MISP EUVD-2026-36549

The attacker must hold an active, authenticated organization administrator account (perm_admin role, not perm_site_admin) within the MISP instance - unauthenticated users and regular non-admin users cannot exploit this flaw. The critical enabling condition is that at least one site administrator must share the same org_id as the attacking org admin; without this co-location, there are no exploitable targets. This is a supported MISP configuration but not universal - deployments that isolate site admins into a dedicated organization are not exploitable. Exploitation is further bounded to reading or overwriting user settings and login profile records; it does not grant code execution, access to other organizations' data, or elevation to the site-admin role itself.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N, score 5.1) accurately characterizes the constrained real-world impact: the PR:H requirement limits the attacker population strictly to users already possessing organization administrator credentials, which is a meaningfully privileged position that should not exist in untrusted hands. The VC:L/VI:L and SC:L/SI:L metrics reflect partial confidentiality and integrity impact on both the MISP application layer and the site administrator accounts treated as a subsequent security scope. No EPSS score was provided, and KEV status is not confirmed, indicating no evidence of active or widespread exploitation. The practical risk is highest in multi-tenant MISP deployments where site administrators are co-located organizationally with less-trusted org admins - a configuration MISP supports but that amplifies the blast radius. The vulnerability does not enable code execution, lateral movement to other organizations, or availability impact; it is bounded to intra-organizational privilege boundary crossing for account metadata.

An org admin with valid credentials to a MISP instance where a site administrator shares the same organization enumerates user IDs belonging to site admins - discoverable via the user listing available to org admins - then queries the user settings or login profile endpoints using those IDs. The pre-patch ACL passes because org_id membership is satisfied, returning the site administrator's login profile metadata or user settings, or allowing the org admin to overwrite them. No public proof-of-concept code has been identified at time of analysis.