CVE-2026-94381: MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime
MISP has a security issue that can let a user gain more access than their API key is supposed to allow.
A read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user’s normal account permissions. This means someone with a read-only API key could potentially gain write, delete, or even administrator access if their underlying account has those permissions.
Exploiting the issue requires a valid read-only API key and a single request to the affected function.
The main impact is that MISP’s API key restrictions can be bypassed, allowing actions that the API key was specifically meant to prevent.
Version affected: <2.5.47
Affected Software
Event History
Frequently Asked Questions
Who is exposed to the greatest impact?
Users whose underlying MISP accounts have write, delete, or administrator permissions are at greatest risk. A read-only API key associated with one of those accounts may regain the account's normal permissions.
What does an attacker need to exploit this issue?
The attacker needs a valid read-only API key and must send a single request to the affected function after logging in with that key. No unauthenticated exploitation is described.
Which versions are affected?
MISP versions earlier than 2.5.47 are affected.