CVE-2026-48115

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-48115

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48115.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-48115

Aliases

GHSA-j49q-76hx-mv8f

Published

2026-08-03T21:21:59.281Z

Modified

2026-08-07T11:51:16.700323449Z

Severity

6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Misskey: Improper Authorization in the Announcements API

Details

Misskey is an open source, federated social media platform. All Misskey servers running versions 2024.5.0 and later, but prior to 2026.5.4, contain a vulnerability in the Server Announcements API where insufficient permission checks allow attackers to access limited portions of data that they normally couldn't view. This vulnerability occurs whether or not federation is enabled. This issue has been fixed in version 2026.5.4.

Database specific

{
    "cwe_ids": [
        "CWE-285"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48115.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/misskey-dev/misskey

Affected ranges

Type

GIT

Repo

https://github.com/misskey-dev/misskey

Events

Introduced

6078081c336ab42535cbea173c728d2aef08d5d2

Fixed

4aa1d9ffc851a7824cb72b84ec01c3f65613463c

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2024.5.0"
        },
        {
            "fixed": "2026.5.4"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48115.json"