https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 20:53:49 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-94381 <p>MISP has a security issue that can let a user gain more access than their API key is supposed to allow.</p> <p>A read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user’s normal account permissions. This means someone with a read-only API key could potentially gain write, delete, or even administrator access if their underlying account has those permissions.</p> <p>Exploiting the issue requires a valid read-only API key and a single request to the affected function.</p> <p>The main impact is that MISP’s API key restrictions can be bypassed, allowing actions that the API key was specifically meant to prevent.</p> <p>Version affected: &lt;2.5.47</p> <p>MISP has a security issue that can let a user gain more access than their API key is supposed to allow.</p> <p>A read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user’s normal account permissions. This means someone with a read-only API key could potentially gain write, delete, or even administrator access if their underlying account has those permissions.</p> <p>Exploiting the issue requires a valid read-only API key and a single request to the affected function.</p> <p>The main impact is that MISP’s API key restrictions can be bypassed, allowing actions that the API key was specifically meant to prevent.</p> <p>Version affected: &lt;2.5.47</p> https://db.gcve.eu/vuln/fkie_cve-2026-94381 https://db.gcve.eu/vuln/gcve-1-2026-20048 <p><strong>Affected:</strong> MISP</p> <p>MISP has a security issue that can let a user gain more access than their API key is supposed to allow.</p> <p>A read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user’s normal account permissions. This means someone with a read-only API key could potentially gain write, delete, or even administrator access if their underlying account has those permissions.</p> <p>Exploiting the issue requires a valid read-only API key and a single request to the affected function.</p> <p>The main impact is that MISP’s API key restrictions can be bypassed, allowing actions that the API key was specifically meant to prevent.</p> <p>Version affected: &lt;2.5.47</p> <p><strong>Affected:</strong> MISP</p> <p>MISP has a security issue that can let a user gain more access than their API key is supposed to allow.</p> <p>A read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user’s normal account permissions. This means someone with a read-only API key could potentially gain write, delete, or even administrator access if their underlying account has those permissions.</p> <p>Exploiting the issue requires a valid read-only API key and a single request to the affected function.</p> <p>The main impact is that MISP’s API key restrictions can be bypassed, allowing actions that the API key was specifically meant to prevent.</p> <p>Version affected: &lt;2.5.47</p> https://db.gcve.eu/vuln/gcve-1-2026-20048 https://db.gcve.eu/vuln/ghsa-mw89-3hh7-vfpg <p>MISP has a security issue that can let a user gain more access than their API key is supposed to allow.</p> <p>A read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user’s normal account permissions. This means someone with a read-only API key could potentially gain write, delete, or even administrator access if their underlying account has those permissions.</p> <p>Exploiting the issue requires a valid read-only API key and a single request to the affected function.</p> <p>The main impact is that MISP’s API key restrictions can be bypassed, allowing actions that the API key was specifically meant to prevent.</p> <p>Version affected: &lt;2.5.47</p> <p>MISP has a security issue that can let a user gain more access than their API key is supposed to allow.</p> <p>A read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user’s normal account permissions. This means someone with a read-only API key could potentially gain write, delete, or even administrator access if their underlying account has those permissions.</p> <p>Exploiting the issue requires a valid read-only API key and a single request to the affected function.</p> <p>The main impact is that MISP’s API key restrictions can be bypassed, allowing actions that the API key was specifically meant to prevent.</p> <p>Version affected: &lt;2.5.47</p> https://db.gcve.eu/vuln/ghsa-mw89-3hh7-vfpg