Access Control Flaw in MISP API Key Management

CVE-2026-94381

What is CVE-2026-94381?

MISP suffers from a significant access control vulnerability that allows users with a read-only API key to gain elevated permissions unexpectedly. This occurs when users log in with a read-only key, and a specific function inadvertently restores their normal account permissions. Thus, an attacker with a valid read-only API key could potentially execute actions such as writing or deleting data, or even obtaining administrator access, depending on their underlying account privileges. This vulnerability highlights critical weaknesses in MISP's API key management system, enabling unauthorized actions that defeat proper access controls.

References