CVE-2026-54357: MISP Privilege Escalation Vulnerability

CVE-2026-54357 Overview

CVE-2026-54357 is an improper authorization vulnerability in MISP, the open-source threat intelligence sharing platform. An authenticated organization administrator could access or modify user settings and login profile information belonging to site administrator accounts within the same organization. The access-control checks scoped administrative actions by organization membership but failed to exclude higher-privileged site administrator users. This allowed an organization administrator to cross the intended privilege boundary between organization-scoped administration and site-wide administration. The flaw is tracked under [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact
An authenticated organization administrator can view or alter site administrator user settings, escalating effective privileges beyond the intended organizational scope.

Affected Products

MISP (Malware Information Sharing Platform) prior to the patched commit ed3d9b8
MISP UserSettingsController component
MISP UserLoginProfilesController component

Discovery Timeline

2026-06-12 - CVE-2026-54357 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-54357

Vulnerability Analysis

The vulnerability resides in MISP's access-control logic for user settings and login profile management. When an organization administrator queried or modified user settings, the controller restricted results to users sharing the same org_id. However, the filter did not exclude users holding the site administrator role within that organization. As a result, an org admin could enumerate or change settings tied to a site admin account, including login profile data. The issue is a horizontal-to-vertical privilege boundary failure within MISP's role-based access control implementation.

Root Cause

The ACL conditions in UserSettingsController.php and UserLoginProfilesController.php filtered target users solely by organization membership. The code did not consult getSiteAdminRoleIds() to exclude privileged role identifiers. Operations that should have failed closed when a target user was not administrable instead succeeded against site admin records.

Attack Vector

An attacker requires authenticated organization administrator credentials in a MISP instance where a site administrator account shares the same org_id. The attacker invokes user setting or login profile endpoints targeting the site admin's user_id and receives or modifies records that should be out of scope.

php

// Patch in app/Controller/UserSettingsController.php
// Source: https://github.com/MISP/MISP/commit/ed3d9b862dea4c8c8e9b620a5ad99ce0c2c82154
if (!$this->_isSiteAdmin()) {
    if ($this->_isAdmin()) {
        $orgUserConditions = array('User.org_id' => $this->Auth->user('org_id'));
        // An org admin must not see a site admin's settings.
        $siteAdminRoleIds = $this->UserSetting->User->getSiteAdminRoleIds();
        if (!empty($siteAdminRoleIds)) {
            $orgUserConditions['NOT'] = array('User.role_id' => $siteAdminRoleIds);
        }
        $conditions['AND'][] = array(
            'UserSetting.user_id' => $this->UserSetting->User->find(
                'list', array(
                    'recursive' => -1,
                    'conditions' => $orgUserConditions,
                    'fields' => array(
                        'User.id', 'User.id'
                    )

The patch adds an explicit NOT condition excluding any user whose role_id matches a site admin role, ensuring org admins cannot retrieve or modify site admin records.

Detection Methods for CVE-2026-54357

Indicators of Compromise

Unexpected modifications to site administrator user settings recorded in the MISP audit log by non-site-admin accounts.
Access to /user_settings/ or /user_login_profiles/ endpoints with a user_id parameter resolving to a site administrator account.
Org admin sessions issuing requests that enumerate or alter login profile entries belonging to other privileged users.

Detection Strategies

Review MISP audit logs for UserSetting and UserLoginProfile actions where the acting user is an org admin and the target user holds a site admin role.
Correlate HTTP access logs with MISP user role data to flag cross-role administrative actions.
Alert on any privilege role change events or login profile deletions initiated by non-site-admin accounts.

Monitoring Recommendations

Enable MISP's built-in audit logging and forward logs to a centralized SIEM for retention and correlation.
Baseline normal org admin activity and alert on access to user records outside the expected administrative scope.
Monitor for sudden changes to authentication-related settings on site admin accounts, including TOTP and login profile data.

How to Mitigate CVE-2026-54357

Immediate Actions Required

Update MISP to a version containing commit ed3d9b862dea4c8c8e9b620a5ad99ce0c2c82154 or later.
Audit recent activity by all organization administrators against site admin user records and login profiles.
Rotate credentials and reset multi-factor authentication enrollments for any site admin accounts that may have been affected.

Patch Information

The upstream patch is published in the MISP repository and hardens ACL logic across UserSettingsController and UserLoginProfilesController. It excludes site administrator accounts from organization administrator-managed user sets, adds explicit authorization failure when a target user is not administrable, and ensures user setting and login profile operations fail closed. Refer to the MISP security patch commit for full details.

Workarounds

Separate site administrator accounts into a dedicated organization that contains no organization administrators until patching is complete.
Temporarily reduce the number of organization administrator accounts and restrict access to trusted personnel.
Increase audit log review frequency until the patched commit is deployed across all MISP instances.

bash

# Apply the upstream fix by updating to the patched MISP revision
cd /var/www/MISP
sudo -u www-data git fetch origin
sudo -u www-data git checkout 2.4
sudo -u www-data git pull origin 2.4
# Verify the fix commit is present
git log --oneline | grep ed3d9b8
# Restart the web server to apply changes
sudo systemctl restart apache2