CVE-2026-90955 Details
Description
Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user. Version affected: ≤2.5.45
A vulnerability exists in MISP's interactive command-line interface (CLI) shell, specifically in versions through 2.5.45. The issue arises because the shell does not consistently maintain the identity of the user being impersonated across audit logs. The CLI is intended to execute actions as a specified MISP user ID, but due to a flaw in the logging behavior, this user attribution can be lost. This problem occurs when another model lazily loads a shared behavior, overwriting the user identity. As a result, actions performed in the CLI may be incorrectly logged, making them resemble regular web activities of the user. Additionally, records generated from the CLI lack a proper CLI indicator, further obscuring their origin.
Users can update to MISP version 2.5.47 or later, where this issue has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MISP/MISP/commit/d13e5db33 | CIRCL | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-223 | Omission of Security-relevant Information | CIRCL |
| CWE-778 | Insufficient Logging | CIRCL |
Affected Products
| Product | Versions |
|---|---|
| MISP | <= 2.5.45 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | New CVE Received | CIRCL |
| Sep 14, 2026 | CVE Modified | CISA-ADP |