Misskey Data Access Vulnerability Due to Insufficient Permission Checks and Input Validation

A vulnerability in Misskey, an open-source federated social media platform, allows unauthorized access to data on servers running versions 8.45.0 and later, but prior to 2026.3.1. This issue arises from inadequate permission checks and input validation, potentially leading to a significant data breach. The vulnerability exists regardless of whether federation is enabled.

Impact

Exploitation of this vulnerability could result in unauthorized data access, leading to a substantial data breach.

Remediation

Users are advised to update to Misskey version 2026.3.1 or later. There is no known workaround for this vulnerability.