---
id: CVE-2026-94381
title: >-
  MISP has a security issue that can let a user gain more access than their API
  key is supposed to allow.


  A read-only API key should only let someone view information
summary: >-
  MISP has a security issue that can let a user gain more access than their API
  key is supposed to allow.


  A read-only API key should only let someone view information. However, after
  logging in with such a key, a specific MISP function co…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-269
vendor: MISP
product: MISP
affected:
  - MISP < 2.5.47
published: '2026-09-21'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T15:17:39.077'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94381'
references:
  - url: 'https://github.com/MISP/MISP/commit/fd27e592a'
    label: 5a6e4751-2f3f-4070-9419-94fb35b644e8
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-21T14:37:33.435781Z'
cvssSource: cna
ingestedAt: '2026-09-21T13:37:22.828Z'
epss: 0.00372
epssPercentile: 0.28437
---

## Overview

MISP has a security issue that can let a user gain more access than their API key is supposed to allow.

A read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user’s normal account permissions. This means someone with a read-only API key could potentially gain write, delete, or even administrator access if their underlying account has those permissions.

Exploiting the issue requires a valid read-only API key and a single request to the affected function.

The main impact is that MISP’s API key restrictions can be bypassed, allowing actions that the API key was specifically meant to prevent.




Version affected: <2.5.47

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.