MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.
The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys.
A second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller.
The impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints.
Affected versions: <2.5.48.
"}],"value":"MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.\n\nThe settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys.\n\nA second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller.\n\nThe impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints.\n\nAffected versions: <2.5.48."}],"impacts":[{"capecId":"CAPEC-124","descriptions":[{"lang":"en","value":"CAPEC-124 Parameter Tampering"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":7.1,"baseSeverity":"HIGH","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"SSVC","other":{"content":{"options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"Supplier","timestamp":"2026-10-19T09:21:00Z","version":"2.0.3"},"type":"SSVC"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-285","description":"CWE-285 Improper Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-19T09:22:37.880Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/MISP/MISP/commit/30b849102"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The settings lookup function now validates that the resolved node is a leaf setting (has a 'level' property and is not an array representing a branch). If the resolved node is a branch or otherwise does not represent a single setting, the function returns false, indicating an invalid setting. This prevents the redaction check from being bypassed and stops the endpoints from returning entire configuration branches containing sensitive values.
"}],"value":"The settings lookup function now validates that the resolved node is a leaf setting (has a 'level' property and is not an array representing a branch). If the resolved node is a branch or otherwise does not represent a single setting, the function returns false, indicating an invalid setting. This prevents the redaction check from being bypassed and stops the endpoints from returning entire configuration branches containing sensitive values."}],"title":"MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"full","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The exact privilege level required to access the server settings endpoints (admin vs. any authenticated user) is not stated in the patch; PR:L is assumed as the most conservative defensible value.","The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48 with 11 commits after fix); the exact last affected version and first fixed version are not explicitly confirmed.","CAPEC-124 (Parameter Tampering) is the closest available attack pattern; no CAPEC specifically models configuration-tree branch traversal, so the mapping is approximate.","The patch does not indicate whether unauthenticated access is possible; authentication is assumed based on the nature of server settings endpoints in MISP.","The Co-Authored-By line references an AI tool (Claude Opus 5); it is listed as a tool credit rather than a human remediation developer."],"capecRationale":[{"capecId":"CAPEC-124","rationale":"The attacker manipulates the setting name parameter supplied to the settings lookup endpoint, substituting a branch name (e.g., 'Security') for a leaf setting name. This causes the application to return a broader data set than intended. CAPEC-124 is the closest match because the core technique is altering a request parameter to change the application's response scope. The mapping is approximate because the parameter is not a traditional HTTP parameter but an application-level setting identifier; no CAPEC specifically covers configuration-tree traversal."}],"commit":"30b849102c687bb53919f1d5d20851bc20fafa4e","confidence":"medium","credits":[{"lang":"en","type":"reporter","value":"Jeroen Pinoy"},{"lang":"en","type":"remediation developer","value":"iglocska"},{"lang":"en","type":"remediation developer","value":"Claude Opus 5"}],"cvssRationale":"AV:N: MISP is a network-accessible web application. AC:L: The attack requires only substituting a branch name for a leaf setting name in an existing API call; no race conditions or complex timing are needed. AT:N: No manipulation of the target environment is required. PR:L: The attacker needs an authenticated account with access to the server settings endpoints; the exact privilege level (admin vs. regular user) is not confirmed in the patch, so Low is assumed. UI:N: No victim interaction is required. VC:H: Sensitive secrets (security salt, Redis passwords, plugin API keys) are fully disclosed. VI:N, VA:N: No integrity or availability impact is evidenced. SC:N, SI:N, SA:N: No impact on subsequent components is indicated.","fixSummary":"The settings lookup function now validates that the resolved node is a leaf setting (has a 'level' property and is not an array representing a branch). If the resolved node is a branch or otherwise does not represent a single setting, the function returns false, indicating an invalid setting. This prevents the redaction check from being bypassed and stops the endpoints from returning entire configuration branches containing sensitive values.","generatedAt":"2026-10-19T09:21:00.388917Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":11,"assumptionCount":5,"confidence":"medium","model":"qwen3.8:27b","score":7}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"70885748c270bb21036c46d9142ef00525834a5c03669c4c4a856d7db6ef58e2","patchSummary":"In app/Model/Server.php, the getSettingData() method previously checked only for the presence of a 'level' key before returning the setting. The patch adds a guard clause: if the resolved setting is an array (i.e., a branch/sub-tree) or lacks the 'level' key, the function immediately returns false. The existing logic for setting the name and resolving options is then applied only to confirmed leaf settings. This ensures callers that assumed a single-setting result never receive a multi-key branch.","patchTruncated":false,"patches":[{"commit":"30b849102c687bb53919f1d5d20851bc20fafa4e","date":"Mon, 28 Sep 2026 12:03:56 +0200","patchSha256":"70885748c270bb21036c46d9142ef00525834a5c03669c4c4a856d7db6ef58e2","source":"https://github.com/MISP/MISP/commit/30b849102.patch","sourceUrl":"https://github.com/MISP/MISP/commit/30b849102.patch","subject":"fix: [settings] Server setting lookups address one setting,"}],"source":"https://github.com/MISP/MISP/commit/30b849102.patch","ssvc":{"options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"Supplier","timestamp":"2026-10-19T09:21:00Z","version":"2.0.3"},"subject":"fix: [settings] Server setting lookups address one setting,","tagVersionBoundary":{"commits_after_fix":11,"repository":"https://github.com/MISP/MISP","tag":"v2.5.48","version":"2.5.48","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-200","rationale":"The settings endpoint returned sensitive configuration values (security salt, Redis passwords, plugin API keys) to a caller who requested a branch name, bypassing the intended redaction mechanism. The data was exposed to an actor who should not have had access to those specific values."},{"cweId":"CWE-285","rationale":"The redaction check, which serves as an authorization control for sensitive setting values, was effectively bypassed because branch nodes do not carry a redacted flag. The system failed to enforce the intended access restriction on sensitive configuration data."}]}},"bcp-05-x-03":{"x_timeline":{"events":[{"description":"Corrective change authored (30b849102c687bb53919f1d5d20851bc20fafa4e): fix: [settings] Server setting lookups address one setting,","id":"evt-fix-developed-1","references":["https://github.com/MISP/MISP/commit/30b849102.patch"],"timestamp":"2026-09-28T10:03:56Z","type":"fix-developed"}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20327"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-112188","datePublished":"2026-10-19T09:22:37.880Z","dateReserved":"2026-10-19T09:22:31.139Z","dateUpdated":"2026-10-19T09:22:37.880Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-19 10:16:47","lastModifiedDate":"2026-10-19 10:16:47","problem_types":["CWE-200","CWE-285","CWE-200 CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","CWE-285 CWE-285 Improper Authorization"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","ssvcData":{"timestamp":"2026-10-19T09:21:00Z","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"Supplier","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"112188","Ordinal":"1","Title":"MISP Server Settings Lookup Exposes Sensitive Configuration Data","CVE":"CVE-2026-112188","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"112188","Ordinal":"1","NoteData":"MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.\n\nThe settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys.\n\nA second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller.\n\nThe impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints.\n\nAffected versions: <2.5.48.","Type":"Description","Title":"MISP Server Settings Lookup Exposes Sensitive Configuration Data"}]}}}