Misskey Data Import Vulnerability Due to Lack of Ownership Validation

A vulnerability exists in Misskey, an open-source federated social media platform, in all servers running versions 10.93.0 and later, but prior to 2026.3.1. This vulnerability allows the import of other users' data without proper ownership validation. While the impact is considered relatively low, as malicious actors would need to know the ID of the target file to import it, the issue still poses a risk to user privacy.

Impact

Exploitation of this vulnerability could lead to unauthorized access and import of other users' data, potentially violating user privacy.

Remediation

Users can update to Misskey version 2026.3.1 or later, where this vulnerability has been fixed. For those using Misskey version 2024.9.0 or later, the importing function can be disabled via role policy as a temporary workaround.