---
id: CVE-2026-90955
title: >-
  Affected versions of MISP’s interactive CLI shell do not reliably preserve the
  identity of the impersonated MISP user across audit logging.



  The shell is designed to run actions as a supplied MISP user ID
summary: >-
  Affected versions of MISP’s interactive CLI shell do not reliably preserve the
  identity of the impersonated MISP user across audit logging.



  The shell is designed to run actions as a supplied MISP user ID. However, the
  legacy SysLogLoga…
severity: medium
cvss: 4.6
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-223
  - CWE-778
vendor: MISP
product: MISP
affected:
  - MISP < 2.5.46
published: '2026-09-14'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T13:42:47.777'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90955'
references:
  - url: 'https://github.com/MISP/MISP/commit/d13e5db33'
    label: 5a6e4751-2f3f-4070-9419-94fb35b644e8
tags:
  - nvd
  - cve.org
epss: 0.00112
epssPercentile: 0.01531
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T12:55:46.663079Z'
cvssSource: cna
ingestedAt: '2026-09-14T15:23:07.429Z'
---

## Overview

Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging.


The shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user.



Version affected: ≤2.5.45

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.