CVE-2026-127016

Name of the Vulnerable Software and Affected Versions MISP Modules versions prior to 3.1.5

Description The MISP Modules website component contains an authorization flaw within the external tools Flask blueprint. When the ADMIN PASSWORD environment variable is configured, the application fails to enforce administrator authentication for external tool management endpoints. This allows an unauthenticated attacker with network access to add arbitrary external tools, delete existing ones, toggle their active status, and modify configurations, including API keys and ingestion URLs. This issue occurs because the external tools management handlers process requests from anonymous users without performing the required authorization checks, bypassing the intended access control.

Recommendations Update to version 3.1.5 or later. As a temporary mitigation, restrict network access to the MISP Modules website component to trusted administrators only.