---
id: CVE-2025-66402
title: 'Misskey is an open source, federated social media platform'
summary: >-
  Misskey is an open source, federated social media platform. Starting in
  version 13.0.0-beta.16 and prior to version 2025.12.0, an actor who does not
  have permission to view favorites or clips can can export the posts and view
  the content…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-862
vendor: misskey
product: misskey
affected:
  - 'misskey >= 13.1.0, < 2025.12.0'
  - misskey = 13.0.0
patched:
  - misskey 2025.12.0
published: '2025-12-16'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-66402'
references:
  - url: >-
      https://github.com/misskey-dev/misskey/commit/dc77d59f8712d3fe0b73cd4af2035133839cd57b
    label: security-advisories@github.com
  - url: >-
      https://github.com/misskey-dev/misskey/security/advisories/GHSA-496g-mmpw-j9x3
    label: security-advisories@github.com
  - url: >-
      https://github.com/misskey-dev/misskey/security/advisories/GHSA-496g-mmpw-j9x3
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00314
epssPercentile: 0.22529
ingestedAt: '2026-10-14T13:30:58.434Z'
---

## Overview

Misskey is an open source, federated social media platform. Starting in version 13.0.0-beta.16 and prior to version 2025.12.0, an actor who does not have permission to view favorites or clips can can export the posts and view the contents. Version 2025.12.0 fixes the issue.

## Affected

- `misskey >= 13.1.0, < 2025.12.0`
- `misskey = 13.0.0`

## Remediation

Upgrade past the affected range:

- `misskey 2025.12.0`