Is there a patch available for CVE-2026-48115?

Yes, a patch is available for CVE-2026-48115. Update the affected software to the latest version immediately.

Misskey CVE-2026-48115

Q: What is the CVSS score of CVE-2026-48115?

CVE-2026-48115 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-52449 MEDIUM

Improper Authorization (CWE-285)

2026-08-03 GitHub_M

Authentication Bypass Misskey Misskey Dev

6.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.7 LOW

Network-reachable API with no auth required, but AT:P in vendor CVSS 4.0 maps to AC:H; only low confidentiality impact with no integrity or availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 03, 2026 - 22:17 EUVD

Source Code Evidence Fetched

Aug 03, 2026 - 22:07 vuln.today

Analysis Generated

Aug 03, 2026 - 22:07 vuln.today

DescriptionCVE.org

Misskey is an open source, federated social media platform. All Misskey servers running versions 2024.5.0 and later, but prior to 2026.5.4, contain a vulnerability in the Server Announcements API where insufficient permission checks allow attackers to access limited portions of data that they normally couldn't view. This vulnerability occurs whether or not federation is enabled. This issue has been fixed in version 2026.5.4.

AnalysisAI

Unauthorized data disclosure via the Server Announcements API in Misskey affects all instances running versions 2024.5.0 through 2026.5.3, allowing remote callers to read restricted announcement data without appropriate authorization. The flaw stems from CWE-285 (Improper Authorization) - the API endpoint fails to enforce privilege checks before returning data, making restricted content accessible to actors who should not see it. No public exploit code or CISA KEV listing exists at time of analysis, but the network-accessible, no-authentication-required vector makes this straightforwardly reachable on any exposed instance.

Technical ContextAI

Misskey is an open-source ActivityPub-based federated social media platform (cpe:2.3:a:misskey-dev:misskey). Its Server Announcements API is designed to surface administrative notices to users with appropriate access. The root cause, CWE-285 (Improper Authorization), indicates the endpoint does not correctly verify that the requesting party holds the privilege level required to view the requested data before returning it. Critically, the advisory confirms the vulnerability is present regardless of whether ActivityPub federation is enabled, meaning self-hosted, single-server, non-federated deployments are equally affected. The CVSS 4.0 AT:P metric indicates a specific attack prerequisite exists - though the advisory does not detail the exact condition - suggesting not every request will trivially succeed without some form of targeted crafting.

RemediationAI

Upgrade to Misskey version 2026.5.4, which contains the vendor-confirmed fix for CVE-2026-48115 as part of a bundled security release. The patched release is available at https://github.com/misskey-dev/misskey/releases/tag/2026.5.4. No official workaround is documented in the advisory data. If immediate upgrading is not feasible, operators may consider restricting network access to the Server Announcements API endpoint at the reverse-proxy or firewall layer; however, this trade-off will also prevent legitimate users from receiving announcements and should be treated as a temporary measure only. Refer to the vendor advisory GHSA-j49q-76hx-mv8f for authoritative guidance.