PT-2026-117309

CVE-2026-112192

Published

2026-10-19

Updated

2026-10-19

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.48

Description An issue exists in the handling of module plugin settings where the server drops the redacted and cli only flags declared in a module's configuration metadata during the rebuild for API consumption. This allows an authenticated user with access to server settings to view sensitive credentials, such as API keys, via the 'servers/getSetting' and 'servers/serverSettingsEdit' endpoints. Additionally, settings intended to be modified only via the command-line interface can be altered through the web API, bypassing intended access restrictions.

Recommendations Update to version 2.5.48 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Iglocska

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-862: Missing Authorization