EUVD-2026-36550
GHSA-9cgp-f46x-4wgf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as org-admin in MISP
-
DeliveryEnumerate site admins sharing the organization
-
ExploitInvoke admin_email/admin_quickEmail endpoint
-
ExecutionTrigger password-reset workflow against site admin
-
PersistCapture or coerce reset link
-
ImpactAssume site-admin identity and control instance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must be authenticated to MISP with the organization-administrator role, and at least one site-administrator account must exist within the same organization as the attacker - confirmed by the CVE description and matching the CVSS 4.0 AT:P attack-requirement. Exploitation is limited to MISP deployments that co-locate site admins and org admins in a single organization; instances that segregate site admins into a dedicated admin-only organization are not exploitable. No user interaction by the victim is required to trigger the privileged email action (UI:N), though completing account takeover via password reset depends on the attacker's ability to receive or intercept the reset workflow output. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N, VC:H/VI:H/VA:H) accurately reflects a network-reachable but high-privilege flaw: the attacker must already hold org-admin credentials and a site admin must exist in the same organization (the AT:P attack-requirement), but once those preconditions are met, impact is complete on the vulnerable system. No EPSS score, KEV listing, or POC was provided in the input, and no public exploit identified at time of analysis - the realistic risk profile is targeted insider/post-compromise escalation rather than mass exploitation. Priority should be elevated for MISP operators who deliberately mix site-admin and org-admin accounts in the same organization (a common pattern for the 'host' organization of a community), and lower for instances where site admins live in a dedicated administrative organization. |
| Exploit ScenarioDerived | An attacker who has compromised or been granted organization-administrator credentials in a MISP instance notices that a site administrator belongs to the same organization. They open the administrative email interface and invoke the password-reset workflow against the site admin, intercept or socially obtain the reset link, and then authenticate as the site admin to gain full control of the MISP instance, its data, sync feeds, and connected sharing communities. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 12, 2026
Privilege escalation in MISP (Malware Information Sharing Platform) allows an authenticated organization administrator to target site administrator accounts within their own organization via the administrative email functionality, enabling privileged actions such as triggering a password-reset workflow against a higher-privileged user. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. Successful exploitation results in full takeover of the targeted site admin account and complete compromise of the MISP instance.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply commit 146795489abef478c8f595ecde2501c32482b81e from https://github.com/MISP/MISP/commit/146795489abef478c8f595ecde2501c32482b81e or upgrade to the first tagged MISP release that includes it. As a compensating control until patched, move all site administrator accounts out of any organization that also contains organization administrators (placing site admins in a dedicated administrative-only organization removes the precondition entirely), and audit existing org-admin assignments to confirm none share an organization with a site admin; the trade-off is operational friction for environments that intentionally co-locate roles. Additionally, monitor MISP audit logs for use of the admin_quickEmail and admin_email endpoints by non-site-admin users and alert on password-reset emails delivered to site administrator accounts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MISP is an open-source threat intelligence sharing platform written in PHP (CakePHP framework). The flaw lives in app/Controller/UsersController.php in the admin_quickEmail and admin_email actions, which build recipient queries scoped to the organization administrator's own organization but fail to also filter out users assigned a site-administrator role. This is a textbook CWE-863 (Incorrect Authorization) defect: the authorization check enforces organizational tenancy but omits role-based tenancy across the privilege hierarchy, so org-admin tooling can reach into the higher-trust site-admin tier whenever the two roles co-exist in the same organization.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-accessible MISP UI (AV:N/AC:L), requires org-admin privileges (PR:H), no victim interaction (UI:N), and full compromise of the MISP instance once a same-org site admin is taken over (C/I/A:H).
Primary rating from Vendor (5a6e4751-2f3f-4070-9419-94fb35b644e8).
CVSS VectorVendor: 5a6e4751-2f3f-4070-9419-94fb35b644e8
Lifecycle Timeline
1DescriptionCVE.org
An incorrect authorization vulnerability in MISP allows an organization administrator to target site administrator accounts belonging to the same organization through the administrative email functionality. The affected code restricted organization administrators to users within their own organization, but did not exclude accounts assigned a site administrator role from recipient queries. As a result, an organization administrator could perform privileged account-management actions, such as initiating a password reset workflow, against a higher-privileged site administrator account in the same organization.
Successful exploitation may allow an authenticated organization administrator to interfere with or potentially take over a site administrator account, resulting in privilege escalation and full compromise of the MISP instance’s confidentiality, integrity, and availability.
Attack prerequisites: The attacker must be authenticated as an organization administrator in the same organization as a site administrator account.
Executive ViewAI
MISP deployments are vulnerable to privilege escalation attacks that allow existing administrators to compromise site administrator accounts and seize complete control of the threat intelligence platform. Organizations using MISP for collaborative threat analysis face immediate risk of losing critical malware intelligence and operational visibility into their threat landscape. While no public exploit code is currently available, the complete compromise risk demands immediate access restrictions and monitoring.
Enforce multi-factor authentication on all MISP administrative accounts; restrict administrator role memberships to essential personnel with documented business justification; implement comprehensive administrative action audit logging with SIEM integration and real-time alerting; create dedicated monitoring for anomalous password-reset email activities targeting site administrators; implement network segmentation to isolate MISP administrative interfaces; disable the administrative email functionality if operationally feasible; conduct weekly privileged access reviews and enforce principle of least privilege across all administrative roles.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB