CVE-2026-28433

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28433", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-27T15:54:05.138Z", "datePublished": "2026-03-09T21:21:06.403Z", "dateUpdated": "2026-03-10T14:44:15.691Z"}, "containers": {"cna": {"title": "Misskey lacks resource ownership validation", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-g6hj-33h7-6fq8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-g6hj-33h7-6fq8"}], "affected": [{"vendor": "misskey-dev", "product": "misskey", "versions": [{"version": ">= 10.93.0, < 2026.3.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-09T21:21:06.403Z"}, "descriptions": [{"lang": "en", "value": "Misskey is an open source, federated social media platform. All Misskey servers running versions 10.93.0 and later, but prior to 2026.3.1, contain a vulnerability that allows importing other users' data due to lack of ownership validation. The impact of this vulnerability is estimated to be relatively low, as bad actors would require the ID corresponding to the target file for import. This vulnerability is fixed in 2026.3.1."}], "source": {"advisory": "GHSA-g6hj-33h7-6fq8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T14:43:55.587966Z", "id": "CVE-2026-28433", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T14:44:15.691Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28433", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T14:43:55.587966Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T14:44:04.804Z"}}], "cna": {"title": "Misskey lacks resource ownership validation", "source": {"advisory": "GHSA-g6hj-33h7-6fq8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "misskey-dev", "product": "misskey", "versions": [{"status": "affected", "version": ">= 10.93.0, < 2026.3.1"}]}], "references": [{"url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-g6hj-33h7-6fq8", "name": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-g6hj-33h7-6fq8", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Misskey is an open source, federated social media platform. All Misskey servers running versions 10.93.0 and later, but prior to 2026.3.1, contain a vulnerability that allows importing other users' data due to lack of ownership validation. The impact of this vulnerability is estimated to be relatively low, as bad actors would require the ID corresponding to the target file for import. This vulnerability is fixed in 2026.3.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-09T21:21:06.403Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28433", "state": "PUBLISHED", "dateUpdated": "2026-03-10T14:44:15.691Z", "dateReserved": "2026-02-27T15:54:05.138Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-09T21:21:06.403Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "misskey", "vendor": "misskey-dev", "versions": [{"status": "affected", "version": ">= 10.93.0, < 2026.3.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:*", "matchCriteriaId": "E7CA53B2-DB4E-4FA7-B3F9-89E6C040CADA", "versionEndExcluding": "2026.3.1", "versionStartIncluding": "10.93.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Misskey is an open source, federated social media platform. All Misskey servers running versions 10.93.0 and later, but prior to 2026.3.1, contain a vulnerability that allows importing other users' data due to lack of ownership validation. The impact of this vulnerability is estimated to be relatively low, as bad actors would require the ID corresponding to the target file for import. This vulnerability is fixed in 2026.3.1."}, {"lang": "es", "value": "Misskey es una plataforma de redes sociales de c\u00f3digo abierto y federada. Todos los servidores Misskey que ejecutan versiones 10.93.0 y posteriores, pero anteriores a la 2026.3.1, contienen una vulnerabilidad que permite importar datos de otros usuarios debido a la falta de validaci\u00f3n de propiedad. El impacto de esta vulnerabilidad se estima que es relativamente bajo, ya que los actores maliciosos requerir\u00edan el ID correspondiente al archivo objetivo para la importaci\u00f3n. Esta vulnerabilidad se corrige en la 2026.3.1."}], "id": "CVE-2026-28433", "lastModified": "2026-06-17T10:28:38.233", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28433", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T14:43:55.587966Z", "version": "2.0.3"}}]}, "published": "2026-03-10T07:43:35.907", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-g6hj-33h7-6fq8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.93.0,2026.3.1)"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "misskey", "source": "cna", "vendor": "misskey-dev"}, "product": "misskey", "vendor": "misskey"}], "analysis": {"en": {"generated_at": "2026-04-17T11:51:24.241207+00:00", "value": {"mitigation_remediation": ["Upgrade to Misskey 2026.3.1 or later, which implements ownership validation during data imports.", "If an upgrade cannot be performed immediately, disable the public import endpoint or restrict it to trusted administrators only to eliminate the attack surface.", "Monitor import logs for any anomalous activity and remove any data that may have been imported without proper authorization."], "summary": {"action": "Patch", "impact": "Unauthorized Data Import"}, "threat_synthesis": {"affected_systems": "All instances of the Misskey platform deployed by the misskey-dev organization are affected. Specifically, any copy of Misskey running a release between 10.93.0 inclusive and 2026.3.0 inclusive is vulnerable. Versions 2026.3.1 and later contain the fix that enforces ownership checks during imports.", "description_and_impact": "Misskey version 10.93.0 through 2026.3.0 lacks validation that an importing user owns the target data file. As a result, a user who knows the identifier of another user's data can submit an import request and the system will perform the import without checking ownership. The flaw is identified as CWE-639 and CWE-862. The vulnerability could enable the illicit import of personal data, but the need to know a specific file ID limits the potential impact, which is reflected in the CVSS score of 2.3.", "risk_and_exploitability": "The probability of exploitation is considered low, with an EPSS score of less than 1% and no presence in the CISA KEV catalog. Exploitation requires prior knowledge of a valid data file identifier. When that condition is satisfied, the import operation succeeds, allowing the attacker to access or clone another user's data on the server."}}}}, "created": "2026-03-10T14:06:56.099117+00:00", "updated": "2026-04-17T12:00:11.756342+00:00", "vendors": ["misskey", "misskey$PRODUCT$misskey"]}