MISP EUVD-2026-94318

The MISP instance must be configured with Security.otp_required (forced TOTP enrolment), a non-default hardening setting, and the attacker must already hold a valid authenticated session for an account that has not yet enrolled in TOTP and whose role lacks the perm_skip_otp permission. Exploitation then requires only issuing a non-browser request shape (AJAX/XHR, REST API, .json URL, restSearch, or automation action) instead of a standard browser request. Limiting factors: valid credentials are mandatory (PR:L), the vulnerable enforcement only exists on otp_required instances, and identities authenticated via API key (logged_by_authkey flag) are explicitly exempt and unaffected.

Signals are mixed and point to a moderate, conditional risk rather than an urgent emergency. The vendor CVSS 4.0 score of 7.1 (High) is driven by a network vector with low complexity and no user interaction (AV:N/AC:L/UI:N) but requires existing low privileges (PR:L) - exploitation is only possible by someone who already holds valid, authenticated credentials on the instance. No EPSS score, CISA KEV listing, or public proof-of-concept is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Critically, this is a defense-in-depth / policy-enforcement bypass (CWE-287) that only takes effect on instances explicitly configured with Security.otp_required; it does not grant an unauthenticated outsider new access. Net: this is a legitimate authentication-policy weakness worth patching promptly on otp-enforcing MISP deployments, but it is not a widespread drive-by threat - real exposure is gated behind both a valid account and a non-default hardening configuration. Note the vendor marked only confidentiality impact (VC:H, VI:N/VA:N); because a bypassed user retains FULL instance access, integrity (write) impact is arguably also High - verify intended impact scope with the vendor.

An attacker who has obtained valid MISP credentials (e.g., via phishing) on an instance that mandates TOTP enrolment logs in but has not set up a second factor. Instead of being forced to the TOTP enrolment page, they issue REST API, .json, restSearch, or AJAX requests, which skip the enforcement redirect, granting full read/write access to threat-intelligence data without ever completing 2FA. No public exploit code is required - the bypass is a trivial change of request type.