Which versions of MISP are affected by CVE-2026-44380?

MISP threat intelligence platform versions prior to 2.5.37 contain an access control vulnerability that allows organization administrators to reset site administrator credentials, enabling privilege…. A patch is available.

How to fix or mitigate CVE-2026-44380?

Within 24 hours: Inventory all MISP deployments and document current versions in use. Within 7 days: Deploy vendor patch 2.5.37 to all systems running versions prior to 2.5.37. Within 30 days: Audit authentication key reset logs from the past 90 days; revoke any API keys reset by organization administrators outside established administrative procedures.

MISP CVE-2026-44380

Q: What is the CVSS score of CVE-2026-44380?

CVE-2026-44380 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-30167 HIGH

Incorrect Authorization (CWE-863)

2026-05-13 GitHub_M

Authentication Bypass Misp

8.6

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:08 vuln.today

Patch available

May 13, 2026 - 22:03 EUVD

CVSS changed

May 13, 2026 - 21:22 NVD

8.6 (HIGH)

DescriptionCVE.org

MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, an improper access control vulnerability in the authentication key reset functionality allowed an authenticated organization administrator to reset authentication keys belonging to site administrator accounts within the same organization. Because non-site administrators were not explicitly prevented from accessing or resetting site administrator auth keys, an attacker with organization administrator privileges could potentially obtain a newly generated auth key for a higher-privileged account and use it to escalate privileges. This vulnerability is fixed in 2.5.37.

AnalysisAI

Privilege escalation in MISP threat intelligence platform versions prior to 2.5.37 allows organization administrators to reset authentication keys of site administrator accounts within the same organization, yielding cross-tier access takeover. The flaw stems from missing authorization checks in the auth key reset workflow, enabling an org-admin to harvest a freshly generated site-admin API key. No public exploit identified at time of analysis, and EPSS rates exploitation probability at just 0.06%, but a vendor-released patch (2.5.37) is available.

Technical ContextAI

MISP (Malware Information Sharing Platform) is a widely deployed open-source threat intelligence platform used by CERTs, SOCs, and ISACs to share IOCs and structured threat data. MISP uses role-based authentication keys (auth keys) for both UI sessions and REST API access, with a tiered admin model distinguishing organization administrators (scoped to their org) from site administrators (global control). The root cause is CWE-863 (Incorrect Authorization): the auth key reset endpoint failed to enforce that org-admins cannot operate on accounts holding equal or higher privileges, so a privilege boundary intended between org-admin and site-admin was not enforced server-side. The affected CPE is cpe:2.3:a:misp:misp prior to 2.5.37.

RemediationAI

Upgrade MISP to version 2.5.37 or later, which is the vendor-released patch documented in advisory GHSA-3939-4g6m-m3hc (https://github.com/MISP/MISP/security/advisories/GHSA-3939-4g6m-m3hc). Until patching is possible, operators of shared/community MISP instances should audit the organization administrator role assignments and consider temporarily revoking org-admin privileges from accounts that share an organization with site-admin users, accepting the operational trade-off of reduced delegated administration. Additionally, monitor the audit log for auth key reset events targeting site-admin accounts and rotate any site-admin auth keys after upgrading in case prior exploitation occurred; the trade-off is that any automation or integrations using those keys will need to be reconfigured.