CVE-2026-28433: Misskey Information Disclosure Flaw

CVE-2026-28433 Overview

CVE-2026-28433 is an Insecure Direct Object Reference (IDOR) vulnerability affecting Misskey, an open source federated social media platform. The vulnerability exists due to a lack of ownership validation in the data import functionality, allowing authenticated users to potentially import other users' data by specifying arbitrary file IDs.

Critical Impact

Authenticated attackers who obtain valid file IDs can import data belonging to other users, potentially exposing private information or enabling data manipulation on affected Misskey instances.

Affected Products

• Misskey versions 10.93.0 through 2026.3.0
• All Misskey server instances running vulnerable versions
• Federated instances that have not updated to version 2026.3.1

Discovery Timeline

• 2026-03-10 - CVE CVE-2026-28433 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-28433

Vulnerability Analysis

This vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), which describes scenarios where an application uses user-supplied input to access data without properly verifying that the requesting user has authorization to access that resource.

In Misskey's data import functionality, the system accepts a file ID parameter but fails to validate whether the authenticated user actually owns the file associated with that ID. This allows an attacker with a valid account to potentially reference and import files belonging to other users on the same instance.

The practical exploitability is somewhat limited because attackers would need to know or guess valid file IDs belonging to target users. However, in federated environments where file IDs may follow predictable patterns or be exposed through other means, this could facilitate unauthorized data access.

Root Cause

The root cause of this vulnerability is missing authorization checks in the import functionality. When processing import requests, the application verifies that the user is authenticated but does not confirm ownership of the specified file resource. This is a classic IDOR pattern where object references (in this case, file IDs) are directly used without proper access control validation.

Attack Vector

The attack requires network access and low-privilege authentication on a vulnerable Misskey instance. An attacker would need to:

1. Create or have access to a valid account on the target Misskey server
2. Obtain or enumerate valid file IDs belonging to other users
3. Submit an import request specifying the target file ID

The vulnerability exploits the lack of ownership validation between the authenticated user and the referenced file object. While the attack complexity is elevated by the requirement to know valid file IDs, file IDs in some systems may be sequential or discoverable through other application features.

Detection Methods for CVE-2026-28433

Indicators of Compromise

• Unusual import activity from user accounts accessing file IDs they did not create
• Authentication logs showing import requests with file IDs belonging to different users
• Anomalous data import patterns where users import data inconsistent with their account history
• Server logs containing import requests with mismatched user/file ownership

Detection Strategies

• Implement logging that captures both the requesting user ID and the file ID for all import operations
• Create alerts for import requests where the file owner differs from the requesting user
• Monitor for users making multiple import requests with different file IDs in rapid succession
• Review access logs for patterns suggesting file ID enumeration attempts

Monitoring Recommendations

• Enable detailed audit logging for all data import and export operations
• Set up anomaly detection for import operations with high volumes of unique file IDs
• Monitor federation activity for suspicious data synchronization patterns
• Implement rate limiting on import endpoints to slow enumeration attempts

How to Mitigate CVE-2026-28433

Immediate Actions Required

• Upgrade all Misskey instances to version 2026.3.1 or later immediately
• Review import logs for any suspicious activity that may indicate prior exploitation
• Notify users if any unauthorized data imports are detected
• Temporarily disable the import functionality on vulnerable instances if immediate patching is not possible

Patch Information

The vulnerability is fixed in Misskey version 2026.3.1. Administrators should update their instances by pulling the latest release from the official Misskey repository. For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• Restrict access to import functionality through reverse proxy rules until patching is complete
• Implement additional authentication requirements for import operations at the network layer
• Monitor and audit all import requests manually until the patch can be applied
• Consider temporary service restrictions on untrusted user accounts

# Example: Block import endpoint via nginx until patched
# Add to your nginx server configuration
location ~ ^/api/i/import {
    # Temporarily deny all access to import endpoint
    deny all;
    return 503;
}