Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging.
\nThe shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user.
Version affected: ≤2.5.45
The fix introduces a process-wide static identity (setShellUser) on SysLogLogableBehavior that is resolved at write time rather than at setup time, so it survives lazy model loads that re-run setup() on the singleton. The behavior appends 'via CLI' to the log description for shell-originated rows, mirroring the request_type = CLI marker in the new audit engine. The CLI shell now publishes the impersonated user through both Configure::write('CurrentUserId') and SysLogLogableBehavior::setShellUser() before any write. Explicit extralog calls were added for CLI user edit, disable, and delete operations so the default audit engine records them the same way the web path does. Background jobs that publish no user continue to log as SYSTEM without a CLI marker.
"}],"value":"The fix introduces a process-wide static identity (setShellUser) on SysLogLogableBehavior that is resolved at write time rather than at setup time, so it survives lazy model loads that re-run setup() on the singleton. The behavior appends 'via CLI' to the log description for shell-originated rows, mirroring the request_type = CLI marker in the new audit engine. The CLI shell now publishes the impersonated user through both Configure::write('CurrentUserId') and SysLogLogableBehavior::setShellUser() before any write. Explicit extralog calls were added for CLI user edit, disable, and delete operations so the default audit engine records them the same way the web path does. Background jobs that publish no user continue to log as SYSTEM without a CLI marker."}],"title":"MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"review","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The tag_version_boundary indicates the fix commit is 183 commits after tag v2.5.46, suggesting the fix landed in a version after 2.5.46; however, no explicit fixed version tag is provided, so the exact boundary is uncertain.","The affected version range is assumed to be all versions prior to the fix commit; the patch does not specify a minimum affected version.","CVSS PR:H assumes that CLI shell access is equivalent to site-admin-equivalent access, consistent with the project's own CLI_usage.md documentation stating that running cake requires reading database.php and that the shell should not be exposed to anyone who must not have site-admin-equivalent access.","The SI:L rating assumes the audit-log inaccuracy is a secondary integrity impact on the logging subsystem rather than a primary integrity impact on the MISP application data.","The patch does not include a CVE or GCVE identifier; this analysis is a draft for CNA/GNA review."],"commit":"d13e5db33faa8eb27c945d6561badc24f00b2cda","confidence":"medium","credits":[{"lang":"en","type":"reporter","value":"Scottish Government - National Cyber Team"},{"lang":"en","type":"remediation developer","value":"iglocska"},{"lang":"en","type":"remediation developer","value":"Claude Fable 5.1"}],"cvssRationale":"Attack vector is Local because the CLI shell requires direct access to the MISP host and the ability to run the cake console command. Attack complexity is Low because no race condition or special timing is needed; the identity loss occurs deterministically on the first lazy model load. No attack target is required. Privileges Required is High because running the CLI shell requires reading app/Config/database.php and passing a user ID, which the project documentation equates to site-admin-equivalent access. No user interaction is needed. There is no direct confidentiality, integrity, or availability impact on the MISP application itself. The secondary integrity impact is Low: the audit log data is inaccurate (wrong user attribution, missing CLI marker, missing user-management entries), which degrades forensic and compliance capability but does not corrupt application data. No secondary availability impact.","draft":false,"fixSummary":"The fix introduces a process-wide static identity (setShellUser) on SysLogLogableBehavior that is resolved at write time rather than at setup time, so it survives lazy model loads that re-run setup() on the singleton. The behavior appends 'via CLI' to the log description for shell-originated rows, mirroring the request_type = CLI marker in the new audit engine. The CLI shell now publishes the impersonated user through both Configure::write('CurrentUserId') and SysLogLogableBehavior::setShellUser() before any write. Explicit extralog calls were added for CLI user edit, disable, and delete operations so the default audit engine records them the same way the web path does. Background jobs that publish no user continue to log as SYSTEM without a CLI marker.","generatedAt":"2026-09-14T12:23:30.990762Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":9,"assumptionCount":5,"confidence":"medium","model":"qwen3.8:27b","score":5}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"8ea0cae590f0d9a3a2fa579b800f69fb5f5f8c9083de74df05945869dd3e91bf","patchSummary":"In cli_common.php, __setUserContext() was replaced: instead of iterating loaded models and setting the user on each SysLogLogable behavior instance, it now calls Configure::write('CurrentUserId', $user['id']) and SysLogLogableBehavior::setShellUser($user). In SysLogLogableBehavior.php, a private static $shellUser property and setShellUser() static method were added; _saveLog() now resolves the actor via shellActor() at write time when CAKEPHP_SHELL is defined, and appends ' via CLI' to the description. setup() was refactored to use the same shellActor() helper. In cli_users.php, __logUserEdit() was added to write an extralog row for user edits and disables, and __deleteUser() now calls extralog for permanent deletions. A new test file SysLogLogableShellIdentityTest.php (395 lines) covers identity persistence across lazy model attaches, CLI marker presence/absence, SYSTEM fallback, and web-request isolation. CLI_usage.md documents the audit-trail behavior.","patchTruncated":false,"patches":[{"commit":"d13e5db33faa8eb27c945d6561badc24f00b2cda","patchSha256":"8ea0cae590f0d9a3a2fa579b800f69fb5f5f8c9083de74df05945869dd3e91bf","source":"https://github.com/MISP/MISP/commit/d13e5db33.patch","sourceUrl":"https://github.com/MISP/MISP/commit/d13e5db33.patch","subject":"fix: [cli] Attribute interactive CLI shell writes stably and"}],"source":"https://github.com/MISP/MISP/commit/d13e5db33.patch","subject":"fix: [cli] Attribute interactive CLI shell writes stably and","tagVersionBoundary":{"commits_after_fix":183,"repository":"https://github.com/MISP/MISP","tag":"v2.5.46","version":"2.5.46","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-778","rationale":"The CLI shell's audit rows lost the impersonated user identity after the first lazy model load (reset to SYSTEM), and user-management operations (edit, disable, delete) performed via CLI produced no audit row at all in the default engine. Both are failures to record security-relevant events with sufficient detail."},{"cweId":"CWE-223","rationale":"Audit rows written by the CLI shell carried no marker distinguishing them from web-originated actions. In the default engine the description lacked 'via CLI'; in the new engine request_type was not set to CLI. This omission prevents an investigator from determining the true origin of an action."}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20197"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-90955","datePublished":"2026-09-14T12:37:54.001Z","dateReserved":"2026-09-14T12:37:52.348Z","dateUpdated":"2026-09-14T13:00:29.069Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-14 13:19:32","lastModifiedDate":"2026-09-14 13:19:32","problem_types":["CWE-223","CWE-778","CWE-778 CWE-778 Insufficient Logging","CWE-223 CWE-223 Omission of Security-relevant Information in Log Data"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-14T12:55:46.663079Z","id":"CVE-2026-90955","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"90955","Ordinal":"1","Title":"MISP CLI Shell Audit Logs Lose User Identity and CLI Marker Afte","CVE":"CVE-2026-90955","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"90955","Ordinal":"1","NoteData":"Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging.\n\n\nThe shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user.\n\n\n\nVersion affected: ≤2.5.45","Type":"Description","Title":"MISP CLI Shell Audit Logs Lose User Identity and CLI Marker Afte"}]}}}