MISP CVE-2026-112192

Requires an authenticated MISP user who holds the privilege to read/edit server settings (role with server-settings access), and the MISP instance must have at least one enabled module plugin that declares a setting with the 'redacted' flag (e.g., an API key) or the 'cli_only' flag. Exploitation uses the servers/getSetting and servers/serverSettingsEdit API endpoints. Limiting factors: the attacker must already be authenticated with settings-read permission (not anonymous/remote-unauthenticated), and the exposure only materializes for module-declared settings carrying those flags; instances with no such module settings have nothing to leak. Affected versions are <2.5.48.

This is a moderate, authentication-gated information-disclosure and access-control flaw rather than a high-urgency issue. The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L) and 5.3 base score are consistent with the description: network-reachable but requiring an already-authenticated user who has permission to read/edit server settings (PR:L), with low technical impact. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so there is no signal of active or probable exploitation - exploitation status is 'no public exploit identified at time of analysis.' The realistic risk is an insider or a compromised lower-trust account escalating visibility into sensitive module credentials (e.g., third-party API keys) and tampering with settings a module author intended to lock to CLI, which could aid lateral movement. One data note: the input 4.0 vector sets VA:L (availability impact), but the described impacts are credential exposure (confidentiality) and bypassing a modification restriction (integrity), so an availability impact is not clearly supported by the description - verify with vendor.

An authenticated MISP user who holds the server-settings read/edit permission (but is not intended to see module secrets) calls the servers/getSetting or servers/serverSettingsEdit API endpoint and receives the full plaintext value of a module setting that was declared 'redacted', such as an external threat-feed API key. The same user can also edit a setting the module marked 'cli_only', changing configuration that was meant to be mutable only from the command line. No public exploit code is identified, but the attack is trivial given the required privilege and low complexity (AC:L).