GCVE-1-2026-20323 (CVE-2026-127016)

Vulnerability from gna-1 – Published: 2026-11-12 09:40 – Updated: 2026-11-12 09:49
VLAI
Title
MISP Modules Website: Missing Authorization on External Tool Management Endpoints
Summary
The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application environment, the module configuration endpoints correctly required an authenticated administrator session, but the external tools management handlers processed requests from anonymous users without any authorization check. An unauthenticated attacker with network access to the website could add arbitrary external tools, delete existing tools, toggle their active status, and modify their configurations including API keys and ingestion URLs. This inconsistency allowed bypass of the intended access control for the external tools management functionality. The vulnerability is conditional on ADMIN_PASSWORD being set; installations without an admin password intentionally permit open management access by design. The affected component is the external_tools Flask blueprint within the MISP Modules website application.
Severity
9.2 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:H/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: total
Supplier · CNA (v2.0.3)
Decision recorded 2026-11-12 08:59 UTC
CWE
Assigner
CIRCL GNA GNA-1
GNA scorecard A 90/100 over 257 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
misp misp-modules Affected: 0 , ≤ 3.1.4 (semver)
    cpe:2.3:a:misp:misp-modules:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Alexandre Dulaunoy
GCVE extensions
bcp-05-x-01
AI-assisted vulnerability information annotation
GCVE-BCP-05-X-01
Whole record AI-generated Human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
bcp-05-x-02
Patch-to-vulnerability generation provenance
GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-11-12 08:59
Model
qwen3.8:27b
Input
https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027.patch a7fa238950e4…
Confidence
medium
Commit Subject Patch SHA-256
28c27e30f6d3 fix: [website] authorize external tool management a7fa238950e4…
Fix summary

A before_request authorization handler is added to the external_tools blueprint that checks whether the admin user is active (ADMIN_PASSWORD configured) and whether the current user is authenticated before any management endpoint executes. When both conditions indicate an unauthenticated request to a protected endpoint, the handler redirects to the login page (for the add endpoint) or returns a 403 Permission Denied response (for delete, status, and configuration endpoints). This enforces the same optional-admin policy already applied to module configuration, while preserving the existing open-management behavior when no admin password is configured.

Patch summary

The patch adds a before_request decorator on external_tools_blueprint in website/app/external_tools/external_tools.py that imports current_user from flask_login and admin_user_active from app.utils. The handler checks if the request endpoint is one of the four management endpoints (add_external_tool, delete_tool, change_status, change_config) and if the admin user is active but the current user is not authenticated, it either redirects to the login page or returns a 403 JSON response. The patch also adds a new test file website/tests/external_tools_checks.py with regression tests verifying that anonymous mutations are denied even with valid CSRF tokens, that authorization precedes JSON validation, that authenticated admins can perform all operations, and that the open-management policy is preserved when no admin password is set. The README is updated to document the new authorization requirement.

CVSS rationale

AV:N: The vulnerability is exploitable over the network via HTTP requests to the website. AC:L: No special conditions are required; standard HTTP POST/GET requests to known endpoints suffice. AT:N: No attack target manipulation is needed. PR:N: No privileges are required; the attack works as an anonymous user. UI:N: No user interaction is required. VC:L: Tool configurations including API keys and URLs are accessible/modifiable by the attacker. VI:H: The attacker can add, delete, and modify external tools, fully compromising the integrity of the tool management function. VA:L: Deleting or disabling tools reduces availability of data ingestion. SC:N: No secondary system confidentiality impact identified. SI:H: External tools feed into the broader MISP data pipeline; modifying them can corrupt or redirect data ingestion for the entire MISP instance. SA:N: No secondary availability impact beyond the direct effect.

