← Back to the live CVE advisory feed

CVE-2026-112188: MISP

Severity

7.1 (HIGH)

Vendor

MISP

Affected versions

0 through before 2.5.48

Patch status

Unknown

Published

2026-10-19T10:16:47.413

Why it matters

This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Check whether the affected WordPress plugin or theme is installed.
• Update, disable, or remove the affected component if present.

Technical summary

MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys. A second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller. The impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints. Affected versions: <2.5.48.

View the official NVD record for CVE-2026-112188

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.