CVE-2026-46712

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46712", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-15T23:26:58.309Z", "datePublished": "2026-08-03T21:29:49.394Z", "dateUpdated": "2026-08-04T15:55:04.271Z"}, "containers": {"cna": {"title": "Misskey: Lack of proper permission checks in Direct Messaging feature", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-2m3r-xx7x-63j6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-2m3r-xx7x-63j6"}, {"name": "https://github.com/misskey-dev/misskey/releases/tag/2026.5.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/misskey-dev/misskey/releases/tag/2026.5.4"}], "affected": [{"vendor": "misskey-dev", "product": "misskey", "versions": [{"version": ">= 2025.3.2, < 2026.5.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-03T21:29:49.394Z"}, "descriptions": [{"lang": "en", "value": "Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability where a lack of proper permission checks allows access to certain data points from the Direct Messages (formerly Chat) feature, regardless of account permissions. This vulnerability occurs whether or not federation is enabled. Notes created with \"specified\" visibility (formerly \"direct\" visibility) are not affected. This issue has been fixed in version 2026.5.4."}], "source": {"advisory": "GHSA-2m3r-xx7x-63j6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-04T15:45:45.520135Z", "id": "CVE-2026-46712", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T15:55:04.271Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Misskey: Lack of proper permission checks in Direct Messaging feature", "source": {"advisory": "GHSA-2m3r-xx7x-63j6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "misskey-dev", "product": "misskey", "versions": [{"status": "affected", "version": ">= 2025.3.2, < 2026.5.4"}]}], "references": [{"url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-2m3r-xx7x-63j6", "name": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-2m3r-xx7x-63j6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/misskey-dev/misskey/releases/tag/2026.5.4", "name": "https://github.com/misskey-dev/misskey/releases/tag/2026.5.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability where a lack of proper permission checks allows access to certain data points from the Direct Messages (formerly Chat) feature, regardless of account permissions. This vulnerability occurs whether or not federation is enabled. Notes created with \"specified\" visibility (formerly \"direct\" visibility) are not affected. This issue has been fixed in version 2026.5.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-03T21:29:49.394Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46712", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-04T15:45:45.520135Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-08-04T15:54:56.769Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-46712", "state": "PUBLISHED", "dateUpdated": "2026-08-03T21:29:49.394Z", "dateReserved": "2026-05-15T23:26:58.309Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-03T21:29:49.394Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "misskey", "vendor": "misskey-dev", "versions": [{"status": "affected", "version": ">= 2025.3.2, < 2026.5.4"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability where a lack of proper permission checks allows access to certain data points from the Direct Messages (formerly Chat) feature, regardless of account permissions. This vulnerability occurs whether or not federation is enabled. Notes created with \"specified\" visibility (formerly \"direct\" visibility) are not affected. This issue has been fixed in version 2026.5.4."}, {"lang": "es", "value": "Misskey es una plataforma de redes sociales de c\u00f3digo abierto y federada. Las versiones 2025.3.2 y posteriores, pero anteriores a la 2026.5.4, contienen una vulnerabilidad donde una falta de comprobaciones de permisos adecuadas permite el acceso a ciertos puntos de datos de la funci\u00f3n de Mensajes Directos (anteriormente Chat), independientemente de los permisos de la cuenta. Esta vulnerabilidad ocurre ya sea que la federaci\u00f3n est\u00e9 habilitada o no. Las notas creadas con visibilidad \u2019especificada\u2019 (anteriormente visibilidad \u2019directa\u2019) no se ven afectadas. Este problema ha sido solucionado en la versi\u00f3n 2026.5.4."}], "id": "CVE-2026-46712", "lastModified": "2026-10-23T21:10:00.157", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46712", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-04T15:45:45.520135Z", "version": "2.0.3"}}]}, "published": "2026-08-03T22:16:48.863", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/misskey-dev/misskey/releases/tag/2026.5.4"}, {"source": "security-advisories@github.com", "url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-2m3r-xx7x-63j6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2025.3.2,2026.5.4)"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "misskey", "source": "cna", "vendor": "misskey-dev"}, "product": "misskey", "vendor": "misskey"}], "created": "2026-08-04T09:45:03.694513+00:00", "updated": "2026-08-05T09:45:06.869597+00:00", "vendors": ["misskey", "misskey$PRODUCT$misskey"]}