CVE-2026-94381

MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user’s normal account permissions. This means someone with a read-only API key could potentially gain write, delete, or even administrator access if their underlying account has those permissions. Exploiting the issue requires a valid read-only API key and a single request to the affected function. The main impact is that MISP’s API key restrictions can be bypassed, allowing actions that the API key was specifically meant to prevent. Version affected: <2.5.47

• CWE-269

• https://github.com/MISP/MISP/commit/fd27e592a

Published

Sep 21, 2026

Last Modified

Sep 21, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9437A vulnerability has been found in DTStack Taier 1.4.0. This …6.3
• CVE-2026-94372MISP contains a stored cross-site scripting (XSS) vulnerabil…6.3
• CVE-2026-94373MISP contains a DOM-based cross-site scripting (XSS) vulnera…6.3
• CVE-2026-94374MISP contains an insecure direct object reference vulnerabil…8.3
• CVE-2026-94379The login() function in MISP's UsersController.php contained…6.9
• CVE-2026-9438A vulnerability was found in yashpokharna2555 StudentManagem…5.4
• CVE-2026-94382Beszel before 0.19.0 contains an insecure direct object refe…4.2
• CVE-2026-94383The MISP blocklist workflow module accepted a user-supplied …8.6
• CVE-2026-94387Aureus ERP before 1.6.0 contains a stored cross-site scripti…5.4
• CVE-2026-9439A vulnerability was determined in Edimax BR-6675nD 1.12. Aff…6.3
• CVE-2026-94393When a user creates or edits a report inside an event, MISP …6.4
• CVE-2026-94394When a regular user adds a reference between objects or attr…6.3