CVE-2026-90895: MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection
Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies.
The patch shows that CLI access could differ from the web application in multiple security-sensitive areas:
- feed listings did not enforce the same lookupvisible restrictions for non-host-organisation users; - feed detail access did not enforce the same host-organisation/site-admin authorization as FeedsController::view(); - Feed.headers, which can contain HTTP authorization credentials, could be exposed instead of being hidden or masked; - server synchronization authkey values were not explicitly hidden from CLI detail output; - sharing-group detail access did not consistently use SharingGroup::checkIfAuthorised(); - the use command could establish context for a record without first proving that the user was authorized to view that record
The commit additionally hardens pagination and terminal rendering, including neutralization of terminal control sequences found in database-backed values. Those are important hardening changes, but the main vulnerability is the CLI authorization/data-disclosure mismatch.
Version affected: ≤2.5.45
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISP interactive CLI shellto a version that resolves this vulnerability.Fixed in ≤2.5.45Patch Authorization Bypass, Credential Exposure, and Terminal Injection - Configuration
Ensure the CLI query uses a hiddenFields mechanism that excludes credential-bearing columns (e.g., Feed.headers and any other authorization-credential columns) so they are not fetched and therefore cannot be exposed in CLI output.
MISP interactive CLI shell hiddenFields (credential columns) = exclude Feed.headers and other credential-bearing fields at query level so they are never fetched from the database - Configuration
Keep/enable the sanitiser on all terminal output so database-backed values cannot inject terminal control sequences or influence rendering via ANSI/bidirectional override characters.
MISP interactive CLI shell terminal output sanitization = neutralize C0/C1 control characters, ANSI escape sequences, and Unicode bidirectional overrides - Configuration
Enforce pagination clamping to a safe range (1-1000) to prevent unbounded result sets and to harden pagination handling.
MISP interactive CLI shell pagination clamping = 1-1000 - Configuration
Remove/replace the shell’s hand-rolled authorization logic and delegate read/write checks to the same model-level accessors used by the web app (e.g., Event::fetchSimpleEvent, MispAttribute::fetchAttributes, MispObject::fetchObjects, SharingGroup::checkIfAuthorised, Organisation::canSee) so CLI and web enforce identical ACL rules.
MISP interactive CLI shell authorization layer access-control logic = use the same model-level accessors as the web application - Configuration
Ensure the inline detail editor delegates to the entity-specific edit handlers that enforce per-record write authorization (instead of using independent CLI authorization paths).
MISP interactive CLI shell inline detail editor detail editor authorization delegation = delegate to entity-specific edit handlers
Event History
Frequently Asked Questions
Which users could see data that the web application would restrict?
Non-host-organisation users were specifically affected by feed-listing visibility differences. CLI feed-detail access also did not apply the same host-organisation or site-admin authorization as the web controller.
What sensitive information could be exposed through CLI output?
Feed.headers could be displayed without being hidden or masked, including HTTP authorization credentials. Server synchronization authkey values were also not explicitly hidden in CLI detail output.
Are sharing groups and record context selection affected?
Sharing-group detail access did not consistently use SharingGroup::checkIfAuthorised(). The use command could also establish context for a record before proving that the user was authorized to view it.
Does the update address risks beyond authorization and disclosure?
The patch also neutralizes terminal control sequences in database-backed values and hardens pagination and terminal rendering. These are hardening changes; the primary issue is the CLI authorization and data-disclosure mismatch.