VulnSocial

CVE-2026-28433Disclosure(misskey / misskey)

LOWCVSS 4.3 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Patch misskey misskey systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Misskey is an open source, federated social media platform. All Misskey servers running versions 10.93.0 and later, but prior to 2026.3.1, contain a vulnerability that allows importing other users' data due to lack of ownership validation. The impact of this vulnerability is estimated to be relatively low, as bad actors would require the ID corresponding to the target file for import. This vulnerability is fixed in 2026.3.1.

misskey CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-639CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • misskey

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • 3 total mentions across 1 day

Affected systems

Vendors
misskey
Products
misskey

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-03-09: 3Patch / Workaround · 2026-03-09: 1Technical Details · 2026-03-09: 103-09
Signal classification3 categories
Disclosure
133.3%
General
133.3%
Patch
133.3%
Referenced assets3 URLs
Full discourse3 posts
  • Open Source Security mailing list@oss_security
    Patch

    Misskey/Sharkey "extremely severe" vulnerabilities https://www.openwall.com/lists/oss-security/2026/03/09/7 These ActivityPub-based social network services (similar to Mastodon) have released updates CVE-2026-28431: Information disclosure CVE-2026-28432: Authentication bypass CVE-2026-28433: Authorization bypass

    Post summary

    Advisory announces updates for Misskey/Sharkey covering CVE‑2026‑28431 (info disclosure), CVE‑2026‑28432 (authentication bypass), and CVE‑2026‑28433 (authorization bypass).

    00010719
    4.4K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-28433 CVE-2026-28431+more https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28433

    Post summary

    The message only lists CVE identifiers and provides a link to a vulnerability detail page, lacking further context such as PoC, exploit, or mitigation.

    0001043
    4.0K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-28433 Misskey is an open source, federated social media platform. All Misskey servers running versions 10.93.0 and later, but prior to 2026.3.1, contain a vulnerability tha… https://www.cve.org/CVERecord?id=CVE-2026-28433

    Post summary

    The text announces CVE-2026-28433 affecting specific Misskey versions, but provides no technical details, fix, or exploitation information.

    0000079
    56.6K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appmisskeymisskey---

Explore more

Back to dashboardmisskey CVEsmisskey vulnerabilities