CVE-2025-66402

Katalog CVE

CVSS 6.5 · Medium EPSS 0,31%

Kerentanan Missing Authorization pada misskey. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Misskey is an open source, federated social media platform. Starting in version 13.0.0-beta.16 and prior to version 2025.12.0, an actor who does not have permission to view favorites or clips can can export the posts and view the contents. Version 2025.12.0 fixes the issue.

Rincian

Terbit di NVD

16 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/misskey-dev/misskey/security/advisories/GHSA-496g-mmpw-j9x3 exploit · advisory vendor
• https://github.com/misskey-dev/misskey/commit/dc77d59f8712d3fe0b73cd4af2035133839cd57b patch