MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata.
As a result:
- A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings.
- A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction.
An authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access.
Affected: <2.5.48
"}],"value":"MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata.\n\nAs a result:\n\n- A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings.\n\n- A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction.\n\nAn authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access.\n\nAffected: <2.5.48"}],"impacts":[{"capecId":"CAPEC-126","descriptions":[{"lang":"en","value":"CAPEC-126 Sensitive Data Discovery"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.3,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"SSVC","other":{"content":{"options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"Supplier","timestamp":"2026-10-19T09:23:47Z","version":"2.0.3"},"type":"SSVC"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-19T09:28:08.054Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/MISP/MISP/commit/6c02f0f5c"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The fix ensures that the redacted and cli_only flags declared by a module in its own setting definition are preserved when the server rebuilds the setting for API exposure. By carrying these flags through to the final setting object, the existing enforcement logic (which checks these flags before serving values or accepting edits) now correctly applies to module-supplied settings, preventing disclosure of redacted values and blocking API-based modification of CLI-only settings.
"}],"value":"The fix ensures that the redacted and cli_only flags declared by a module in its own setting definition are preserved when the server rebuilds the setting for API exposure. By carrying these flags through to the final setting object, the existing enforcement logic (which checks these flags before serving values or accepting edits) now correctly applies to module-supplied settings, preventing disclosure of redacted values and blocking API-based modification of CLI-only settings."}],"title":"MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"full","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The affected version boundary is inferred from the tag_version_boundary metadata (fix is 10 commits after v2.5.48); the exact fixed release version is not stated in the patch metadata.","PR:L assumes that reading server settings requires an authenticated MISP user with appropriate role permissions; the patch does not specify the exact permission level required.","The CAPEC-126 mapping is the closest available pattern for the information-disclosure aspect; the authorization-bypass aspect (cli_only) does not have a precise CAPEC match and is subsumed under the same mapping.","VC:L assumes the exposed data is limited to module-specific API keys rather than system-wide credentials; the actual sensitivity depends on which modules are installed.","The commit message references a separate issue (branch read) reported by Jeroen Pinoy; this vulnerability was discovered as a side effect of fixing that issue, so Jeroen Pinoy is not credited as a finder of this specific vulnerability."],"capecRationale":[{"capecId":"CAPEC-126","rationale":"The primary impact is that sensitive data (module API keys marked as redacted) is discoverable via standard API endpoints because the redaction flag was not enforced. An authenticated user querying server settings can obtain credentials that the module author intended to keep hidden. This is the closest CAPEC to the information-disclosure aspect of the vulnerability. The secondary aspect (CLI-only settings editable via API) is an authorization bypass that does not map cleanly to a single CAPEC; CAPEC-126 is selected as the best available match for the overall pattern of accessing data that should be restricted."}],"commit":"6c02f0f5c33aab96e90df8791c3873303d7e99ce","confidence":"medium","credits":[{"lang":"en","type":"remediation developer","value":"iglocska"},{"lang":"en","type":"remediation developer","value":"Claude Opus 5"}],"cvssRationale":"AV:N: MISP is a web application accessible over the network. AC:L: No special race conditions or complex setup are needed; a standard API call to the settings endpoint triggers the issue. AT:N: No manipulation of the attack target is required. PR:L: The attacker needs an authenticated MISP account with permission to view server settings. UI:N: No user interaction is required. VC:L: Sensitive module API keys are exposed, but the scope is limited to settings of modules that declare the redacted flag. VI:N: No direct integrity impact on the vulnerable component's data beyond the VA impact. VA:L: CLI-only settings can be modified via the API, representing a limited integrity impact on the vulnerable component's configuration. SC/SI/SA:N: No evidence of impact on other components or systems.","fixSummary":"The fix ensures that the redacted and cli_only flags declared by a module in its own setting definition are preserved when the server rebuilds the setting for API exposure. By carrying these flags through to the final setting object, the existing enforcement logic (which checks these flags before serving values or accepting edits) now correctly applies to module-supplied settings, preventing disclosure of redacted values and blocking API-based modification of CLI-only settings.","generatedAt":"2026-10-19T09:23:47.526920Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":11,"assumptionCount":5,"confidence":"medium","model":"qwen3.8:27b","score":7}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"e7e99bab776b221dd41bf562693fc308d8a2ee619806b1bfef26bb008212205a","patchSummary":"In app/Model/Server.php, within the readModuleSettings() method, a loop was added after the setting fields are populated that iterates over the strings 'redacted' and 'cli_only'. For each flag, if the module's own result array contains a truthy value for that key, the flag is set to true on the rebuilt $setting object before it is stored in $serverSettings. This is a 6-line addition that preserves the module-declared guard flags that were previously discarded during the setting reconstruction.","patchTruncated":false,"patches":[{"commit":"6c02f0f5c33aab96e90df8791c3873303d7e99ce","date":"Mon, 28 Sep 2026 12:14:28 +0200","patchSha256":"e7e99bab776b221dd41bf562693fc308d8a2ee619806b1bfef26bb008212205a","source":"https://github.com/MISP/MISP/commit/6c02f0f5c.patch","sourceUrl":"https://github.com/MISP/MISP/commit/6c02f0f5c.patch","subject":"fix: [settings] Module settings keep the flags the module"}],"source":"https://github.com/MISP/MISP/commit/6c02f0f5c.patch","ssvc":{"options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"Supplier","timestamp":"2026-10-19T09:23:47Z","version":"2.0.3"},"subject":"fix: [settings] Module settings keep the flags the module","tagVersionBoundary":{"commits_after_fix":10,"repository":"https://github.com/MISP/MISP","tag":"v2.5.48","version":"2.5.48","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-200","rationale":"The redacted flag, which instructs the server to mask a setting's value (e.g., an API key), was dropped during setting reconstruction. This caused the sensitive value to be served in plaintext via API endpoints to any authenticated user, constituting an information exposure."},{"cweId":"CWE-862","rationale":"The cli_only flag, which restricts a setting to command-line modification only, was dropped during setting reconstruction. This allowed the setting to be modified via the web API without the intended authorization restriction, effectively bypassing the access control the module author specified."}]}},"bcp-05-x-03":{"x_timeline":{"events":[{"description":"Corrective change authored (6c02f0f5c33aab96e90df8791c3873303d7e99ce): fix: [settings] Module settings keep the flags the module","id":"evt-fix-developed-1","references":["https://github.com/MISP/MISP/commit/6c02f0f5c.patch"],"timestamp":"2026-09-28T10:14:28Z","type":"fix-developed"}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20310"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-112192","datePublished":"2026-10-19T09:28:08.054Z","dateReserved":"2026-10-19T09:28:06.573Z","dateUpdated":"2026-10-19T09:28:08.054Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-19 10:16:47","lastModifiedDate":"2026-10-19 10:16:47","problem_types":["CWE-200","CWE-862","CWE-200 CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","CWE-862 CWE-862 Missing Authorization"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","ssvcData":{"timestamp":"2026-10-19T09:23:47Z","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"Supplier","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"112192","Ordinal":"1","Title":"MISP Module Settings Expose Redacted Values and Allow API Modifi","CVE":"CVE-2026-112192","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"112192","Ordinal":"1","NoteData":"MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata.\n\nAs a result:\n\n- A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings.\n\n- A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction.\n\nAn authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access.\n\nAffected: <2.5.48","Type":"Description","Title":"MISP Module Settings Expose Redacted Values and Allow API Modifi"}]}}}