A time-of-check to time-of-use race condition in Misskey could allow unauthenticated attackers to perform unauthorized data modifications.

This vulnerability is a CWE-367 (TOCTOU Race Condition). It is remotely exploitable by unauthenticated users and specifically impacts data integrity within the platform.

The ability for an unauthenticated user to exploit a race condition to modify data undermines the integrity of the platform. With a CVSS score of 8.9, this vulnerability carries a high risk of unauthorized actions, which could lead to significant reputational damage and data inconsistencies for federated instances.

Immediate Action: Update all Misskey instances to version 2026.5.4 or later to address the race condition.

Proactive Monitoring: Audit application logs for unusual request patterns that might indicate an attempt to trigger race conditions during data processing.

Compensating Controls: While difficult to mitigate via WAF, ensuring that the platform is deployed in a secure environment with standard hardening practices is recommended.

Public Exploit Available: No

All operators of Misskey instances must update to the latest patched version immediately. This vulnerability poses a severe risk to data integrity, and prompt action is required to ensure the platform remains secure against manipulation.