MISP CVE-2026-90961

Requires that the target MISP instance has the optional LdapAuth or LinOTPAuth authentication plugin enabled (neither is the default), and that the attacker knows at least one valid email address registered in the directory or MISP user store. No prior authentication is required (PR:N). The LDAP empty-password path further depends on the backing LDAP directory accepting unauthenticated binds (RFC 4513 §5.1.2), a server-side configuration outside attacker control that limits exploitation against hardened directories; the LinOTP mixed-authentication path and the empty-password-hash provisioning path are additional independent vectors. Instances using only MISP's stock password authentication are not exploitable.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L, score 9.3) reflects a network-reachable, unauthenticated, low-complexity bypass with high confidentiality/integrity impact - consistent with full account impersonation of sensitive threat-intelligence data. However, signals conflict on real-world urgency: CISA SSVC records Exploitation=none and Automatable=no, and no EPSS score, KEV listing, or POC was provided, so this is currently a high-severity-but-not-yet-exploited issue rather than an active-attack priority. Two real limiters temper the raw score: exploitation only works if the LdapAuth or LinOTPAuth plugin is enabled (both are optional, non-default), and the LDAP empty-password path additionally depends on the backing directory being configured to accept unauthenticated/anonymous binds - a server-side setting the attacker does not control. AC:L is arguably generous given that dependency; treat it as AC:H in hardened directories. The attacker must also know a valid email, which is low-effort reconnaissance. Net: prioritize patching on any MISP instance running these plugins, but instances using default password auth are unaffected.

An attacker learns a MISP org's user email format (e.g. from a public CIRCL/CERT contact page) and submits a login POST for admin@victim-cert.example with a blank password to a MISP instance running LdapAuth. The plugin forwards the empty password to ldap_bind(), the directory answers the unauthenticated bind with success, and MISP issues a session with that user's full privileges - including access to and modification of shared threat-intelligence events. No public exploit is identified at time of analysis, but the request is trivial to craft.