CVE-2025-25306: Critical Forged Notes in Misskey

CVE-2025-25306 is a critical (CVSS 9.3) flaw in Misskey, the open source federated social platform. An incomplete earlier patch let a remote caller forge ActivityPub objects by claiming authority in the url field. Misskey 2025.2.1 fixes it, so upgrade every instance to that release or later.

What's affected

• Product: Misskey, a federated social media platform that speaks ActivityPub.
• Affected: versions up to and including 2025.2.0, per the project's advisory GHSA-6w2c-vf6f-xf26.
• Fixed: 2025.2.1.
• Background: the issue is an incomplete patch for CVE-2024-52591. The earlier fix did not sufficiently check the relation between the id and url fields of ActivityPub objects.
• Vector: network reachable, no login, no user interaction. The scope is changed, with low confidentiality and high integrity impact.

How to check if you're exposed

Find your instance version first. It appears on the instance's about page and in the admin control panel. If you run it from a checkout or container, check that too.

# Git checkout
git describe --tags

# Docker or Compose
docker ps --format '{{.Names}} {{.Image}}' | grep -i misskey

Anything at 2025.2.0 or earlier is in range. If you run a fork or a managed hosting offer, ask the maintainer which upstream release it tracks. Then review what your instance accepted from federation. Look for notes that appear to come from users on other servers but that those users say they did not write, and for odd activity from remote actors tied to the date range before you upgraded.

What to do now

1. Upgrade the instance to 2025.2.1 or later and restart all services, including workers.
2. Run the database migrations the release notes call for, following the upgrade guide.
3. Review recent federated content for notes attributed to remote users that look wrong, and remove forged ones.
4. If you moderate an instance, tell your users and have a way for them to report content they did not write.
5. Subscribe to the project's security advisories so the next fix reaches you quickly.
6. If you run a fork, port the fix from the upstream release rather than waiting.

Why it matters

Federated platforms keep a delicate rule: the server that hosts an object has authority over it. When Misskey receives an ActivityPub object, it has to decide who is allowed to speak for it. The advisory says the first fix for CVE-2024-52591 did not fully validate how the id and url fields relate, so a caller could claim authority through the url field even for types that need authority in the id field.

• CWE-1025 is comparison using wrong factors. Two values are compared on the wrong fields, so a check passes when it should fail.
• CWE-346 is an origin validation error. The software does not properly verify that data comes from the source it claims.
• CWE-441 is unintended proxy or intermediary, often called the confused deputy problem. A trusted component acts on a request without preserving who the request really came from.

The result is forged content that appears to come from another user or server. The integrity impact is high even though nothing else breaks, because trust in who said what is the whole point of a social network. For moderators it also becomes a reputation and abuse issue. The broader lesson is about incomplete fixes. When a vulnerability class is patched with a narrow check, test the family of inputs around it, not just the exact case from the report.

Try it yourself

Not every advisory in your inventory matters equally. This demo shows how reachability analysis helps sort the ones that do.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Misskey advisory GHSA-6w2c-vf6f-xf26
• Misskey 2025.2.1 release

Last reviewed: 19 October 2026.