Auth bypass in Misskey-dev Misskey

CVE-2026-46712

Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability where a lack of proper permission checks allows access to certain data points from the Direct Messages…

Vulnerability class: IDOR (Insecure Direct Object Reference)