Read the docs
TI-2026-61767 Aliases CVE-2026-90895GHSA-rx79-g748-j44m

MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection

Priority LOW 37CWE-150Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-862.

Summary

Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. The patch shows that CLI access could differ from the web application in multiple security-sensitive areas:  - feed listings did not enforce the same lookup_visible restrictions for non-host-organisation users;  - feed detail access did not enforce the same host-organisation/site-admin authorization as FeedsController::view();  - Feed.headers, which can contain HTTP authorization credentials, could be exposed instead of being hidden or masked;  - server synchronization authkey values were not explicitly hidden from CLI detail output;  - sharing-group detail access did not consistently use SharingGroup::checkIfAuthorised();  - the use command could establish context for a record without first proving that the user was authorized to view that record The commit additionally hardens pagination and terminal rendering, including neutralization of terminal control sequences found in database-backed values. Those are important hardening changes, but the main vulnerability is the CLI authorization/data-disclosure mismatch. Version affected: ≤2.5.45

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00149 4th percentileScored 2026-11-07
Fix Fixed MISP (MISP): 2.5.46

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MISPMISPbefore 2.5.462.5.46Patch availableCNA
  • MISP VendorMISP Affected before 2.5.46 Fixed in 2.5.46 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:misp-project:misp:*:*:*:*:*:*:*:*——Misp-project
  • cpe:2.3:a:misp-project:misp:*:*:*:*:*:*:*:* Versions — — ·Misp-project

Remediation

  • Fix · CNA MISP (MISP) Fixed in 2.5.46

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    MISP 2.5.46

    5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-61820 MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String CredentialsPriority MEDIUM 43
    • TI-2026-61818 MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report PicturesPriority LOW 23
    • TI-2026-61765 MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle EndpointsPriority LOW 23
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-90895
  2. 2026-10-03 Alias added: GHSA-rx79-g748-j44m

References

Patch 1

  • TI-2025-41517 In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. CVSS 3.1CRITICAL 9.0
  • TI-2026-65744 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period CVSS 4.0CRITICAL 9.3
  • TI-2026-54145 Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library CVSS 4.0HIGH 8.8
  • TI-2020-10250 MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case. CVSS 3.1CRITICAL 9.8
  • TI-2026-59159 MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding CVSS 4.0HIGH 8.7
  • TI-2026-58541 MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials CVSS 4.0CRITICAL 9.5
See all 182 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences