MISP EUVD-2026-104150

Requires an authenticated MISP account (PR:L) that can reach the server settings retrieval or settings-edit endpoints; the attacker must supply a configuration branch name such as 'Security', 'MISP', or 'Plugin' in place of a specific leaf setting name, causing getSettingData to return the entire sub-tree. Exploitation works against default configurations of affected MISP versions (<2.5.48) and needs no special deployment mode, but is limited by the need for prior authentication and access to the server settings endpoints - unauthenticated external attackers cannot trigger it. The impact is bounded to disclosure of stored secrets (security salt, Redis passwords, plugin API keys); no write, code execution, or availability impact is involved.

This is a genuine but moderate-priority information-disclosure flaw (CWE-200), not an inflated high-CVSS issue, though the raw 7.1 somewhat overstates real-world urgency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) correctly reflects an authenticated (PR:L), network-reachable, low-complexity attack with high confidentiality impact and no integrity or availability impact, consistent with the description of secret disclosure only. There is no public exploit identified at time of analysis and no CISA KEV listing, and no EPSS score was provided, so exploitation probability cannot be quantified - these signals are simply absent rather than conflicting. The key limiting factor is that PR:L requires an already-authenticated MISP user who can reach the server settings endpoints, which meaningfully reduces exposure versus an unauthenticated flaw; however, the disclosed values (security salt, Redis passwords, plugin API keys) are high-value secrets that enable follow-on attacks, so prompt patching is warranted. No conflicting signals were detected between the CVSS vector and the description - both agree on authenticated network access with confidentiality-only impact.

An authenticated MISP user with access to the server settings interface queries the settings lookup endpoint using a configuration branch name (e.g. 'Security', 'MISP', or 'Plugin') rather than a specific leaf setting. Because branch nodes carry no redaction flag, the redaction check is bypassed and the entire sub-tree is returned, exposing the security salt, Redis connection passwords, and plugin API keys. No public proof-of-concept is identified, but the technique is trivial to reproduce given the clear description and the fix commit.