CVE-2025-66402
📋 TL;DR
This vulnerability in Misskey allows unauthorized users to export and view posts from favorites or clips they shouldn't have access to. It affects Misskey instances running versions from 13.0.0-beta.16 up to but not including 2025.12.0. This is an authorization bypass issue where export functionality doesn't properly check permissions.
💻 Affected Systems
- Misskey
📦 What is this software?
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
Misskey by Misskey
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized actors could export and view all private/sensitive posts from any user's favorites or clips, potentially exposing confidential information, private communications, or sensitive content.
Likely Case
Attackers with basic user accounts could access and export posts from other users' private favorites/clips, violating privacy expectations and potentially exposing sensitive content.
If Mitigated
With proper access controls and monitoring, impact is limited to unauthorized viewing of posts that should have been private, but no modification or deletion capabilities.
🎯 Exploit Status
Exploitation requires at least a basic user account but no special permissions. The vulnerability is straightforward to exploit once identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.12.0
Vendor Advisory: https://github.com/misskey-dev/misskey/security/advisories/GHSA-496g-mmpw-j9x3
Restart Required: Yes
Instructions:
1. Backup your Misskey instance. 2. Update Misskey to version 2025.12.0 or later using your preferred update method (git pull, package manager, or manual update). 3. Run database migrations if required. 4. Restart the Misskey service.
🔧 Temporary Workarounds
Disable Export Feature
allTemporarily disable the export functionality for favorites and clips until patching is possible.
# Modify Misskey configuration to disable export features
# Check Misskey documentation for specific configuration options
🧯 If You Can't Patch
- Implement strict access controls and monitoring for export-related API endpoints
- Consider temporarily disabling user access to export features through configuration or reverse proxy rules
🔍 How to Verify
Check if Vulnerable:
Check your Misskey version. If it's between 13.0.0-beta.16 and 2025.12.0 (exclusive), you are vulnerable.Check Version:
Check the Misskey admin panel or run: cat /path/to/misskey/package.json | grep versionVerify Fix Applied:
After updating, verify the version is 2025.12.0 or later and test that unauthorized users cannot export posts from others' favorites/clips.📡 Detection & Monitoring
Log Indicators:
- Unusual export activity from users without proper permissions
- Multiple export requests from single users
- Export requests for other users' content
Network Indicators:
- API calls to export endpoints without proper authorization headers
- Unusual patterns in /api/clips/export or /api/favorites/export requests
SIEM Query:
source="misskey" AND (uri_path="/api/clips/export" OR uri_path="/api/favorites/export") AND user_id!=requested_user_id