Executive brief
MISP is an open-source threat intelligence platform used by organizations to share cyber threat information. A security flaw allows an organization-level administrator to target higher-level site administrators within the same organization using administrative email tools. This could allow an attacker to reset a site administrator's password, leading to a full takeover of the entire MISP instance and access to all stored threat data.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in the administrative email functionality of MISP. The vulnerable component, located in UsersController.php, failed to exclude site administrator roles from recipient queries when an organization administrator initiated administrative actions. An authenticated attacker with organization administrator privileges can exploit this to perform privileged account-management actions, such as initiating password reset workflows, against higher-privileged site administrator accounts in the same organization. This results in vertical privilege escalation, potentially granting the attacker full control over the MISP instance. A fix has been committed to the MISP repository to explicitly exclude site admin role IDs from these queries.
Affected products
- MISP Project MISP Prior to commit 1467954
Timeline
- 2026-06-12: disclosed
- 2026-06-12: advisory