CVE Feed

    Dashboard / CVE / CVE-2026-90955

    CVE-2026-90955

    Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user. Version affected: ≤2.5.45

    Published:Sep 14, 2026
    Last Modified:Sep 14, 2026
    EPS:Sep 14, 2026
    EPSS Score:
    CVSS Score:4.6

    Affected Products

    Vendor
    Misp
    Product
    Misp

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-112192 (CVSS 5.3) — MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-suppl…
    CVE-2026-112188 (CVSS 7.1) — MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to ret…
    CVE-2026-112184 (CVSS 4.8) — MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter…
    CVE-2026-112183 (CVSS 4.8) — MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event…
    CVE-2026-112180 (CVSS 5.1) — MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associa…
    CVE-2026-112179 (CVSS 5.3) — In MISP, the event synchronization process contained a logic error in the preparation of event reports for rem…
    CVE-2026-112178 (CVSS 7.1) — MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization ch…
    CVE-2026-107278 (CVSS 5.3) — MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a d…
    CVE-2026-107276 (CVSS 6.3) — MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests c…
    CVE-2026-107180 (CVSS 7.1) — On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandato…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High