CVE-2026-44380: MISP improper access control in authentication key reset

CVE-2026-44380 · Severity: high · CVSS 7.2 · Published 2026-05-13

MISP is an open-source platform used by organizations to share and analyze threat intelligence. A security flaw in the platform's credential management allowed users with 'Organization Administrator' privileges to reset the authentication keys of 'Site Administrators' if they belonged to the same organization. This could allow a lower-level administrator to hijack a high-level system account, potentially leading to full control over the MISP instance and its sensitive threat data.

Technologies: Misp. Vendors: Misp.

Quick answers

Is CVE-2026-44380 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44380 being exploited in the wild.
How severe is CVE-2026-44380?
High severity, with a CVSS score of 7.2, published 13 May 2026.
Which products and versions are affected?
MISP Project MISP < 2.5.37.
Is there a fix for CVE-2026-44380?
A patch was published on 2026-05-13: Fix released in version 2.5.37 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44380 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44380?
Check whether you run Misp. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper access control vulnerability (CWE-863) exists in MISP's authentication key reset functionality. The application failed to explicitly prevent non-site administrators from accessing or resetting authentication keys belonging to site administrator accounts within the same organization. An attacker with 'Organization Administrator' privileges can trigger a reset of a 'Site Administrator' account's key, obtain the newly generated key, and use it to escalate their privileges to the site-wide administrator level. This issue is resolved in version 2.5.37 by implementing strict role-based checks that prevent non-site administrators from viewing or modifying keys associated with site administrator roles.

Affected products

  • MISP Project MISP < 2.5.37

Timeline

  • 2026-04-29: advisory: GitHub advisory published by vendor
  • 2026-05-13: disclosed: NVD publication date
  • 2026-05-13: patched: Fix released in version 2.5.37

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.