EUVD-2026-77344
GHSA-rx79-g748-j44m
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local shell access plus a low-privileged MISP account required; high C/I from plaintext credential disclosure and ACL bypass via `use`; no availability impact.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
Lifecycle Timeline
5DescriptionCVE.org
Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies.
The patch shows that CLI access could differ from the web application in multiple security-sensitive areas:
- feed listings did not enforce the same lookup_visible restrictions for non-host-organisation users;
- feed detail access did not enforce the same host-organisation/site-admin authorization as FeedsController::view();
- Feed.headers, which can contain HTTP authorization credentials, could be exposed instead of being hidden or masked;
- server synchronization authkey values were not explicitly hidden from CLI detail output;
- sharing-group detail access did not consistently use SharingGroup::checkIfAuthorised();
- the use command could establish context for a record without first proving that the user was authorized to view that record
The commit additionally hardens pagination and terminal rendering, including neutralization of terminal control sequences found in database-backed values. Those are important hardening changes, but the main vulnerability is the CLI authorization/data-disclosure mismatch.
Version affected: ≤2.5.45
AnalysisAI
MISP's interactive CLI shell (≤2.5.45) enforces access control independently from the web application, creating at least six distinct authorization gaps that allow authenticated local users to retrieve sensitive credentials and bypass record-level ACLs. Feed HTTP authorization headers (Feed.headers), server synchronization authkeys, sharing-group memberships, and feed visibility restrictions are all enforced correctly in the web tier but not in the CLI, while the use command allows a user to establish an unauthorized record context without proving read rights. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) a valid MISP user account at any privilege level below site-admin; (2) local OS-level shell access to the MISP server (e.g., SSH, direct console, or container exec), since the CLIShell is not accessible via the web interface; and (3) MISP version 2.5.45 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.4 with vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N accurately reflects the realistic threat model. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade MISP to a version incorporating commit cd9f548ed (available at https://github.com/MISP/MISP/commit/cd9f548ed), which the vendor has confirmed resolves all six authorization gaps. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all staff with local shell access to MISP servers and restrict access for non-administrative users if operationally feasible; simultaneously obtain the latest patched MISP version from your vendor. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in MISP 2.4.9x before 2.4.99. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
An issue was discovered in MISP before 2.4.158. Rated critical severity (CVSS 9.8), this vulnerability is remotely explo
app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_de
SQL injection in MISP threat intelligence platform versions prior to 2.5.37 allows remote unauthenticated attackers to m
An issue was discovered in MISP before 2.4.158. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitab
MISP 2.4.172 mishandles different certificate file extensions in server sync. Rated high severity (CVSS 7.5), this vulne
In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call. R
An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. Rated critical severity (CVSS 9.8), this v
An issue was discovered in MISP 2.4.128. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyEleme
app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data rel
MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value. Rated
Same weakness CWE-862 – Missing Authorization
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today