MISP CVE-2026-85237

Exploitation requires two prerequisites: (1) the attacker must possess valid primary authentication credentials (username and password) for the target MISP account - PR:L in the CVSS vector reflects this; and (2) the target account must have email-based OTP two-factor authentication enabled. Exploitation is limited to the window during which the OTP remains valid and before the user or an admin detects anomalous login activity. No special network position is required - the OTP endpoint is accessible over the network to any authenticated session. The user-scoped OTP design (rather than per-session) is a configuration-level aggravating factor present in all unpatched deployments.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) is well-calibrated. PR:L correctly reflects the prerequisite of valid primary credentials - the attacker must already have compromised or obtained the target's password before reaching the OTP stage, which meaningfully limits the attacker pool. AC:L is accurate because once primary auth is cleared, no additional complexity barriers exist on the OTP endpoint. The user-scoped OTP design is a genuine force multiplier: a threat actor controlling a botnet can open N concurrent sessions and partition the OTP keyspace across them, completing exhaustion faster than a single-threaded attack. MISP stores sensitive threat intelligence often classified at TLP:RED or TLP:AMBER, so account compromise in this context carries disproportionate downstream impact. No KEV listing and no public POC suggest this is not yet being exploited at scale, but the attack is straightforwardly reproducible from the patch diff alone. The SC:L in the CVSS 4.0 subsequent-system metrics reflects MISP's role as a sharing hub: one compromised account can expose intelligence feeds visible across multiple member organizations.

An attacker who has obtained a MISP user's password - through phishing, credential stuffing, or a data breach - authenticates with primary credentials and reaches the email OTP prompt. The attacker then scripts a high-rate loop of POST requests to /users/email_otp submitting all possible OTP values (typically 6-digit numeric space = 1,000,000 candidates); because there is no lockout, the correct value is discovered before the OTP expires. Opening multiple concurrent sessions allows partitioning the keyspace further, cutting time-to-success proportionally. No public exploit code exists, but the attack is trivially constructable from the patch diff.