CVE-2026-94381: MISP Auth Bypass Vulnerability

CVE-2026-94381 Overview

CVE-2026-94381 is a privilege escalation vulnerability in the Malware Information Sharing Platform (MISP) that allows a read-only API key to regain the full permissions of the underlying user account. The flaw resides in a specific authenticated endpoint that reloads the session user record from the database, discarding the API-key-imposed restrictions. Any user with a valid read-only API key can invoke the affected function with a single POST request and obtain write, delete, or administrator capabilities held by their account. The issue is tracked under [CWE-269: Improper Privilege Management] and affects MISP versions prior to 2.5.47.

Critical Impact
A read-only MISP API key can be silently upgraded to the full permission set of the account, bypassing the API key restriction model entirely.

Affected Products

MISP versions earlier than 2.5.47
MISP instances exposing the affected controller endpoint to API-authenticated users
Deployments issuing read-only API keys to users whose accounts carry write or administrator roles

Discovery Timeline

2026-09-21 - CVE-2026-94381 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94381

Vulnerability Analysis

MISP enforces API-key-scoped permissions by attaching restriction metadata to the authenticated session. When a request is issued using a read-only API key, the authenticated user object carries reduced role capabilities. The affected controller action reloaded the user record directly from the User model and re-authenticated the session with Auth->login($user), which replaced the restricted session user with the full account record. The result is a session that retains API authentication but silently inherits the account's underlying role, including write and site-admin privileges where applicable.

Exploitation requires only a valid read-only API key and a single POST request to the vulnerable endpoint. No user interaction or additional credentials are needed. The vulnerability breaks the trust boundary between issued API key scope and account role scope.

Root Cause

The root cause is improper privilege management ([CWE-269]) in the MISP UsersController. The controller re-fetched the raw user record and reissued authentication using getAuthUser() and Auth->login(), overwriting the session context that carried the API-key restrictions. The fix replaces this pattern with _refreshAuth(), which preserves the current authentication scope while updating login timestamps.

Attack Vector

The attack is remote and network-based. An attacker in possession of a read-only API key issues an authenticated POST request to the affected endpoint. The server updates the login timestamps and rebuilds the session user without the API key restriction filter. Subsequent requests within the same session operate with the underlying account's full role, enabling data modification, deletion, or administrative actions.

php

         if (!$this->request->is('post')) {
             throw new MethodNotAllowedException('This feature is only accessible via POST requests');
         }
-        $user = $this->User->find('first', array(
-            'recursive' => -1,
-            'conditions' => array('User.id' => $this->Auth->user('id'))
-        ));
         $this->User->id = $this->Auth->user('id');
         $this->User->saveField('last_login', time());
         $this->User->saveField('current_login', time());
-        $user = $this->User->getAuthUser($user['User']['id']);
-        $this->Auth->login($user);
+        $this->_refreshAuth();
         $this->redirect(array('Controller' => 'User', 'action' => 'dashboard'));
     }

Source: MISP commit fd27e592a. The patch removes the direct user reload and full Auth->login() call, substituting _refreshAuth() so the session honors the original API key restrictions.

Detection Methods for CVE-2026-94381

Indicators of Compromise

POST requests to the affected UsersController action originating from clients presenting a read-only API key
Session-authenticated write, delete, or administrative actions immediately following an API-key login flow
Unexpected updates to last_login and current_login fields for accounts that normally use only read-only automation
API-key-attributed audit entries followed by role-elevated actions from the same session identifier

Detection Strategies

Correlate MISP application logs to identify API key sessions that perform write or admin operations after invoking the affected endpoint
Baseline expected behavior for each API key and alert when a key tagged read-only issues modifying requests
Review reverse proxy or web server logs for POST requests to the dashboard-redirecting user action from automation user agents

Monitoring Recommendations

Enable MISP audit logging and forward events to a centralized SIEM for cross-session analysis
Alert on privilege changes, event modifications, and user administration actions performed by accounts whose API keys are provisioned as read-only
Monitor for anomalies in last_login timestamp updates on service or automation accounts

How to Mitigate CVE-2026-94381

Immediate Actions Required

Upgrade all MISP instances to version 2.5.47 or later without delay
Rotate any read-only API keys that could have been used against a vulnerable instance
Audit MISP logs for write, delete, or admin actions performed by accounts that only interact via read-only API keys
Restrict network exposure of the MISP web interface to trusted networks pending patch deployment

Patch Information

The fix is committed upstream in the MISP repository and replaces the vulnerable re-authentication logic with _refreshAuth(). See the MISP security commit fd27e592a for the exact code change. Administrators should apply the corresponding tagged release (2.5.47 or newer).

Workarounds

Reduce blast radius by ensuring accounts issued read-only API keys do not also hold write or administrator roles on their user object
Limit access to the MISP UI and API to authenticated administrators via network access controls until the patch is applied
Disable or revoke read-only API keys that are not actively required for automation

bash

# Verify the running MISP version and upgrade via git
cd /var/www/MISP
sudo -u www-data git fetch --tags
sudo -u www-data git checkout v2.5.47
sudo -u www-data /var/www/MISP/app/Console/cake Admin runUpdates