CVE-2026-94381 in MISP
Summary
by MITRE • 09/21/2026
MISP has a security issue that can let a user gain more access than their API key is supposed to allow.
A read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user’s normal account permissions. This means someone with a read-only API key could potentially gain write, delete, or even administrator access if their underlying account has those permissions.
Exploiting the issue requires a valid read-only API key and a single request to the affected function.
The main impact is that MISP’s API key restrictions can be bypassed, allowing actions that the API key was specifically meant to prevent.
Version affected: <2.5.47
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
MISP version 2.5.46 and earlier contain a critical authorization flaw within its application logic that allows for privilege escalation through improper enforcement of role-based access controls. The vulnerability stems from a specific function in the codebase that fails to properly validate or persist API key permissions during session initialization. When an authenticated user presents a read-only API key, which is designed strictly to restrict actions to viewing data without modification capabilities, the application incorrectly processes this credential and subsequently restores the underlying account's full permission set. This behavior effectively nullifies the restrictive intent of the API key configuration, creating a significant gap in access control mechanisms that governs how users interact with the platform’s sensitive intelligence data.
The technical root cause involves an error in session management or role assignment logic where the system prioritizes the base user account permissions over the specific constraints imposed by the active API token. In a properly secured implementation, the most restrictive permission set should apply when multiple credentials are involved, ensuring that read-only keys cannot inadvertently trigger administrative functions. Instead, MISP’s architecture allows the session context to revert to the full privileges associated with the underlying user profile after authentication is established via the restricted key. This logical flaw means that any action requiring write, delete, or administrator-level access can be executed by an attacker possessing only a read-only API token, provided they target the specific vulnerable endpoint and make a single request to trigger the permission restoration sequence.
From an operational perspective, this vulnerability poses severe risks to organizations utilizing MISP for sharing sensitive cyber threat intelligence. Attackers with limited initial access could escalate their privileges to modify or delete critical indicators of compromise, alter sharing rules, or exfiltrate data beyond authorized scopes. This undermines the integrity and confidentiality guarantees that API keys are intended to provide in multi-tenant environments or when delegating read-only access to external partners. The ability to bypass these restrictions without needing additional credentials or complex exploitation chains makes this a high-severity issue that could lead to significant data breaches, manipulation of threat feeds, and potential disruption of security operations centers relying on accurate and untampered intelligence sharing platforms.
This vulnerability aligns with CWE-269 Improper Privilege Management, as the application fails to maintain appropriate separation between user roles and API key restrictions. It also relates to CWE-862 Missing Authorization, since the system does not enforce access control policies correctly for specific actions based on the presented credentials. In terms of adversary tactics, this flaw facilitates lateral movement or privilege escalation within the MISP environment, potentially supporting ATT&CK techniques such as T1078 Valid Accounts if an attacker compromises a low-privilege account and uses it to gain higher-level access through API manipulation. The lack of strict enforcement allows for unauthorized data modification which falls under potential impacts described in MITRE ATT&CK related to Data Manipulation or Impact categories depending on the specific action taken post-exploitation.
To mitigate this risk, organizations running MISP versions prior to 2.5.47 must upgrade immediately to version 2.5.47 or later where the permission logic has been corrected to ensure that read-only API keys strictly enforce their limitations and do not revert to full account permissions. Until an update is applied, administrators should audit existing API key configurations to identify any keys designated as read-only that are being used in contexts requiring higher privileges. Additionally, implementing strict network-level access controls for MISP instances can limit exposure by restricting who can interact with the application’s endpoints. Security teams should also monitor logs for unusual patterns of authentication followed immediately by high-privilege actions using low-privilege keys to detect potential exploitation attempts in real-time and enhance overall monitoring capabilities around API usage anomalies.