Executive brief
MISP's command-line interface (CLI) shell manages threat intelligence and incident response data. The CLI enforced access controls independently of the web application, allowing authenticated users to view sensitive data (feeds, server credentials, sharing groups) that they should not have permission to access. An attacker with CLI access could retrieve authentication credentials and other restricted information.
Technical details
The vulnerability is an authorization inconsistency in the interactive CLI shell where access control was implemented separately from the web application, resulting in data disclosure and privilege escalation. Vulnerable components include: feed listing and detail view missing lookup_visible and host-organisation restrictions; Feed.headers containing HTTP authorization credentials not being masked in CLI output; server synchronization authkey values exposed in detail commands; sharing group access not using the same SharingGroup::checkIfAuthorised() validation; and the use command allowing context establishment without verifying user authorization. An authenticated user with CLI access could enumerate feeds, sharing groups, and credentials not visible through the web interface. The patch routes all CLI authorization through model accessors to align with web application controls and neutralizes terminal control sequences.
Affected products
- MISP MISP ≤2.5.45
Timeline
- 2026-09-14: disclosed
- 2026-09-02: patched