Misskey version 10.93.0 through 2026.3.0 lacks validation that an importing user owns the target data file. As a result, a user who knows the identifier of another user's data can submit an import request and the system will perform the import without checking ownership. The flaw is identified as CWE-639 and CWE-862. The vulnerability could enable the illicit import of personal data, but the need to know a specific file ID limits the potential impact, which is reflected in the CVSS score of 2.3.

All instances of the Misskey platform deployed by the misskey-dev organization are affected. Specifically, any copy of Misskey running a release between 10.93.0 inclusive and 2026.3.0 inclusive is vulnerable. Versions 2026.3.1 and later contain the fix that enforces ownership checks during imports.

The probability of exploitation is considered low, with an EPSS score of less than 1% and no presence in the CISA KEV catalog. Exploitation requires prior knowledge of a valid data file identifier. When that condition is satisfied, the import operation succeeds, allowing the attacker to access or clone another user's data on the server.