MISP CLI Shell Authorization Bypass and Credential Exposure
MISP through 2.5.45 has CLI access controls separate from the web app, exposing HTTP feed credentials and server sync authkeys to unauthorized CLI users. Fix available in 2.5.46.
- Vendor
- MISP Project
- Product
- MISP
- CVSS
- N/A
- EPSS (exploit probability)
- 0.2%
- Status
- patched
- Published
CVE-2026-90895 is an authorization inconsistency in MISP’s interactive CLI shell. The CLI implements access control independently from the web application, creating gaps not present in the normal web interface.
Six specific inconsistencies are documented in the NVD record: feed listing visibility bypass for non-host-organisation users; feed detail access skipping host-org/site-admin gating; Feed.headers (which stores HTTP authorization credentials) returned unmasked; server sync authkeys unredacted in CLI detail output; sharing group access inconsistency; and the use command establishing record context without view-authorization confirmation.
CVSS score: not yet assigned by NVD. Severity classification is pending formal scoring.
Affected: MISP through and including 2.5.45. Fix: update to MISP 2.5.46 or later. Patch: GitHub commit cd9f548ed.
No CISA KEV listing. In-the-wild exploitation: unconfirmed as of publication.
