CVE-2026-112192 (GCVE-0-2026-112192)
Vulnerability from cvelistv5 – Published: 2026-10-19 09:28 – Updated: 2026-10-19 17:13
VLAI
EPSS
VEX
Title
MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings
Summary
MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata.
As a result:
- A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings.
- A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction.
An authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access.
Affected: <2.5.48
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
Supplier · CIRCL (v2.0.3)
Decision recorded 2026-10-19 09:23 UTC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:13 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/6c02f0f5c | patch |
Impacted products
GCVE extensions
AI-generated
Human-reviewed
Confidence: medium
Model
qwen3.8:27b
1 event
advisory
bcp-05-x-01bcp-05-x-02bcp-05-x-03
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-10-19 09:23 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/6c02f0f5c.patch
e7e99bab776b… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
6c02f0f5c33a
|
fix: [settings] Module settings keep the flags the module | e7e99bab776b… |
Fix summary
The fix ensures that the redacted and cli_only flags declared by a module in its own setting definition are preserved when the server rebuilds the setting for API exposure. By carrying these flags through to the final setting object, the existing enforcement logic (which checks these flags before serving values or accepting edits) now correctly applies to module-supplied settings, preventing disclosure of redacted values and blocking API-based modification of CLI-only settings.
Patch summary
In app/Model/Server.php, within the readModuleSettings() method, a loop was added after the setting fields are populated that iterates over the strings 'redacted' and 'cli_only'. For each flag, if the module's own result array contains a truthy value for that key, the flag is set to true on the rebuilt $setting object before it is stored in $serverSettings. This is a 6-line addition that preserves the module-declared guard flags that were previously discarded during the setting reconstruction.
CVSS rationale
AV:N: MISP is a web application accessible over the network. AC:L: No special race conditions or complex setup are needed; a standard API call to the settings endpoint triggers the issue. AT:N: No manipulation of the attack target is required. PR:L: The attacker needs an authenticated MISP account with permission to view server settings. UI:N: No user interaction is required. VC:L: Sensitive module API keys are exposed, but the scope is limited to settings of modules that declare the redacted flag. VI:N: No direct integrity impact on the vulnerable component's data beyond the VA impact. VA:L: CLI-only settings can be modified via the API, representing a limited integrity impact on the vulnerable component's configuration. SC/SI/SA:N: No evidence of impact on other components or systems.
Weakness rationale
- CWE-200 The redacted flag, which instructs the server to mask a setting's value (e.g., an API key), was dropped during setting reconstruction. This caused the sensitive value to be served in plaintext via API endpoints to any authenticated user, constituting an information exposure.
- CWE-862 The cli_only flag, which restricts a setting to command-line modification only, was dropped during setting reconstruction. This allowed the setting to be modified via the web API without the intended authorization restriction, effectively bypassing the access control the module author specified.
Attack pattern rationale
- CAPEC-126 The primary impact is that sensitive data (module API keys marked as redacted) is discoverable via standard API endpoints because the redaction flag was not enforced. An authenticated user querying server settings can obtain credentials that the module author intended to keep hidden. This is the closest CAPEC to the information-disclosure aspect of the vulnerability. The secondary aspect (CLI-only settings editable via API) is an authorization bypass that does not map cleanly to a single CAPEC; CAPEC-126 is selected as the best available match for the overall pattern of accessing data that should be restricted.
Assumptions to verify
- The affected version boundary is inferred from the tag_version_boundary metadata (fix is 10 commits after v2.5.48); the exact fixed release version is not stated in the patch metadata.
- PR:L assumes that reading server settings requires an authenticated MISP user with appropriate role permissions; the patch does not specify the exact permission level required.
- The CAPEC-126 mapping is the closest available pattern for the information-disclosure aspect; the authorization-bypass aspect (cli_only) does not have a precise CAPEC match and is subsumed under the same mapping.
- VC:L assumes the exposed data is limited to module-specific API keys rather than system-wide credentials; the actual sensitivity depends on which modules are installed.
