CVE-2026-28433 Details

A vulnerability exists in Misskey, an open-source federated social media platform, in all servers running versions 10.93.0 and later, but prior to 2026.3.1. This vulnerability allows the import of other users' data without proper ownership validation. While the impact is considered relatively low, as malicious actors would need to know the ID of the target file to import it, the issue still poses a risk to user privacy.

Users can update to Misskey version 2026.3.1 or later, where this vulnerability has been fixed. For those using Misskey version 2024.9.0 or later, the importing function can be disabled via role policy as a temporary workaround.