CVE-2026-46712
Last modified
CVE-2026-46712 is a low-severity vulnerability rated 2.3/10 on the CVSS scale. Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability where a lack of proper permission checks allows access to certain data points from the Direct Messages (formerly Chat) feature, regardless of account permissions. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability where a lack of proper permission checks allows access to certain data points from the Direct Messages (formerly Chat) feature, regardless of account permissions. This vulnerability occurs whether or not federation is enabled. Notes created with "specified" visibility (formerly "direct" visibility) are not affected. This issue has been fixed in version 2026.5.4.
Metrics
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| misskey-dev | misskey | >= 2025.3.2, < 2026.5.4 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-46712?
How severe is CVE-2026-46712?
How do I fix CVE-2026-46712?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-46701Network-AI is a TypeScript/Node.js multi-agent orchestrator.…7.6
- CVE-2026-46702Russh is a Rust SSH client & server library. From version 0.…7.5
- CVE-2026-46703Boxlite is a sandbox service that allows users to create lig…9.6
- CVE-2026-46705Russh is a Rust SSH client & server library. From version 0.…5.3
- CVE-2026-46709Tabby (formerly Terminus) is a highly configurable terminal …7.8
- CVE-2026-46710Notepad++ is a free and open-source source code editor. From…7.8
- CVE-2026-46713Misskey is an open source, federated social media platform. …9.2
- CVE-2026-46714Misskey is an open source, federated social media platform. …5.1
- CVE-2026-46715Flask-Security-Too allows users to add security features to …5.3
- CVE-2026-46716Nezha Monitoring is a self-hostable, lightweight, servers an…9.9
- CVE-2026-46717Nezha Monitoring is a self-hostable, lightweight, servers an…7.7
- CVE-2026-46718Use of Externally-Controlled Input to Select Classes or Code…6.5
Are you affected by CVE-2026-46712?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST