Improper Access Control in MISP Threat Intelligence Platform

CVE-2026-44380

What is CVE-2026-44380?

MISP, an open-source threat intelligence sharing platform, contains an improper access control vulnerability in its authentication key reset functionality prior to version 2.5.37. This flaw permits an authenticated organization administrator to reset authentication keys for site administrator accounts within the same organization. Attackers with organization administrator privileges could exploit this vulnerability to obtain a newly generated authentication key for a higher-privileged site administrator, allowing potential privilege escalation and unauthorized access to sensitive information. The issue has been addressed in version 2.5.37.

References