Weakness rationale
  • CWE-862 The external tools management endpoints (add, delete, change_status, change_config) lacked an authorization check that would verify the requester is an authenticated administrator when the admin-login policy is active. The authentication mechanism (flask_login, ADMIN_PASSWORD) existed in the application but was not applied to these specific endpoints, allowing anonymous users to perform privileged management operations.
Attack pattern rationale
  • CAPEC-1 The closest available CAPEC pattern is Software Feature Discovery, as the attacker must identify the external tools management endpoints (e.g., /add_external_tool, /external_tools/<id>/delete_tool, /external_tools/change_status, /external_tools/change_config) and then issue unauthenticated requests to them. The vulnerability is exploited by discovering that these management functions are accessible without the authorization that the application's own documentation and parallel module-configuration endpoints imply. No CAPEC specifically models 'missing authorization on a discovered endpoint,' so CAPEC-1 is the best available match for the discovery-and-exploitation sequence.
Assumptions to verify
  • The CAPEC mapping to CAPEC-1 (Software Feature Discovery) is the closest available pattern; no CAPEC specifically models exploitation of a missing authorization check on a discovered endpoint. The mapping is uncertain but is the best fit given the attack sequence of discovering and then invoking unauthenticated management endpoints.
  • CVSS SI:H assumes that external tools in MISP feed into a broader data ingestion pipeline whose integrity is affected by unauthorized modification of tool configurations. If external tools are isolated to a single instance with no downstream consumers, SI could be reduced.
  • The vulnerability is conditional on ADMIN_PASSWORD being configured. Installations without ADMIN_PASSWORD intentionally allow open management access by design and are not considered vulnerable.
  • No specific version boundaries are identified in the patch; the affected version range is unspecified.
  • The patch references issue #816 in the MISP/misp-modules repository, but no additional context about the issue tracker entry is available to confirm reporter or finder credits.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 7 11 medium 5
bcp-05-x-03
Vulnerability handling and disclosure timeline
GCVE-BCP-05-X-03
  1. 2026-11-12 08:37 UTC Fix developed Corrective change authored (28c27e30f6d3a10e38fe9c54bb52f57ccf70d027): fix: [website] authorize external tool management
  2. 2026-11-12 08:58 UTC Fix available Patch retrieved from the supplied URL; retrieval time is used as the default availability time.
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp-modules:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "external_tools"
          ],
          "product": "misp-modules",
          "programFiles": [
            "website/app/external_tools/external_tools.py"
          ],
          "repo": "https://github.com/MISP/misp-modules",
          "vendor": "misp",
          "versions": [
            {
              "lessThanOrEqual": "3.1.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:misp:misp-modules:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "3.1.4",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Alexandre Dulaunoy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application environment, the module configuration endpoints correctly required an authenticated administrator session, but the external tools management handlers processed requests from anonymous users without any authorization check. An unauthenticated attacker with network access to the website could add arbitrary external tools, delete existing tools, toggle their active status, and modify their configurations including API keys and ingestion URLs. This inconsistency allowed bypass of the intended access control for the external tools management functionality. The vulnerability is conditional on ADMIN_PASSWORD being set; installations without an admin password intentionally permit open management access by design. The affected component is the external_tools Flask blueprint within the MISP Modules website application."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Software Feature Discovery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "total"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-11-12T08:59:10Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "A before_request authorization handler is added to the external_tools blueprint that checks whether the admin user is active (ADMIN_PASSWORD configured) and whether the current user is authenticated before any management endpoint executes. When both conditions indicate an unauthenticated request to a protected endpoint, the handler redirects to the login page (for the add endpoint) or returns a 403 Permission Denied response (for delete, status, and configuration endpoints). This enforces the same optional-admin policy already applied to module configuration, while preserving the existing open-management behavior when no admin password is configured."
        }
      ],
      "title": "MISP Modules Website: Missing Authorization on External Tool Management Endpoints",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The CAPEC mapping to CAPEC-1 (Software Feature Discovery) is the closest available pattern; no CAPEC specifically models exploitation of a missing authorization check on a discovered endpoint. The mapping is uncertain but is the best fit given the attack sequence of discovering and then invoking unauthenticated management endpoints.",
                  "CVSS SI:H assumes that external tools in MISP feed into a broader data ingestion pipeline whose integrity is affected by unauthorized modification of tool configurations. If external tools are isolated to a single instance with no downstream consumers, SI could be reduced.",
                  "The vulnerability is conditional on ADMIN_PASSWORD being configured. Installations without ADMIN_PASSWORD intentionally allow open management access by design and are not considered vulnerable.",
                  "No specific version boundaries are identified in the patch; the affected version range is unspecified.",
