CVE-2026-54357 Details

A vulnerability exists in MISP that allows authenticated organization administrators to access or modify user settings of site administrators within the same organization. The issue arises because the access control checks for administrative actions by organization membership do not exclude site administrators, who have higher privileges. Consequently, an organization administrator could potentially view or change site administrator user settings and related login profile information, violating the intended separation of privileges between organization and site-wide administration.

Users can update to MISP version 2.5.40, which includes a patch that strengthens the access control logic by excluding site administrator accounts from the user sets managed by organization administrators. The update also ensures that any unauthorized attempts to access or modify site administrator settings are explicitly denied.