CVE-2026-127016

The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application environment, the module configuration endpoints correctly required an authenticated administrator session, but the external tools management handlers processed requests from anonymous users without any authorization check. An unauthenticated attacker with network access to the website could add arbitrary external tools, delete existing tools, toggle their active status, and modify their configurations including API keys and ingestion URLs. This inconsistency allowed bypass of the intended access control for the external tools management functionality. The vulnerability is conditional on ADMIN_PASSWORD being set; installations without an admin password intentionally permit open management access by design. The affected component is the external_tools Flask blueprint within the MISP Modules website application.

• CWE-862

• https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027

Published

Nov 12, 2026

Last Modified

Nov 12, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126994A vulnerability has been found in braindecode up to 1.8.1. A…6.3
• CVE-2026-126995A vulnerability was found in tjake Jlama up to 0.8.4/0.9.0-b…6.3
• CVE-2026-126996A vulnerability was determined in SakanaAI text-to-LoRA 0.0.…6.3
• CVE-2026-126997A vulnerability was identified in JeecgBoot up to 3.9.6. Thi…7.3
• CVE-2026-126998A security flaw has been discovered in JeecgBoot up to 3.9.5…7.3
• CVE-2026-12701A path traversal vulnerability was found in pulpcore. The re…9
• CVE-2026-12702In affected versions of Octopus Deploy Insufficient checks o…4.9
• CVE-2026-127029A flaw was found in freeradius's Extensible Authentication P…7.5
• CVE-2026-12703TeamViewer Full Client and Host for macOS before version 15.…8
• CVE-2026-127030A flaw was found in freeradius. An improper length validatio…7.5
• CVE-2026-127036Improper neutralization of CRLF sequences ('CRLF injection')…8.6
• CVE-2026-12704When SAML IdP-initiated login is enabled in Grafana Enterpri…6.8