Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-28433 is a vulnerability in Misskey servers running versions 10.93.0 and later, but prior to 2026.3.1. It arises from a lack of ownership validation when importing data, allowing an attacker to import other users' data by exploiting insufficient authorization checks related to file IDs."}, {'type': 'paragraph', 'content': 'Specifically, the system does not properly verify whether the user owns the resource identified by the file ID, enabling unauthorized data importation. This is classified as an authorization bypass vulnerability.'}, {'type': 'paragraph', 'content': 'The vulnerability is considered low severity because exploitation requires knowledge of the target file ID, and the impact on confidentiality is limited.'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with limited privileges to import data belonging to other users without proper authorization.

The impact is relatively low since the attacker needs to know the specific file ID to exploit the vulnerability, and the unauthorized data disclosure is limited.

There is no impact on data integrity or availability, and no user interaction is required for exploitation.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, users are strongly advised to update Misskey servers to version 2026.3.1 or later, where the issue is fixed.

As a workaround for users on Misskey version 2024.9.0 or later, it is possible to disable the importing function via role policy settings to reduce risk.

Useful 0 Not Useful 0