CVE-2025-66402Published

Misskey is an open source, federated social media platform. Starting in version 13.0.0-beta.16 and prior to version 2025.12.0, an actor who does not have permission to view favorites or clips can can export the posts and view the contents. …

Exact source revision recorded 25 Oct 2026 03:17:36 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

nvd · CVE-2025-66402

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-862

Original publisher date fields

published: 2025-12-16T00:16:02.207

lastModified: 2026-10-14T13:10:00.187

37 source CPE criteria · context only

cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:-:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta16:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta21:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta22:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta23:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta24:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta25:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta26:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta27:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta28:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta29:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta30:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta31:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta32:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta33:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta34:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta35:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta36:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta37:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta38:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta39:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta40:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta41:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta42:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:beta43:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:rc10:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:rc11:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:rc3:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:rc4:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:rc5:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:rc6:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:rc7:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:rc8:*:*:*:*:*:*
cpe:2.3:a:misskey:misskey:13.0.0:rc9:*:*:*:*:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON