CVE-2025-66402 misskey.js's export data contains private post data

What is CVE-2025-66402?

CVE-2025-66402 is a high-severity missing authorization vulnerability in misskey-dev misskey, published on 15 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Misskey is an open source, federated social media platform. Starting in version 13.0.0-beta.16 and prior to version 2025.12.0, an actor who does not have permission to view favorites or clips can can export the posts and view the contents. Version 2025.12.0 fixes the issue.

Weakness: CWE-862

Which versions are affected by CVE-2025-66402?

2 open source packages ship an affected version, including misskey-js. It affects 1 product.

Products include Misskey Misskey.

How do I fix CVE-2025-66402?

Upgrade misskey-js to 2025.12.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-66402 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-66402 exists.

Other vulnerabilities in misskey-dev misskey

• CVE-2025-25306 Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes Critical 9.3
• CVE-2023-49079 Misskey's missing signature validation allows arbitrary users to impersonate any remote user. Critical 9.3
• CVE-2026-28431 Misskey lacks proper authorization checks and input validation Critical 9.2
• CVE-2023-52139 Misskey vulnerable to improper authorization when accessing with third-party application Critical 9.1
• CVE-2024-52590 Missing validation allows spoofed profiles in Misskey High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-496g-mmpw-j9x3.