6.5

CVE-2025-66402

Exploit

misskey.js's export data contains private post data

Misskey is an open source, federated social media platform. Starting in version 13.0.0-beta.16 and prior to version 2025.12.0, an actor who does not have permission to view favorites or clips can can export the posts and view the contents. Version 2025.12.0 fixes the issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Misskey ≫ Misskey Version >= 13.1.0 < 2025.12.0
Misskey ≫ Misskey Version 13.0.0 Update -
Misskey ≫ Misskey Version 13.0.0 Update beta16
Misskey ≫ Misskey Version 13.0.0 Update beta21
Misskey ≫ Misskey Version 13.0.0 Update beta22
Misskey ≫ Misskey Version 13.0.0 Update beta23
Misskey ≫ Misskey Version 13.0.0 Update beta24
Misskey ≫ Misskey Version 13.0.0 Update beta25
Misskey ≫ Misskey Version 13.0.0 Update beta26
Misskey ≫ Misskey Version 13.0.0 Update beta27
Misskey ≫ Misskey Version 13.0.0 Update beta28
Misskey ≫ Misskey Version 13.0.0 Update beta29
Misskey ≫ Misskey Version 13.0.0 Update beta30
Misskey ≫ Misskey Version 13.0.0 Update beta31
Misskey ≫ Misskey Version 13.0.0 Update beta32
Misskey ≫ Misskey Version 13.0.0 Update beta33
Misskey ≫ Misskey Version 13.0.0 Update beta34
Misskey ≫ Misskey Version 13.0.0 Update beta35
Misskey ≫ Misskey Version 13.0.0 Update beta36
Misskey ≫ Misskey Version 13.0.0 Update beta37
Misskey ≫ Misskey Version 13.0.0 Update beta38
Misskey ≫ Misskey Version 13.0.0 Update beta39
Misskey ≫ Misskey Version 13.0.0 Update beta40
Misskey ≫ Misskey Version 13.0.0 Update beta41
Misskey ≫ Misskey Version 13.0.0 Update beta42
Misskey ≫ Misskey Version 13.0.0 Update beta43
Misskey ≫ Misskey Version 13.0.0 Update rc1
Misskey ≫ Misskey Version 13.0.0 Update rc10
Misskey ≫ Misskey Version 13.0.0 Update rc11
Misskey ≫ Misskey Version 13.0.0 Update rc2
Misskey ≫ Misskey Version 13.0.0 Update rc3
Misskey ≫ Misskey Version 13.0.0 Update rc4
Misskey ≫ Misskey Version 13.0.0 Update rc5
Misskey ≫ Misskey Version 13.0.0 Update rc6
Misskey ≫ Misskey Version 13.0.0 Update rc7
Misskey ≫ Misskey Version 13.0.0 Update rc8
Misskey ≫ Misskey Version 13.0.0 Update rc9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.31% 0.231
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
security-advisories@github.com 7.1 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://github.com/misskey-dev/misskey/security/advisories/GHSA-496g-mmpw-j9x3
Vendor Advisory
Exploit
https://github.com/misskey-dev/misskey/commit/dc77d59f8712d3fe0b73cd4af2035133839cd57b
Patch