Is there a patch available for EUVD-2026-36549?

Yes, a patch is available for EUVD-2026-36549. Update the affected software to the latest version immediately.

MISP EUVD-2026-36549

Q: What is the CVSS score of EUVD-2026-36549?

EUVD-2026-36549 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-54357 MEDIUM

Incorrect Authorization (CWE-863)

2026-06-12 CIRCL

GHSA-jfqf-9254-245v

Authentication Bypass Misp

5.1

CVSS 4.0 · Vendor: CIRCL

Severity by source

Vendor (CIRCL) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.5 MEDIUM

PR:H for required org-admin credentials; S:C because site admin accounts represent a distinct higher-privilege security scope; no availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (CIRCL).

CVSS VectorVendor: CIRCL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 12, 2026 - 20:03 vuln.today

Analysis Generated

Jun 12, 2026 - 20:03 vuln.today

DescriptionCVE.org

An improper authorization vulnerability in MISP allowed an authenticated organization administrator to access or modify user settings belonging to site administrator accounts within the same organization. The affected access-control checks scoped administrative actions by organization membership but did not exclude higher-privileged site administrator users. As a result, an organization administrator could potentially view or alter site administrator user settings and related login profile information, crossing the intended privilege boundary between organization administration and site-wide administration.

The patch hardens the ACL logic by excluding site administrator accounts from organization administrator-managed user sets, adding explicit authorization failure when a target user is not administrable, and ensuring user setting and login profile operations fail closed.

AnalysisAI

Improper authorization in MISP permits an authenticated organization administrator to read or overwrite user settings and login profile data belonging to site administrator accounts that share the same organization. The ACL checks in UserLoginProfilesController, UserSettingsController, and the UserSetting model correctly scoped operations by org_id membership but failed to exclude users holding site-admin roles, allowing a lower-privileged admin to cross the intended privilege boundary. No public exploit has been identified at time of analysis; a patch is available via a CIRCL-reported upstream commit.

Technical ContextAI

MISP (Malware Information Sharing Platform), identified by CPE cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*, implements a two-tier administrative model: site administrators hold global instance-wide privileges while organization administrators (perm_admin) are scoped to their own org_id. CWE-863 (Incorrect Authorization) manifests in three components: UserLoginProfilesController.php restricted login-profile listing and deletion by org_id without excluding site-admin role holders; UserSettingsController.php applied the same incomplete condition when building the user set for settings enumeration; and UserSetting::checkAccess() and setSetting() permitted org admins to pass authorization checks against site admin targets co-located in their org. A secondary flaw in setSetting() caused unauthorized write attempts to silently fall through to modifying the acting user's own settings rather than returning an explicit failure, compounding the authorization gap. The fix introduces getSiteAdminRoleIds() and isUserSiteAdmin() helpers to actively filter site-admin role holders from all org-admin-managed user sets, and replaces the silent fall-through with an explicit authorisation failure.

RemediationAI

Apply the upstream patch at https://github.com/MISP/MISP/commit/ed3d9b862dea4c8c8e9b620a5ad99ce0c2c82154, which modifies UserLoginProfilesController.php, UserSettingsController.php, UserSetting.php, and User.php to exclude site-admin role holders from org-admin-managed user sets and enforce explicit authorization failures on unauthorized write attempts. A specific tagged release version incorporating this fix was not confirmed from the available data; operators should verify the commit hash is present in their installed version via git log or their deployment pipeline. As an interim compensating control where patching is not immediately possible, place all site administrator accounts into a dedicated organization that contains no organization administrators - this eliminates the co-location condition that enables exploitation. This workaround carries a structural trade-off: it requires reorganizing user-org assignments and may disrupt threat intelligence sharing workflows or audit functions that depend on site admins sharing an organization with operational teams.