{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-94381", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "state": "PUBLISHED", "assignerShortName": "CIRCL", "dateReserved": "2026-09-21T12:42:51.237Z", "datePublished": "2026-09-21T12:42:53.242Z", "dateUpdated": "2026-09-21T14:48:17.524Z"}, "containers": {"cna": {"affected": [{"modules": ["UsersController"], "product": "MISP", "programFiles": ["app/Controller/UsersController.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.47", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p></p><p>MISP has a security issue that can let a user gain more access than their API key is supposed to allow.</p><p>A read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user\u2019s normal account permissions. This means someone with a read-only API key could potentially gain write, delete, or even administrator access if their underlying account has those permissions.</p><p>Exploiting the issue requires a valid read-only API key and a single request to the affected function.</p><p>The main impact is that MISP\u2019s API key restrictions can be bypassed, allowing actions that the API key was specifically meant to prevent.</p><br><p></p><p>Version affected: &lt;2.5.47</p>"}], "value": "MISP has a security issue that can let a user gain more access than their API key is supposed to allow.\n\nA read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user\u2019s normal account permissions. This means someone with a read-only API key could potentially gain write, delete, or even administrator access if their underlying account has those permissions.\n\nExploiting the issue requires a valid read-only API key and a single request to the affected function.\n\nThe main impact is that MISP\u2019s API key restrictions can be bypassed, allowing actions that the API key was specifically meant to prevent.\n\n\n\n\nVersion affected: <2.5.47"}], "impacts": [{"capecId": "CAPEC-114", "descriptions": [{"lang": "en", "value": "CAPEC-114 Exploiting Incorrectly Configured Privileges"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-09-21T12:42:53.242Z"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/fd27e592a"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix removes the call to User::getAuthUser() and Auth::login() from the updateLoginTime() method, which was re-authenticating the user with their full role permissions. It replaces this with a call to _refreshAuth(), which refreshes the authentication state while preserving the current (restricted) permission level associated with the API key, preventing privilege escalation.</p>"}], "value": "The fix removes the call to User::getAuthUser() and Auth::login() from the updateLoginTime() method, which was re-authenticating the user with their full role permissions. It replaces this with a call to _refreshAuth(), which refreshes the authentication state while preserving the current (restricted) permission level associated with the API key, preventing privilege escalation."}], "title": "MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "review", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The tag_version_boundary indicates the fix commit is 141 commits before v2.5.47, implying v2.5.47 contains the fix; versions prior to v2.5.47 are assumed affected. No explicit version range is stated in the patch.", "The _refreshAuth() method is assumed to preserve the current API-key-scoped permission level rather than re-fetching full role permissions; this is inferred from the commit subject and the removal of getAuthUser()/Auth::login().", "The 'full role' referenced in the commit subject is assumed to be a higher-privilege role (e.g., admin or site admin) compared to the read-only API key scope.", "CAPEC-114 is the closest available attack pattern; no CAPEC specifically models session privilege escalation via authentication refresh, so this mapping carries some uncertainty.", "CVSS impact metrics (VC/VI/VA) assume the user's full role grants broad administrative access to the MISP instance; actual impact depends on the specific role assigned to the user."], "capecRationale": [{"capecId": "CAPEC-114", "rationale": "The vulnerability arises because the updateLoginTime endpoint incorrectly reconfigures the user's privilege level during session refresh, upgrading from the API-key-scoped read-only permissions to the user's full role. The attacker exploits this misconfiguration by simply calling the endpoint. CAPEC-114 is the closest match as it covers scenarios where an application incorrectly assigns or maintains privilege levels. Uncertainty: no CAPEC specifically covers 'session privilege escalation via auth refresh,' so this is the best available approximation."}], "commit": "fd27e592a617f21934f4a2c424e0578287affb36", "confidence": "medium", "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}], "cvssRationale": "AV:N - the endpoint is accessible over the network via HTTP POST. AC:L - the attack requires only a single POST request to a known endpoint; no race conditions or complex timing. AT:N - no manipulation of the target system is needed beyond the API call. PR:L - the attacker must possess a valid read-only API key (authenticated user). UI:N - no user interaction is required. VC:H - the escalated user can read all data in the MISP instance that their full role permits. VI:H - the escalated user can create, modify, and delete threat intelligence data. VA:H - the escalated user can delete data, modify configurations, or disrupt the MISP service. SC/SI/SA:N - the impact is confined to the MISP instance itself; no cascading impact on other systems is evidenced.", "fixSummary": "The fix removes the call to User::getAuthUser() and Auth::login() from the updateLoginTime() method, which was re-authenticating the user with their full role permissions. It replaces this with a call to _refreshAuth(), which refreshes the authentication state while preserving the current (restricted) permission level associated with the API key, preventing privilege escalation.", "generatedAt": "2026-09-21T12:37:21.609779Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 9, "assumptionCount": 5, "confidence": "medium", "model": "qwen3.8:27b", "score": 5}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "d4143841f5f0d52a14d8538760872a7d91f78ba110384eafa3eedcad8e6480d3", "patchSummary": "In app/Controller/UsersController.php, the updateLoginTime() method is modified: the lines that fetched the user record via User::find(), called User::getAuthUser() to retrieve the full auth user, and called Auth::login() to re-establish the session are removed. These are replaced with a single call to $this->_refreshAuth(), which updates the authentication context without upgrading the permission scope. Net change: 1 insertion, 6 deletions.", "patchTruncated": false, "patches": [{"commit": "fd27e592a617f21934f4a2c424e0578287affb36", "patchSha256": "d4143841f5f0d52a14d8538760872a7d91f78ba110384eafa3eedcad8e6480d3", "source": "https://github.com/MISP/MISP/commit/fd27e592a.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/fd27e592a.patch", "subject": "fix: [security] read only api keys can regain full role"}], "source": "https://github.com/MISP/MISP/commit/fd27e592a.patch", "subject": "fix: [security] read only api keys can regain full role", "tagVersionBoundary": {"commits_after_fix": 141, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.47", "version": "2.5.47", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-269", "rationale": "The system fails to maintain the restricted privilege level (read-only) associated with the API key authentication. The updateLoginTime endpoint re-establishes the session with the user's full role permissions, effectively granting higher privileges than the authentication credential intended. This is a failure to properly manage and enforce the privilege boundary during session refresh."}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20048"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-94381", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-21T14:37:33.435781Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-21T14:48:17.524Z"}}]}}

{}

{"affected": [{"affectedData": [{"modules": ["UsersController"], "product": "MISP", "programFiles": ["app/Controller/UsersController.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.47", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MISP has a security issue that can let a user gain more access than their API key is supposed to allow.\n\nA read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user\u2019s normal account permissions. This means someone with a read-only API key could potentially gain write, delete, or even administrator access if their underlying account has those permissions.\n\nExploiting the issue requires a valid read-only API key and a single request to the affected function.\n\nThe main impact is that MISP\u2019s API key restrictions can be bypassed, allowing actions that the API key was specifically meant to prevent.\n\n\n\n\nVersion affected: <2.5.47"}], "id": "CVE-2026-94381", "lastModified": "2026-09-21T13:17:13.460", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}]}, "published": "2026-09-21T13:17:13.360", "references": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "url": "https://github.com/MISP/MISP/commit/fd27e592a"}], "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}]}

{}

{}