Executive brief
MISP is an open-source platform used by organizations to share and analyze threat intelligence. A security flaw in the platform's credential management allowed users with 'Organization Administrator' privileges to reset the authentication keys of 'Site Administrators' if they belonged to the same organization. This could allow a lower-level administrator to hijack a high-level system account, potentially leading to full control over the MISP instance and its sensitive threat data.
Technical details
An improper access control vulnerability (CWE-863) exists in MISP's authentication key reset functionality. The application failed to explicitly prevent non-site administrators from accessing or resetting authentication keys belonging to site administrator accounts within the same organization. An attacker with 'Organization Administrator' privileges can trigger a reset of a 'Site Administrator' account's key, obtain the newly generated key, and use it to escalate their privileges to the site-wide administrator level. This issue is resolved in version 2.5.37 by implementing strict role-based checks that prevent non-site administrators from viewing or modifying keys associated with site administrator roles.
Affected products
- MISP Project MISP < 2.5.37
Timeline
- 2026-04-29: advisory: GitHub advisory published by vendor
- 2026-05-13: disclosed: NVD publication date
- 2026-05-13: patched: Fix released in version 2.5.37