CVE-2026-48115
Received Received - Intake

Insufficient Permission Check in Misskey Server Announcements API

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: GitHub, Inc.

Description
Misskey is an open source, federated social media platform. All Misskey servers running versions 2024.5.0 and later, but prior to 2026.5.4, contain a vulnerability in the Server Announcements API where insufficient permission checks allow attackers to access limited portions of data that they normally couldn't view. This vulnerability occurs whether or not federation is enabled. This issue has been fixed in version 2026.5.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-48115

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misskey misskey From 2024.5.0 (inc) to 2026.5.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Misskey versions 2024.5.0 to 2026.5.3 have a flaw in the Server Announcements API where insufficient permission checks let attackers access some data they normally couldn't view. This issue affects all servers regardless of federation settings and was fixed in version 2026.5.4.

Detection Guidance

Detecting this vulnerability requires checking if your Misskey server version is between 2024.5.0 and 2026.5.3. Run the command: node -e "console.log(require('./package.json').version)" in your Misskey installation directory to check the version.

Impact Analysis

Attackers could view limited data they are not authorized to access, potentially exposing sensitive information or internal server details. The impact depends on the server's configuration and the data it handles.

Mitigation Strategies

Upgrade your Misskey server to version 2026.5.4 or later immediately. This version contains the fix for the insufficient permission checks in the Server Announcements API.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48115. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart