CVE-2026-54357: MISP improper authorization allows organization administrators to modify site administrator user settings
An improper authorization vulnerability in MISP allowed an authenticated organization administrator to access or modify user settings belonging to site administrator accounts within the same organization. The affected access-control checks scoped administrative actions by organization membership but did not exclude higher-privileged site administrator users. As a result, an organization administrator could potentially view or alter site administrator user settings and related login profile information, crossing the intended privilege boundary between organization administration and site-wide administration.
The patch hardens the ACL logic by excluding site administrator accounts from organization administrator–managed user sets, adding explicit authorization failure when a target user is not administrable, and ensuring user setting and login profile operations fail closed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Temporarily revoke or restrict organization-administrator privileges for any accounts that do not strictly require them until a vendor patch/fix is available and applied.
- Compensating control
Restrict access to the user-management and administration interfaces (where organization administrators can manage users) to trusted admin IP ranges or networks via firewall, ACLs, or WAF to reduce the risk of misuse.
- Operational
Audit recent changes and access to site-administrator user settings and login profiles. If any unauthorized view or modification is detected or suspected, restore affected settings from backups where available and force password resets/rotate credentials and API tokens for impacted site-administrator accounts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54357?
CVE-2026-54357 has a medium severity rating of 5.1 based on the CVSS score.
How do I fix CVE-2026-54357?
To fix CVE-2026-54357, ensure proper authorization checks are implemented in the MISP application for user settings modifications.
What impact does CVE-2026-54357 have on MISP?
CVE-2026-54357 can allow an authenticated organization administrator to improperly modify settings of site administrator accounts, leading to unauthorized access.
What requires mitigation for CVE-2026-54357?
Mitigation for CVE-2026-54357 involves enforcing stricter access controls for administrative actions based on user roles.
Who is affected by CVE-2026-54357?
CVE-2026-54357 affects organizations using MISP where organization administrators can access user settings beyond their intended permissions.