CVE-2026-46712 misskey-dev CVE debrief

Who should care

Defenders responsible for Misskey instances, especially those using versions between 2025.3.2 and 2026.5.4, should assess exposure and verify data access controls. They should also prioritize updating to version 2026.5.4 or later if affected.

Why it matters

CVE-2026-46712 is a low-severity vulnerability in Misskey that allows unauthorized access to certain Direct Messages data points. Defenders should prioritize verifying their instance versions, reviewing data access controls, and updating to the fixed version to prevent potential data breaches.

• Defenders need to verify Misskey instance versions to determine exposure
• Reviewing Direct Messages data access controls is necessary to prevent unauthorized access
• Defenders should check for potential data breaches due to this vulnerability
• Updating to version 2026.5.4 or later is necessary to fix the vulnerability

Technical summary

The vulnerability occurs due to a lack of proper permission checks in Misskey versions 2025.3.2 and later, but prior to 2026.5.4. This allows access to certain data points from the Direct Messages feature, regardless of account permissions or federation status. The issue does not affect notes created with 'specified' visibility. Defenders should prioritize verifying their Misskey instance versions and assessing exposure, especially if using versions between 2025.3.2 and 2026.5.4. They should also review Direct Messages data access controls and verify that no unauthorized access has occurred.

Defensive priority

Defenders should prioritize verifying their Misskey instance versions and assessing exposure, especially if using versions between 2025.3.2 and 2026.5.4. They should also review Direct Messages data access controls and verify that no unauthorized access has occurred.

Recommended defensive actions

• Verify Misskey instance version and assess exposure
• Review Direct Messages data access controls
• Verify that no unauthorized access has occurred
• Update to version 2026.5.4 or later if affected
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, its impact, and the fixed version. However, there is limited information about potential exploitation or victim impact. To verify, defenders should review the official CVE Program record and NIST NVD detail page. They should also check for any additional information from the vendor or other reliable sources. The vulnerability affects Misskey versions 2025.3.2 and later, but prior to 2026.5.4.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.