High · CVSS 8.4CVE-2026-90895

MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal InjectionCVE-2026-90895

Answer in brief

CVE-2026-90895 records a High severity (CVSS 8.4) vulnerability in MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection. The current sources do not mark it as known exploited. The current feed maps MISP/MISP (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 14, 2026Updated Sep 16, 2026Source checked Oct 29, 2026First seen by HOL Sep 14, 2026Material review Sep 16, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 8.4
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Available

Why this deserves its current priority

CVSS is 8.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps MISP/MISP (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
MISP/MISPgeneric	>=0 <2.5.46	2.5.46

Recommended response

Check inventory. Check lockfiles and deployed manifests for MISP/MISP.
Review the reported fix. Source-reported solution: The fix replaces the shell's hand-rolled authorization logic with the same model-level accessors used by the web interface (Event::fetchSimpleEvent, MispAttribute::fetchAttributes, MispObject::fetchObjects, SharingGroup::checkIfAuthorised, Organisation::canSee), ensuring read and write operations enforce identical ACL rules. Credential columns are excluded at the query level via a hiddenFields mechanism so they are never fetched from the database. The inline detail editor now delegates to the entity-specific edit handlers, which enforce per-record write authorization. All terminal output passes through a sanitiser that neutralises C0/C1 control characters, ANSI escape sequences, and Unicode bidirectional overrides. Pagination is clamped to a safe range (1-1000) to prevent unbounded result sets.

Evidence timeline and material changes

Published upstream
Sep 14, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 14, 2026

Sources and claim methodology

GitHub security advisorygithub.com

Upstream source description

Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. The patch shows that CLI access could differ from the web application in multiple security-sensitive areas: - feed listings did not enforce the same lookup_visible restrictions for non-host-organisation users; - feed detail access did not enforce the same host-organisation/site-admin authorization as FeedsController::view(); - Feed.headers, which can contain HTTP authorization credentials, could be exposed instead of being hidden or masked; - server synchronization authkey values were not explicitly hidden from CLI detail output; - sharing-group detail access did not consistently use SharingGroup::checkIfAuthorised(); - the use command could establish context for a record without first proving that the user was authorized to view that record The commit additionally hardens pagination and terminal rendering, including neutralization of terminal control sequences found in database-backed values. Those are important hardening changes, but the main vulnerability is the CLI authorization/data-disclosure mismatch. Version affected: ≤2.5.45

Quoted source text, attributed separately from HOL analysis.

Package

Affected range

Fixed version

MISP/MISPgeneric

>=0 <2.5.46

2.5.46

Recommended response

Check inventory. Check lockfiles and deployed manifests for MISP/MISP.

Review the reported fix. Source-reported solution: The fix replaces the shell's hand-rolled authorization logic with the same model-level accessors used by the web interface (Event::fetchSimpleEvent, MispAttribute::fetchAttributes, MispObject::fetchObjects, SharingGroup::checkIfAuthorised, Organisation::canSee), ensuring read and write operations enforce identical ACL rules. Credential columns are excluded at the query level via a hiddenFields mechanism so they are never fetched from the database. The inline detail editor now delegates to the entity-specific edit handlers, which enforce per-record write authorization. All terminal output passes through a sanitiser that neutralises C0/C1 control characters, ANSI escape sequences, and Unicode bidirectional overrides. Pagination is clamped to a safe range (1-1000) to prevent unbounded result sets.

Sources and claim methodology

Upstream source description

Quoted source text, attributed separately from HOL analysis.

MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal InjectionCVE-2026-90895

Key facts

Why this deserves its current priority

Affected scope and exposure questions

Recommended response

Evidence timeline and material changes

Sources and claim methodology

Related CVEs

MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal InjectionCVE-2026-90895

Key facts

Why this deserves its current priority

Affected scope and exposure questions

Recommended response

Evidence timeline and material changes

Sources and claim methodology

Related CVEs