                  "The patch references issue #816 in the MISP/misp-modules repository, but no additional context about the issue tracker entry is available to confirm reporter or finder credits."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "The closest available CAPEC pattern is Software Feature Discovery, as the attacker must identify the external tools management endpoints (e.g., /add_external_tool, /external_tools/\u003cid\u003e/delete_tool, /external_tools/change_status, /external_tools/change_config) and then issue unauthenticated requests to them. The vulnerability is exploited by discovering that these management functions are accessible without the authorization that the application\u0027s own documentation and parallel module-configuration endpoints imply. No CAPEC specifically models \u0027missing authorization on a discovered endpoint,\u0027 so CAPEC-1 is the best available match for the discovery-and-exploitation sequence."
                  }
                ],
                "commit": "28c27e30f6d3a10e38fe9c54bb52f57ccf70d027",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Alexandre Dulaunoy"
                  }
                ],
                "cvssRationale": "AV:N: The vulnerability is exploitable over the network via HTTP requests to the website. AC:L: No special conditions are required; standard HTTP POST/GET requests to known endpoints suffice. AT:N: No attack target manipulation is needed. PR:N: No privileges are required; the attack works as an anonymous user. UI:N: No user interaction is required. VC:L: Tool configurations including API keys and URLs are accessible/modifiable by the attacker. VI:H: The attacker can add, delete, and modify external tools, fully compromising the integrity of the tool management function. VA:L: Deleting or disabling tools reduces availability of data ingestion. SC:N: No secondary system confidentiality impact identified. SI:H: External tools feed into the broader MISP data pipeline; modifying them can corrupt or redirect data ingestion for the entire MISP instance. SA:N: No secondary availability impact beyond the direct effect.",
                "draft": false,
                "fixSummary": "A before_request authorization handler is added to the external_tools blueprint that checks whether the admin user is active (ADMIN_PASSWORD configured) and whether the current user is authenticated before any management endpoint executes. When both conditions indicate an unauthenticated request to a protected endpoint, the handler redirects to the login page (for the add endpoint) or returns a 403 Permission Denied response (for delete, status, and configuration endpoints). This enforces the same optional-admin policy already applied to module configuration, while preserving the existing open-management behavior when no admin password is configured.",
                "generatedAt": "2026-11-12T08:59:10.622852Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "potentialErrors": [],
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "a7fa238950e4db922c8ad604a6abe453385d29b8a6bcc58762a4fe72add73775",
                "patchSummary": "The patch adds a before_request decorator on external_tools_blueprint in website/app/external_tools/external_tools.py that imports current_user from flask_login and admin_user_active from app.utils. The handler checks if the request endpoint is one of the four management endpoints (add_external_tool, delete_tool, change_status, change_config) and if the admin user is active but the current user is not authenticated, it either redirects to the login page or returns a 403 JSON response. The patch also adds a new test file website/tests/external_tools_checks.py with regression tests verifying that anonymous mutations are denied even with valid CSRF tokens, that authorization precedes JSON validation, that authenticated admins can perform all operations, and that the open-management policy is preserved when no admin password is set. The README is updated to document the new authorization requirement.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "28c27e30f6d3a10e38fe9c54bb52f57ccf70d027",
                    "date": "Thu, 12 Nov 2026 09:37:23 +0100",
                    "patchSha256": "a7fa238950e4db922c8ad604a6abe453385d29b8a6bcc58762a4fe72add73775",
                    "retrievedAt": "2026-11-12T08:58:21.777259Z",
                    "source": "https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027.patch",
                    "sourceUrl": "https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027.patch",
                    "subject": "fix: [website] authorize external tool management"
                  }
                ],
                "source": "https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "total"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-11-12T08:59:10Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [website] authorize external tool management",
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The external tools management endpoints (add, delete, change_status, change_config) lacked an authorization check that would verify the requester is an authenticated administrator when the admin-login policy is active. The authentication mechanism (flask_login, ADMIN_PASSWORD) existed in the application but was not applied to these specific endpoints, allowing anonymous users to perform privileged management operations."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (28c27e30f6d3a10e38fe9c54bb52f57ccf70d027): fix: [website] authorize external tool management",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027.patch"
                    ],
                    "timestamp": "2026-11-12T08:37:23Z",
                    "type": "fix-developed"
                  },
                  {
                    "description": "Patch retrieved from the supplied URL; retrieval time is used as the default availability time.",
                    "id": "evt-fix-available-1",
                    "references": [
                      "https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027.patch"
                    ],
                    "timestamp": "2026-11-12T08:58:21.777259Z",
                    "type": "fix-available"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20323"
        }
      ]
    }
  },
  "cveMetadata": {
    "cveId": "CVE-2026-127016",
    "datePublished": "2026-11-12T09:40:23.014021Z",
    "dateReserved": "2026-11-12T09:45:10.065Z",
    "dateUpdated": "2026-11-12T09:49:37.028410Z",
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-20323"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2.0"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.