CVE-2026-107180

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.48

Description Instances configured to require TOTP enrolment via Security.otp required only enforced mandatory two-factor authentication for standard browser requests. Authenticated users who had not enrolled in TOTP could bypass this requirement by using non-browser request types, such as AJAX/XHR calls, REST API requests, .json format URLs, restSearch queries, or automation actions. This occurs because machine-readable requests cannot follow the redirect to the TOTP enrolment page, allowing the user to maintain full access to the instance without completing the second-factor setup.

Recommendations Update to version 2.5.48 or later.