CVE-2026-54358: MISP Privilege Escalation Vulnerability

CVE-2026-54358 Overview

CVE-2026-54358 is an incorrect authorization vulnerability in MISP (Malware Information Sharing Platform). The flaw resides in the administrative email functionality, which restricts organization administrators to users within their own organization but fails to exclude site administrator accounts from recipient queries. An authenticated organization administrator can target a higher-privileged site administrator account in the same organization. The attacker can initiate privileged account-management actions, including password reset workflows, against that site administrator. Successful exploitation leads to privilege escalation and full compromise of the MISP instance.

Critical Impact
An authenticated organization administrator can take over a site administrator account in the same organization, resulting in full compromise of the MISP instance's confidentiality, integrity, and availability.

Affected Products

MISP (Malware Information Sharing Platform) instances prior to the patched commit 146795489abef478c8f595ecde2501c32482b81e
The admin_email functionality in app/Controller/UsersController.php
Deployments where organization administrators coexist with site administrators in the same organization

Discovery Timeline

2026-06-12 - CVE-2026-54358 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-54358

Vulnerability Analysis

The vulnerability is classified as Incorrect Authorization [CWE-863]. MISP enforces a hierarchical role model where site administrators hold higher privileges than organization administrators. The admin_email function in UsersController.php builds recipient queries that filter users by org_id for non-site-admin callers. The query does not exclude users whose role_id corresponds to a site administrator. An organization administrator can therefore enumerate and act on site administrator accounts that happen to belong to the same organization. The administrative email feature exposes privileged account-management workflows, including password reset initiation, against those higher-privileged accounts.

Root Cause

The root cause is a missing role-based filter in the recipient query construction. The authorization logic conflated organization membership with privilege equality. It assumed that limiting results to the caller's organization was sufficient to prevent privilege escalation. Site administrator role identifiers were never appended as a NOT condition on User.role_id. This allowed cross-privilege targeting whenever a site administrator shared an organization with an organization administrator.

Attack Vector

The attacker must authenticate to MISP as an organization administrator. The attacker must also share an organization with at least one site administrator account. From the administrative email interface, the attacker selects the site administrator as a recipient and triggers a password reset workflow or other privileged action. The workflow proceeds because the recipient query returns the site administrator. Compromise of the site administrator account yields full control over the MISP instance.

php

 public function admin_email($isPreview=false)
 {
+        // An org admin must not be able to target a site admin (e.g. to reset
+        // their password) even one within their own organisation, so exclude
+        // site admin roles from every recipient query below.
+        $siteAdminRoleIds = $this->_isSiteAdmin() ? array() : $this->User->getSiteAdminRoleIds();
         $conditionsAllowedOrgs = array();
         if (!$this->_isSiteAdmin()) {
             $conditionsAllowedOrgs = array('org_id' => $this->Auth->user('org_id'));
+            if (!empty($siteAdminRoleIds)) {
+                $conditionsAllowedOrgs['NOT'] = array('User.role_id' => $siteAdminRoleIds);
+            }
         }
         $conditionsAllowedOrgs['User.disabled'] = 0;
         $temp = $this->User->find('all', array('recursive' => -1, 'fields' => array('id', 'email', 'Organisation.name'), 'order' => array('email ASC'), 'conditions' => $conditionsAllowedOrgs, 'contain' => array('Organisation')));

Source: MISP Security Patch Commit. The patch retrieves site administrator role identifiers and appends a NOT clause to the recipient query when the caller is not a site administrator.

Detection Methods for CVE-2026-54358

Indicators of Compromise

Password reset emails delivered to site administrator accounts that were initiated by an organization administrator.
Audit log entries showing admin_email invocations by non-site-admin users targeting site administrator user IDs.
Unexpected authentication or session activity on site administrator accounts following an admin_email event.
Modifications to site administrator account attributes shortly after a password reset workflow.

Detection Strategies

Review MISP application logs for UsersController::admin_email calls and correlate the caller's role with recipient role identifiers.
Query the MISP database to identify password reset tokens issued to site administrators by organization administrators.
Monitor outbound email events from MISP for administrative messages directed at known site administrator addresses.

Monitoring Recommendations

Enable verbose audit logging for all account-management actions in MISP, including recipient selection metadata.
Forward MISP logs to a centralized SIEM and alert on privilege-boundary crossings between organization and site administrator roles.
Track changes to the users table where role_id reflects elevated privileges and correlate with prior admin_email activity.

How to Mitigate CVE-2026-54358

Immediate Actions Required

Apply the upstream MISP patch from commit 146795489abef478c8f595ecde2501c32482b81e to all production instances.
Audit existing organization assignments and remove site administrator accounts from organizations that contain organization administrators where feasible.
Reset credentials and invalidate active sessions for any site administrator account suspected of having been targeted.
Review recent administrative email activity for unauthorized password reset attempts.

Patch Information

The MISP project committed the fix in app/Controller/UsersController.php. The patch introduces getSiteAdminRoleIds() and excludes those role identifiers from the admin_email recipient query when the caller is not a site administrator. Administrators should pull the latest MISP release containing commit 146795489abef478c8f595ecde2501c32482b81e. See the MISP Security Patch Commit for the authoritative change.

Workarounds

Segregate site administrator accounts into a dedicated organization that contains no organization administrators.
Restrict organization administrator role assignments to trusted personnel until the patch is applied.
Temporarily disable the administrative email functionality for non-site-admin users through controller-level access restrictions.

bash

# Apply the upstream patch to a MISP deployment
cd /var/www/MISP
sudo -u www-data git fetch origin
sudo -u www-data git cherry-pick 146795489abef478c8f595ecde2501c32482b81e
sudo -u www-data /var/www/MISP/app/Console/cake Admin runUpdates
sudo systemctl restart apache2