerability as a reminder of the need for comprehensive security testing including permission boundary validation, especially in distributed systems where trust relationships between instances must be carefully managed. The fix implementation likely involves strengthening API endpoint validation, enhancing internal access control logic, and ensuring that all data retrieval operations properly verify user credentials and permissions against the intended recipient or owner of the data being accessed.