Skip to content
OpenAdvisories

Vendor

misskey-dev

38 known vulnerabilities.

Products

misskey 37 summaly 1
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 5.1
    CVE-2026-46714

    Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilation

    Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Misskey web client to slow down or crash when it applies a malformed theme. This issue has been fixed in …

    misskey-dev misskey
  • Medium 6.3
    CVE-2026-48115

    Misskey: Improper Authorization in the Announcements API

    Misskey is an open source, federated social media platform. All Misskey servers running versions 2024.5.0 and later, but prior to 2026.5.4, contain a vulnerability in the Server Announcements API where insufficient permission checks allow attackers to access …

    misskey-dev misskey
  • Medium 6.9
    CVE-2026-57575

    Misskey: SSRF bypass in URL Preview

    Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a Server-Side Request Forgery (SSRF) vulnerability in URL preview functionality in UrlPreviewService. Due to missing network restrictions before establishing outbo…

    misskey-dev misskey
  • Medium 6.9
    CVE-2025-66482

    Misskey has a login rate limit bypass via spoofed X-Forwarded-For header

    Misskey is an open source, federated social media platform. Attackers who use an untrusted reverse proxy or not using a reverse proxy at all can bypass IP rate limiting by adding a forged X-Forwarded-For header. Starting with version 2025.9.1, an option (`tru…

    misskey-dev misskey misskey-js npm
  • Medium 5.4
    CVE-2025-46559

    Misskey Directory Traversal Vulnerability in AiScript via `Mk:api`

    Misskey is an open source, federated social media platform. Starting in version 12.31.0 and prior to version 2025.4.1, missing validation in `Mk:api` allows malicious AiScript code to access additional endpoints that it isn't designed to have access to. The m…

    misskey-dev misskey
  • Medium 6.4
    CVE-2024-52579

    Server-Side Request Forgery vulnerability in various APIs in Misskey

    Misskey is an open source, federated social media platform. Some APIs using `HttpRequestService` do not properly check the target host. This vulnerability allows an attacker to send POST or GET requests to the internal server, which may result in a SSRF attac…

    misskey-dev misskey
  • Medium 6.9
    CVE-2024-52592

    Missing validation allows spoofed poll updates in Misskey

    Misskey is an open source, federated social media platform. In affected versions missing validation in `ApInboxService.update` allows an attacker to modify the result of polls belonging to another user. No authentication is required, except for a valid signat…

    misskey-dev misskey
  • Medium 5.1
    CVE-2024-52593

    Missing validation allows spoofed "origin" links in Misskey

    Misskey is an open source, federated social media platform.In affected versions missing validation in `NoteCreateService.insertNote`, `ApPersonService.createPerson`, and `ApPersonService.updatePerson` allows an attacker to control the target of any "origin" l…

    misskey-dev misskey