CVE Feed

    Dashboard / CVE / CVE-2026-94381

    CVE-2026-94381

    MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user’s normal account permissions. This means someone with a read-only API key could potentially gain write, delete, or even administrator access if their underlying account has those permissions. Exploiting the issue requires a valid read-only API key and a single request to the affected function. The main impact is that MISP’s API key restrictions can be bypassed, allowing actions that the API key was specifically meant to prevent. Version affected: <2.5.47

    Published:Sep 21, 2026
    Last Modified:Sep 21, 2026
    EPS:Sep 21, 2026
    EPSS Score:
    CVSS Score:8.7

    Affected Products

    Vendor
    Misp
    Product
    Misp

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-269 Improper Privilege Management

    Related CVEs

    CVE-2026-112192 (CVSS 5.3) — MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-suppl…
    CVE-2026-112188 (CVSS 7.1) — MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to ret…
    CVE-2026-112184 (CVSS 4.8) — MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter…
    CVE-2026-112183 (CVSS 4.8) — MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event…
    CVE-2026-112180 (CVSS 5.1) — MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associa…
    CVE-2026-112179 (CVSS 5.3) — In MISP, the event synchronization process contained a logic error in the preparation of event reports for rem…
    CVE-2026-112178 (CVSS 7.1) — MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization ch…
    CVE-2026-107278 (CVSS 5.3) — MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a d…
    CVE-2026-107276 (CVSS 6.3) — MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests c…
    CVE-2026-107180 (CVSS 7.1) — On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandato…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High