CVE-2025-66402 json
misskey.js's export data contains private post data
published 2025-12-15 10 mo ago modified 2026-10-14 26 d ago also EUVD-2025-203442 , GHSA-496g-mmpw-j9x3
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
Misskey is an open source, federated social media platform. Starting in version 13.0.0-beta.16 and prior to version 2025.12.0, an actor who does not have permission to view favorites or clips can can export the posts and view the contents. Version 2025.12.0 fixes the issue.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10 mo ago
Exploit prediction
0.31% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/misskey-dev/misskey/security/advisories/GHSA-496g-mmpw-j9x3 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | misskey-js | >=13.0.0-beta.16, <2025.12.0 |
2025.12.0 |
Affected products
- misskey-dev misskey
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/misskey-dev/misskey/commit/dc77d59f8712d3fe0b73cd4af2035133839cd57b
web, patch
-
github.com
/misskey-dev/misskey/security/advisories/GHSA-496g-mmpw-j9x3
exploit, web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-66402
advisory
-
github.com
/misskey-dev/misskey
package
Sources
- CVE List CVE-2025-66402
- GitHub Advisory GHSA-496g-mmpw-j9x3
- NVD CVE-2025-66402
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.