CVE-2026-90955 in MISP
Summary
by MITRE • 09/14/2026
Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging.
The shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user.
Version affected: ≤2.5.45
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified in versions of MISP up to 2.5.45 represents a significant integrity failure within the interactive command-line interface shell regarding audit trail accuracy and identity preservation. This flaw stems from an improper implementation of the SysLogLogable behavior, which is responsible for capturing and storing logs of user actions for forensic analysis and compliance purposes. The core technical issue lies in how the application manages state during impersonation scenarios where a system administrator or automated process executes commands on behalf of another specific MISP user. Instead of persisting the intended user identity through stable storage mechanisms such as database fields or session variables, the legacy implementation relied on behavior-instance state within the object model itself. This approach is inherently fragile because it depends on the immediate lifecycle and isolation of a single code instance rather than persistent application context.
The operational mechanism of this flaw involves a race condition-like scenario triggered by lazy loading in the underlying framework. When another model lazily attaches to the shared SysLogLogable behavior, it overwrites the previously stored identity state associated with the impersonated user. Consequently, any subsequent CLI commands executed during that session are logged under the wrong user account or potentially as an anonymous action rather than the intended target of the impersonation. This results in a complete decoupling between the actual actor performing the actions and the recorded audit log entries. The discrepancy is not merely cosmetic; it fundamentally undermines the reliability of the audit trail, which serves as the primary source of truth for tracking who performed what actions within the threat intelligence platform.
From an industry standard perspective, this vulnerability maps directly to CWE-754: Improper Check for Unusual or Exceptional Conditions and CWE-201: Information Exposure Through Audit Logs. The failure to correctly attribute actions violates the fundamental security principle of non-repudiation, as it becomes impossible to definitively prove which user account was responsible for specific modifications or queries. Furthermore, this aligns with MITRE ATT&CK technique T1078.004: Valid Accounts - Local Account if an attacker were able to exploit similar state manipulation in other contexts, although here the impact is primarily on internal accountability rather than direct privilege escalation. The lack of a CLI marker further exacerbates the issue by making it difficult for security analysts to distinguish between automated script activity and manual web interface interactions based solely on log structure, reducing the contextual value of the logs during incident response investigations.
The operational impact of this vulnerability is severe in environments where MISP is used for high-stakes threat intelligence sharing or compliance-driven data handling. Security teams rely on accurate audit logs to detect insider threats, investigate unauthorized access, and maintain regulatory compliance with standards such as GDPR, HIPAA, or SOC2. If the identity of the user performing actions cannot be trusted due to logging errors, organizations lose their ability to conduct effective forensic investigations. An attacker who gains control over a session could potentially mask their activities by triggering conditions that cause subsequent logs to attribute those actions to other users, thereby creating confusion and delaying detection. Additionally, automated compliance reporting tools may generate inaccurate reports if they parse these flawed logs, leading to false negatives in security monitoring dashboards.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary solution is the application of the provided patch which updates version 2.5.46 or later, ensuring that user identity is stored using persistent mechanisms rather than transient behavior-instance state. Administrators should verify their MISP instance version immediately and upgrade to a patched release if currently running any version up to 2.5.45. In addition to upgrading, organizations should implement enhanced log monitoring rules that flag inconsistencies between session tokens and logged user IDs where possible. It is also recommended to review historical logs for anomalies in action attribution during periods when the vulnerability was active, particularly looking for actions performed by users who were not actively logged into their web sessions at those times. Future development efforts should prioritize decoupling audit logging from model-specific state management to ensure that identity context remains stable regardless of lazy loading behaviors or concurrent object interactions within the application framework.