Executive brief
A security flaw in the MISP threat intelligence platform allowed organization-level administrators to view or change the settings of higher-privileged site administrators within the same organization. This could allow an individual with limited administrative rights to gain unauthorized access to sensitive login profiles or modify the configurations of the system's primary overseers. The issue has been addressed in a recent update that correctly separates these administrative roles.
Technical details
An improper authorization vulnerability (CWE-863/CWE-639) existed in MISP's access control logic. The software scoped administrative actions based on organization membership but failed to exclude site administrator accounts from the sets managed by organization administrators. An authenticated attacker with organization administrator privileges could exploit this to view or alter site administrator user settings and login profile information, effectively crossing a privilege boundary. The fix hardens the ACL logic by explicitly excluding site administrator accounts from organization-managed user sets and ensuring authorization failures occur when a target user is not administrable.
Affected products
- MISP MISP Prior to commit ed3d9b862dea4c8c8e9b620a5ad99ce0c2c82154
Timeline
- 2026-06-11: patched: Fix committed to MISP repository.
- 2026-06-12: disclosed: CVE-2026-54357 published.