EUVD-2026-42239
GHSA-frwx-j879-pmqv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privilege authentication required (read-only API key); no scope change; impact limited to event data integrity with no confidentiality or availability loss.
Primary rating from Vendor (5a6e4751-2f3f-4070-9419-94fb35b644e8).
CVSS VectorVendor: 5a6e4751-2f3f-4070-9419-94fb35b644e8
Lifecycle Timeline
1DescriptionCVE.org
An authorization bypass in MISP’s EventsController::importModule() allowed authenticated users or read-only API keys with event view access to persist data to events they were not allowed to modify. When an import module returned results in the misp_standard format, the write path did not verify event modification rights before saving the module output. This could allow a view-only user to inject or alter event data, impacting the integrity of MISP event content. The issue was fixed by enforcing the same modification-rights check used by related module result handling paths before processing misp_standard imports.
AnalysisAI
Authorization bypass in MISP's EventsController::importModule() allows authenticated users or read-only API key holders with event view access to persist unauthorized data modifications to events. When an import module returns results in the misp_standard format, the write path skips the modification-rights check applied by all other module result handling paths, allowing a view-only principal to inject or overwrite event content they have no permission to edit. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the integrity impact on shared threat intelligence events is operationally significant for MISP deployments where data provenance and access segregation are critical.
Technical ContextAI
MISP (Malware Information Sharing Platform) is an open-source threat intelligence sharing platform used by SOCs, CERTs, and ISACs to collaboratively manage and distribute structured threat data. The vulnerability resides in EventsController::importModule(), the controller action responsible for processing results returned by import modules. CWE-862 (Missing Authorization) describes the root cause: when an import module returns data structured as misp_standard format, a separate code path handles persistence, and that path omits the modification-rights gate present in all sibling code paths. The fix, committed as d0725fc34fda256cc57e5a8f0543cd541033e008, enforces the existing modification-rights check uniformly across all module result formats. Affected versions per EUVD EUVD-2026-42239 are MISP 0 through 2.5.42 inclusive.
RemediationAI
Update MISP to a version incorporating commit d0725fc34fda256cc57e5a8f0543cd541033e008 - the exact first patched release tag is not independently confirmed from available data, so administrators should verify against the MISP release changelog and upgrade to the latest available release beyond 2.5.42. If immediate upgrade is not feasible, a compensating control is to audit and restrict which user accounts or API keys hold even read-only event access, limiting the pool of principals that could trigger the vulnerable import path. Additionally, operators can monitor MISP audit logs for unexpected import module invocations by read-only principals as a detection measure. Note that restricting API key issuance may impact automated integration workflows that depend on read-only access for threat intelligence consumers.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today