- The commit message references a separate issue (branch read) reported by Jeroen Pinoy; this vulnerability was discovered as a side effect of fixing that issue, so Jeroen Pinoy is not credited as a finder of this specific vulnerability.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
7 | 11 | medium | 5 |
- 2026-09-28 10:14 UTC Fix developed Corrective change authored (6c02f0f5c33aab96e90df8791c3873303d7e99ce): fix: [settings] Module settings keep the flags the module https://github.com/MISP/MISP/commit/6c02f0f5c.patch
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112192",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:13:11.731385Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:13:51.582Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"app/Model/Server.php (readModuleSettings)"
],
"product": "MISP",
"programFiles": [
"app/Model/Server.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata.\u003c/p\u003e\u003cp\u003eAs a result:\u003c/p\u003e\u003cp\u003e- A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings.\u003c/p\u003e\u003cp\u003e- A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction.\u003c/p\u003e\u003cp\u003eAn authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48\u003c/p\u003e"
}
],
"value": "MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata.\n\nAs a result:\n\n- A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings.\n\n- A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction.\n\nAn authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access.\n\nAffected: \u003c2.5.48"
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Sensitive Data Discovery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-19T09:23:47Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:28:08.054Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/6c02f0f5c"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix ensures that the redacted and cli_only flags declared by a module in its own setting definition are preserved when the server rebuilds the setting for API exposure. By carrying these flags through to the final setting object, the existing enforcement logic (which checks these flags before serving values or accepting edits) now correctly applies to module-supplied settings, preventing disclosure of redacted values and blocking API-based modification of CLI-only settings.\u003c/p\u003e"
}
],
"value": "The fix ensures that the redacted and cli_only flags declared by a module in its own setting definition are preserved when the server rebuilds the setting for API exposure. By carrying these flags through to the final setting object, the existing enforcement logic (which checks these flags before serving values or accepting edits) now correctly applies to module-supplied settings, preventing disclosure of redacted values and blocking API-based modification of CLI-only settings."
}
],
"title": "MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version boundary is inferred from the tag_version_boundary metadata (fix is 10 commits after v2.5.48); the exact fixed release version is not stated in the patch metadata.",
"PR:L assumes that reading server settings requires an authenticated MISP user with appropriate role permissions; the patch does not specify the exact permission level required.",
"The CAPEC-126 mapping is the closest available pattern for the information-disclosure aspect; the authorization-bypass aspect (cli_only) does not have a precise CAPEC match and is subsumed under the same mapping.",
"VC:L assumes the exposed data is limited to module-specific API keys rather than system-wide credentials; the actual sensitivity depends on which modules are installed.",
"The commit message references a separate issue (branch read) reported by Jeroen Pinoy; this vulnerability was discovered as a side effect of fixing that issue, so Jeroen Pinoy is not credited as a finder of this specific vulnerability."
],
"capecRationale": [
{
"capecId": "CAPEC-126",
"rationale": "The primary impact is that sensitive data (module API keys marked as redacted) is discoverable via standard API endpoints because the redaction flag was not enforced. An authenticated user querying server settings can obtain credentials that the module author intended to keep hidden. This is the closest CAPEC to the information-disclosure aspect of the vulnerability. The secondary aspect (CLI-only settings editable via API) is an authorization bypass that does not map cleanly to a single CAPEC; CAPEC-126 is selected as the best available match for the overall pattern of accessing data that should be restricted."
}
],
"commit": "6c02f0f5c33aab96e90df8791c3873303d7e99ce",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5"
}
],
"cvssRationale": "AV:N: MISP is a web application accessible over the network. AC:L: No special race conditions or complex setup are needed; a standard API call to the settings endpoint triggers the issue. AT:N: No manipulation of the attack target is required. PR:L: The attacker needs an authenticated MISP account with permission to view server settings. UI:N: No user interaction is required. VC:L: Sensitive module API keys are exposed, but the scope is limited to settings of modules that declare the redacted flag. VI:N: No direct integrity impact on the vulnerable component\u0027s data beyond the VA impact. VA:L: CLI-only settings can be modified via the API, representing a limited integrity impact on the vulnerable component\u0027s configuration. SC/SI/SA:N: No evidence of impact on other components or systems.",
"fixSummary": "The fix ensures that the redacted and cli_only flags declared by a module in its own setting definition are preserved when the server rebuilds the setting for API exposure. By carrying these flags through to the final setting object, the existing enforcement logic (which checks these flags before serving values or accepting edits) now correctly applies to module-supplied settings, preventing disclosure of redacted values and blocking API-based modification of CLI-only settings.",
"generatedAt": "2026-10-19T09:23:47.526920Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 5,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 7
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "e7e99bab776b221dd41bf562693fc308d8a2ee619806b1bfef26bb008212205a",
"patchSummary": "In app/Model/Server.php, within the readModuleSettings() method, a loop was added after the setting fields are populated that iterates over the strings \u0027redacted\u0027 and \u0027cli_only\u0027. For each flag, if the module\u0027s own result array contains a truthy value for that key, the flag is set to true on the rebuilt $setting object before it is stored in $serverSettings. This is a 6-line addition that preserves the module-declared guard flags that were previously discarded during the setting reconstruction.",
"patchTruncated": false,
"patches": [
{
"commit": "6c02f0f5c33aab96e90df8791c3873303d7e99ce",
"date": "Mon, 28 Sep 2026 12:14:28 +0200",
"patchSha256": "e7e99bab776b221dd41bf562693fc308d8a2ee619806b1bfef26bb008212205a",
"source": "https://github.com/MISP/MISP/commit/6c02f0f5c.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/6c02f0f5c.patch",
"subject": "fix: [settings] Module settings keep the flags the module"
}
],
"source": "https://github.com/MISP/MISP/commit/6c02f0f5c.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-19T09:23:47Z",
"version": "2.0.3"
},
"subject": "fix: [settings] Module settings keep the flags the module",
"tagVersionBoundary": {
"commits_after_fix": 10,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.48",
"version": "2.5.48",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-200",
"rationale": "The redacted flag, which instructs the server to mask a setting\u0027s value (e.g., an API key), was dropped during setting reconstruction. This caused the sensitive value to be served in plaintext via API endpoints to any authenticated user, constituting an information exposure."
