CVE-2025-66402: 
JavaScript vulnerability analysis and mitigation

CVE-2025-66402 is a missing authorization vulnerability in Misskey, an open-source federated microblogging platform, that allows authenticated users to view the contents of private posts they do not have permission to access. The flaw affects Misskey versions from 13.0.0-beta.16 through 2025.11.x (all versions before 2025.12.0). It was disclosed on December 13, 2025 by researcher na2204 and published to the GitHub Advisory Database on December 15, 2025. The vulnerability carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High) (Github Advisory, Misskey Advisory).

The root cause is CWE-862 (Missing Authorization): the export functionality for favorites and clips (ExportFavoritesProcessorService and ExportClipsProcessorService) did not apply visibility checks before including notes in the exported data. An authenticated attacker could add private posts (visibility set to "followers" or "direct/nominate") to their favorites or clips by querying the post URL directly, then trigger an export to receive the full content of those restricted posts. The fix introduced QueryService.generateVisibilityQuery() calls and a new shouldHideNoteByTime() helper to enforce proper authorization during export processing (Misskey Advisory, Patch Commit). The attack requires only a low-privilege account on the same Misskey server instance and no user interaction from the victim.

Successful exploitation allows an authenticated attacker to read the full contents of private posts (follower-only or direct/nominated posts) that they are not authorized to view, resulting in a high confidentiality impact with no integrity or availability impact. The risk is amplified when target users have pinned private posts, as the post IDs are exposed on the user's public profile page, making it straightforward to identify and target specific private content. There is no evidence of lateral movement or system-level compromise; the impact is limited to unauthorized disclosure of private social media content (Misskey Advisory).

A proof-of-concept (PoC) is publicly documented in the official security advisory, providing a step-by-step reproduction procedure verified against v2025.11.1 (Misskey Advisory). There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.047% (15th percentile), indicating a low probability of near-term exploitation. No threat actor attribution has been reported.

1. Account Setup: Create or use an existing low-privilege account (X) on the target Misskey server instance.
2. Identify Private Post IDs: Browse the profile page of a target user (Y) on the original server. If Y has pinned private posts, their post IDs are visible in the page source or API response, even without access to the content.
3. Construct Post URLs: Build the direct URLs to the private posts using the obtained post IDs (e.g., https://<server>/@<user>/<note-id>).
4. Add to Favorites or Clips: Using account X, query the private post URLs via the Misskey API or UI. Add the private posts to X's favorites or clips — the platform does not enforce visibility checks at this step.
5. Trigger Export: From account X, initiate an export of favorites or clips via the Misskey account settings export feature.
6. Extract Private Content: Download and inspect the exported data file. The full content of the private posts (followers-only or direct) will be included in the export without redaction (Misskey Advisory).

• Logs: Server-side logs showing a user querying note URLs belonging to other users with restricted visibility (followers/direct), followed shortly by an export job (ExportFavoritesProcessorService or ExportClipsProcessorService) triggered by the same user.
• Application Behavior: Unusual pattern of a user adding notes from accounts they do not follow to their favorites or clips, particularly notes with follower-only or direct visibility.
• Export Activity: Repeated or bulk export requests from accounts that have recently favorited or clipped posts from users they are not following.
• API Access: API calls to note lookup endpoints for posts not visible to the requesting user, especially if followed by export API calls (Misskey Advisory).

Upgrade all Misskey installations to version 2025.12.0 or later, which introduces proper visibility authorization checks in the export processing pipeline (Misskey Advisory, Patch Commit). All versions from 13.0.0-beta.16 through 2025.11.x are affected and require patching. For instances unable to patch immediately, consider disabling the favorites/clips export feature or restricting user account registration to limit the attacker pool, and review export logs for signs of abuse.