CVE-2026-90895

MISP versions through 2.5.45 implement access control in the interactive CLI shell separately from the web application, and the two paths diverge in several security-sensitive areas. A local attacker who already has legitimate, low-privileged CLI access (for example, a non-host-organisation MISP user with shell access to the server) can list and view feeds, sharing groups, and servers they are not authorized to see, and can establish CLI context on records without proving view permission. The exposed data can include Feed.headers containing HTTP authorization credentials and server synchronization authkeys, which could enable follow-on attacks against connected feed sources or syncing MISP instances. Any organization running MISP 2.5.45 or earlier where users other than site admins or host-organisation staff can reach the CLI shell is affected. No public proof of concept exists, the flaw is not in the CISA KEV catalog, and it is not known to be exploited in the wild.

What to do: Upgrade MISP to the latest release, which is newer than the affected 2.5.45, so that CLI commands enforce the same authorization as the web application. Until then, restrict interactive CLI shell access to site-admin and host-organisation users only. Rotate feed HTTP authorization credentials and server synchronization authkeys that were previously viewable via CLI output, and review CLI audit logs for unauthorized listing or viewing of feeds, sharing groups, or servers.