},
{
"cweId": "CWE-862",
"rationale": "The cli_only flag, which restricts a setting to command-line modification only, was dropped during setting reconstruction. This allowed the setting to be modified via the web API without the intended authorization restriction, effectively bypassing the access control the module author specified."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (6c02f0f5c33aab96e90df8791c3873303d7e99ce): fix: [settings] Module settings keep the flags the module",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/MISP/MISP/commit/6c02f0f5c.patch"
],
"timestamp": "2026-09-28T10:14:28Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20310"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-112192",
"datePublished": "2026-10-19T09:28:08.054Z",
"dateReserved": "2026-10-19T09:28:06.573Z",
"dateUpdated": "2026-10-19T17:13:51.582Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-112192",
"date": "2026-10-20",
"epss": "0.00365",
"percentile": "0.28927"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"app/Model/Server.php (readModuleSettings)"
],
"product": "MISP",
"programFiles": [
"app/Model/Server.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata.\n\nAs a result:\n\n- A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings.\n\n- A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction.\n\nAn authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access.\n\nAffected: \u003c2.5.48"
}
],
"id": "CVE-2026-112192",
"lastModified": "2026-10-19T18:17:04.063",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"ssvcData": {
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-19T09:23:47Z",
"version": "2.0.3"
}
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-112192",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:13:11.731385Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-10-19T10:16:47.563",
"references": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"url": "https://github.com/MISP/MISP/commit/6c02f0f5c"
}
],
"sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
},
{
"lang": "en",
"value": "CWE-862"
}
],
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112192",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:13:11.731385Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:13:46.395Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"app/Model/Server.php (readModuleSettings)"
],
"product": "MISP",
"programFiles": [
"app/Model/Server.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata.\u003c/p\u003e\u003cp\u003eAs a result:\u003c/p\u003e\u003cp\u003e- A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings.\u003c/p\u003e\u003cp\u003e- A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction.\u003c/p\u003e\u003cp\u003eAn authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48\u003c/p\u003e"
}
],
"value": "MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata.\n\nAs a result:\n\n- A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings.\n\n- A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction.\n\nAn authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access.\n\nAffected: \u003c2.5.48"
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Sensitive Data Discovery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-19T09:23:47Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:28:08.054Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/6c02f0f5c"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix ensures that the redacted and cli_only flags declared by a module in its own setting definition are preserved when the server rebuilds the setting for API exposure. By carrying these flags through to the final setting object, the existing enforcement logic (which checks these flags before serving values or accepting edits) now correctly applies to module-supplied settings, preventing disclosure of redacted values and blocking API-based modification of CLI-only settings.\u003c/p\u003e"
}
],
"value": "The fix ensures that the redacted and cli_only flags declared by a module in its own setting definition are preserved when the server rebuilds the setting for API exposure. By carrying these flags through to the final setting object, the existing enforcement logic (which checks these flags before serving values or accepting edits) now correctly applies to module-supplied settings, preventing disclosure of redacted values and blocking API-based modification of CLI-only settings."
}
],
"title": "MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version boundary is inferred from the tag_version_boundary metadata (fix is 10 commits after v2.5.48); the exact fixed release version is not stated in the patch metadata.",
"PR:L assumes that reading server settings requires an authenticated MISP user with appropriate role permissions; the patch does not specify the exact permission level required.",
"The CAPEC-126 mapping is the closest available pattern for the information-disclosure aspect; the authorization-bypass aspect (cli_only) does not have a precise CAPEC match and is subsumed under the same mapping.",
"VC:L assumes the exposed data is limited to module-specific API keys rather than system-wide credentials; the actual sensitivity depends on which modules are installed.",
"The commit message references a separate issue (branch read) reported by Jeroen Pinoy; this vulnerability was discovered as a side effect of fixing that issue, so Jeroen Pinoy is not credited as a finder of this specific vulnerability."
