Is there a patch available for CVE-2026-46712?

Yes, a patch is available for CVE-2026-46712. Update the affected software to the latest version immediately.

Misskey CVE-2026-46712

Q: What is the CVSS score of CVE-2026-46712?

CVE-2026-46712 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-52451 LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-03 GitHub_M

Authentication Bypass Misskey Misskey Dev

2.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.1 LOW

Network-accessible requiring authenticated low-privilege account; AC:H reflects AT:P condition (specific DM object identifiers needed); confidentiality-only limited impact, no scope change.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 03, 2026 - 22:17 EUVD

Source Code Evidence Fetched

Aug 03, 2026 - 22:08 vuln.today

Analysis Generated

Aug 03, 2026 - 22:08 vuln.today

DescriptionCVE.org

Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability where a lack of proper permission checks allows access to certain data points from the Direct Messages (formerly Chat) feature, regardless of account permissions. This vulnerability occurs whether or not federation is enabled. Notes created with "specified" visibility (formerly "direct" visibility) are not affected. This issue has been fixed in version 2026.5.4.

AnalysisAI

Insufficient permission checks in Misskey's Direct Messages (Chat) feature expose DM data points to authenticated users who lack authorization to access them, across versions 2025.3.2 through 2026.5.3. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), where the server fails to validate account permissions before returning DM-related data via API. No public exploit or CISA KEV listing exists; the vendor patched this in version 2026.5.4 alongside four additional CVEs.

Technical ContextAI

Misskey is an open-source, ActivityPub-compatible federated social media platform (CPE: cpe:2.3:a:misskey-dev:misskey:*). The vulnerability is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), a class of flaw where the application uses a user-controlled value - such as a message or thread object identifier - to gate resource access without performing adequate server-side permission enforcement. The Direct Messages (formerly Chat) subsystem maintains its own permission model distinct from Misskey's general note visibility system. Notably, notes created with 'specified' (formerly 'direct') visibility are handled through a separate code path and are explicitly not affected, indicating the bypass is isolated to DM/Chat API endpoints. The vulnerability manifests regardless of whether ActivityPub federation is enabled, suggesting it is an internal authorization defect rather than a federation-boundary issue.

RemediationAI

Upgrade to Misskey version 2026.5.4, the vendor-confirmed patched release (https://github.com/misskey-dev/misskey/releases/tag/2026.5.4). This release also resolves four additional CVEs (CVE-2026-46713, CVE-2026-47746, CVE-2026-46714, CVE-2026-48115), providing additional security motivation for the upgrade. If an immediate upgrade is not feasible, consider restricting access to the DM/Chat API endpoints at the reverse-proxy or firewall layer to reduce the attack surface - this trade-off would degrade DM functionality for legitimate users. Audit application-level access logs for anomalous cross-account DM API calls as a detection measure. No configuration-only workaround fully mitigates the permission bypass without applying the patch.