CVE-2026-48115: Misskey Information Disclosure Flaw

CVE-2026-48115 Overview

CVE-2026-48115 is an improper authorization vulnerability [CWE-285] in Misskey, an open source federated social media platform. The flaw resides in the Server Announcements API, where insufficient permission checks allow unauthenticated attackers to access limited portions of data that should be restricted. The issue affects all Misskey servers running versions 2024.5.0 through versions prior to 2026.5.4, regardless of whether federation is enabled. The Misskey maintainers addressed the flaw in version 2026.5.4.

Critical Impact
Attackers can retrieve restricted announcement data through the API over the network without authentication or user interaction, exposing information not intended for public visibility.

Affected Products

Misskey versions 2024.5.0 and later
Misskey versions prior to 2026.5.4
All Misskey deployments, whether federated or standalone

Discovery Timeline

2026-08-03 - CVE-2026-48115 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-48115

Vulnerability Analysis

The vulnerability affects the Server Announcements API endpoint in Misskey. Server announcements can be scoped to specific audiences, such as authenticated users or particular roles. The API responsible for returning announcement data does not fully enforce these scoping rules before returning results.

As a result, an attacker sending crafted requests to the Announcements API can retrieve portions of announcement content that should be restricted. The exposure is limited to data reachable through this endpoint, but it defeats the visibility controls administrators configure on announcements.

The issue is present regardless of the federation setting, meaning both isolated single-instance deployments and federated servers in the wider Fediverse are affected. See the GitHub Security Advisory GHSA-j49q-76hx-mv8f for the maintainer's technical description.

Root Cause

The root cause is missing or incomplete authorization checks in the Server Announcements API handler. The endpoint evaluates the request without verifying that the caller has the required permissions to view every announcement returned in the response. This is a classic instance of [CWE-285: Improper Authorization].

Attack Vector

Exploitation requires only network access to a vulnerable Misskey instance. An attacker issues HTTP requests to the Announcements API and receives announcement data that would normally be gated by role or authentication state. No user interaction is required, and the attacker does not need valid credentials on the target instance.

No verified proof-of-concept code is publicly available. Refer to the Misskey 2026.5.4 release notes for the corresponding fix.

Detection Methods for CVE-2026-48115

Indicators of Compromise

Unusual volumes of unauthenticated requests to the Server Announcements API endpoint from a single client or IP range.
Access log entries showing announcement API queries from clients that never authenticate against the instance.
Requests to announcement endpoints originating from automated user agents or scanning tools rather than standard Misskey clients.

Detection Strategies

Review Misskey application and reverse-proxy logs for repeated queries targeting the announcements API path.
Correlate announcement API access patterns with authentication events to identify callers that read announcements without a valid session.
Compare the running Misskey version against 2026.5.4 to confirm whether an instance remains vulnerable.

Monitoring Recommendations

Forward Misskey web server and application logs to a centralized logging or SIEM platform for retention and query.
Alert on spikes in traffic to announcement endpoints, particularly from unauthenticated sources.
Track the deployed Misskey version in your asset inventory so future advisories can be triaged quickly.

How to Mitigate CVE-2026-48115

Immediate Actions Required

Upgrade all Misskey instances to version 2026.5.4 or later without delay.
Audit announcement content on affected instances and remove any sensitive material that may have been exposed during the vulnerable window.
Review recent web server access logs for suspicious queries against the Server Announcements API.

Patch Information

The Misskey project fixed CVE-2026-48115 in version 2026.5.4. Administrators should upgrade using the standard release procedure documented in the Misskey 2026.5.4 release. Details of the fix are described in the GitHub Security Advisory GHSA-j49q-76hx-mv8f.

Workarounds

No official workaround is published; upgrading to 2026.5.4 is the supported remediation.
As a temporary risk-reduction measure, avoid publishing sensitive information in scoped server announcements until the upgrade is complete.
Restrict network access to the Misskey instance via upstream firewall or reverse-proxy access controls where feasible.

bash

# Example: verify the installed Misskey version before and after upgrade
cat package.json | grep '"version"'
# Expected after remediation: "version": "2026.5.4"