],
"capecRationale": [
{
"capecId": "CAPEC-126",
"rationale": "The primary impact is that sensitive data (module API keys marked as redacted) is discoverable via standard API endpoints because the redaction flag was not enforced. An authenticated user querying server settings can obtain credentials that the module author intended to keep hidden. This is the closest CAPEC to the information-disclosure aspect of the vulnerability. The secondary aspect (CLI-only settings editable via API) is an authorization bypass that does not map cleanly to a single CAPEC; CAPEC-126 is selected as the best available match for the overall pattern of accessing data that should be restricted."
}
],
"commit": "6c02f0f5c33aab96e90df8791c3873303d7e99ce",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5"
}
],
"cvssRationale": "AV:N: MISP is a web application accessible over the network. AC:L: No special race conditions or complex setup are needed; a standard API call to the settings endpoint triggers the issue. AT:N: No manipulation of the attack target is required. PR:L: The attacker needs an authenticated MISP account with permission to view server settings. UI:N: No user interaction is required. VC:L: Sensitive module API keys are exposed, but the scope is limited to settings of modules that declare the redacted flag. VI:N: No direct integrity impact on the vulnerable component\u0027s data beyond the VA impact. VA:L: CLI-only settings can be modified via the API, representing a limited integrity impact on the vulnerable component\u0027s configuration. SC/SI/SA:N: No evidence of impact on other components or systems.",
"fixSummary": "The fix ensures that the redacted and cli_only flags declared by a module in its own setting definition are preserved when the server rebuilds the setting for API exposure. By carrying these flags through to the final setting object, the existing enforcement logic (which checks these flags before serving values or accepting edits) now correctly applies to module-supplied settings, preventing disclosure of redacted values and blocking API-based modification of CLI-only settings.",
"generatedAt": "2026-10-19T09:23:47.526920Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 5,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 7
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "e7e99bab776b221dd41bf562693fc308d8a2ee619806b1bfef26bb008212205a",
"patchSummary": "In app/Model/Server.php, within the readModuleSettings() method, a loop was added after the setting fields are populated that iterates over the strings \u0027redacted\u0027 and \u0027cli_only\u0027. For each flag, if the module\u0027s own result array contains a truthy value for that key, the flag is set to true on the rebuilt $setting object before it is stored in $serverSettings. This is a 6-line addition that preserves the module-declared guard flags that were previously discarded during the setting reconstruction.",
"patchTruncated": false,
"patches": [
{
"commit": "6c02f0f5c33aab96e90df8791c3873303d7e99ce",
"date": "Mon, 28 Sep 2026 12:14:28 +0200",
"patchSha256": "e7e99bab776b221dd41bf562693fc308d8a2ee619806b1bfef26bb008212205a",
"source": "https://github.com/MISP/MISP/commit/6c02f0f5c.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/6c02f0f5c.patch",
"subject": "fix: [settings] Module settings keep the flags the module"
}
],
"source": "https://github.com/MISP/MISP/commit/6c02f0f5c.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-19T09:23:47Z",
"version": "2.0.3"
},
"subject": "fix: [settings] Module settings keep the flags the module",
"tagVersionBoundary": {
"commits_after_fix": 10,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.48",
"version": "2.5.48",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-200",
"rationale": "The redacted flag, which instructs the server to mask a setting\u0027s value (e.g., an API key), was dropped during setting reconstruction. This caused the sensitive value to be served in plaintext via API endpoints to any authenticated user, constituting an information exposure."
},
{
"cweId": "CWE-862",
"rationale": "The cli_only flag, which restricts a setting to command-line modification only, was dropped during setting reconstruction. This allowed the setting to be modified via the web API without the intended authorization restriction, effectively bypassing the access control the module author specified."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (6c02f0f5c33aab96e90df8791c3873303d7e99ce): fix: [settings] Module settings keep the flags the module",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/MISP/MISP/commit/6c02f0f5c.patch"
],
"timestamp": "2026-09-28T10:14:28Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20310"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-112192",
"datePublished": "2026-10-19T09:28:08.054Z",
"dateReserved": "2026-10-19T09:28:06.573Z",
"dateUpdated": "2026-10-19T17:13:51.582Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.