CVE-2026-90955

Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user. Version affected: ≤2.5.45

CVSS

No CVSS.

References

Link	Resource
https://github.com/MISP/MISP/commit/d13e5db33

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-14 13:19

Updated : 2026-09-16 13:42

NVD link : CVE-2026-90955

Mitre link : CVE-2026-90955

CVE.ORG link : CVE-2026-90955

JSON object : View

Products Affected

No product.

CWE

CWE-223

Omission of Security-relevant Information

CWE-778

Insufficient Logging

{"id": "CVE-2026-90955", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-90955", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-14T12:55:46.663079Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.6, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "affectedData": [{"repo": "https://github.com/MISP/MISP", "vendor": "MISP", "modules": ["CLIShell (app/Console/Command/CLIShell)", "SysLogLogableBehavior (app/Plugin/SysLogLogable/Model/Behavior)"], "product": "MISP", "versions": [{"status": "affected", "version": "0", "lessThan": "2.5.46", "versionType": "semver"}], "programFiles": ["app/Console/Command/CLIShell.php", "app/Console/Command/CLIShell/cli_common.php", "app/Console/Command/CLIShell/cli_users.php", "app/Plugin/SysLogLogable/Model/Behavior/SysLogLogableBehavior.php"]}]}], "published": "2026-09-14T13:19:32.583", "references": [{"url": "https://github.com/MISP/MISP/commit/d13e5db33", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "description": [{"lang": "en", "value": "CWE-223"}, {"lang": "en", "value": "CWE-778"}]}], "descriptions": [{"lang": "en", "value": "Affected versions of MISP\u2019s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging.\n\n\nThe shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user.\n\n\n\nVersion affected: \u22642.5.45"}], "lastModified": "2026-09-16T13:42:47.777", "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}