MISP Modules Website: Missing Authorization on External Tool Management Endpoints
Summary
| CVE | CVE-2026-127016 |
|---|---|
| State | PUBLISHED |
| Assigner | CIRCL |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-12 10:17:28 UTC |
| Updated | 2026-11-12 10:17:29 UTC |
| Description | The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application environment, the module configuration endpoints correctly required an authenticated administrator session, but the external tools management handlers processed requests from anonymous users without any authorization check. An unauthenticated attacker with network access to the website could add arbitrary external tools, delete existing tools, toggle their active status, and modify their configurations including API keys and ingestion URLs. This inconsistency allowed bypass of the intended access control for the external tools management functionality. The vulnerability is conditional on ADMIN_PASSWORD being set; installations without an admin password intentionally permit open management access by design. The affected component is the external_tools Flask blueprint within the MISP Modules website application. |
Risk And Classification
Primary CVSS: v4.0 9.2 CRITICAL from 5a6e4751-2f3f-4070-9419-94fb35b644e8
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-862 | CWE-862 CWE-862 Missing Authorization
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 5a6e4751-2f3f-4070-9419-94fb35b644e8 | Secondary | 9.2 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:H/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 9.2 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:H/SA:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Misp | Misp-modules | affected 3.1.4 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70... | 5a6e4751-2f3f-4070-9419-94fb35b644e8 | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Alexandre Dulaunoy (en)
Additional Advisory Data
Solutions
CNA: A before_request authorization handler is added to the external_tools blueprint that checks whether the admin user is active (ADMIN_PASSWORD configured) and whether the current user is authenticated before any management endpoint executes. When both conditions indicate an unauthenticated request to a protected endpoint, the handler redirects to the login page (for the add endpoint) or returns a 403 Permission Denied response (for delete, status, and configuration endpoints). This enforces the same optional-admin policy already applied to module configuration, while preserving the existing open-management behavior when no admin password is configured.