Executive brief
MISP is a platform for sharing threat intelligence data and indicators of compromise. The vulnerability allows any authenticated user to retrieve sensitive cryptographic keys (including signing keys) from protected events that they should not have access to. This could enable an attacker with basic user credentials to access confidential signing keys and potentially forge threat intelligence data or impersonate trusted sources within the platform.
Technical details
A critical authorization flaw in MISP's CryptographicKeysController::view() method fails to enforce parent-event visibility constraints before returning sensitive key material. The vulnerable code queries CryptographicKey records directly using the supplied key ID and exposes fields like type, key_data, and fingerprint without first authorizing access to the associated parent event. An authenticated attacker can request a cryptographic key by ID and retrieve a protected event's signing key regardless of their event access permissions. The fix adds parent_id and parent_type to the lookup and enforces authorization through fetchSimpleEvent($user, parent_id), ensuring only users with appropriate event access can retrieve associated keys. Non-Event parents are restricted to site administrators.
Affected products
- MISP Project MISP ≤2.5.45
Timeline
- 2026-09-07: disclosed
- 2026-09-07: patched: Fix committed to upstream repository