CVE-2026-90955

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-90955

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90955.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-90955

Published

2026-09-14T12:37:54Z

Modified

2026-09-18T03:31:03Z

Severity

4.6 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load

Details

Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging.

The shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user.

Version affected: ≤2.5.45

Database specific

{
    "cna_assigner": "CIRCL",
    "cwe_ids": [
        "CWE-223",
        "CWE-778"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90955.json"
}

References

Affected packages

Git / github.com/misp/misp

Affected ranges

Type

GIT

Repo

https://github.com/misp/misp

Events

Introduced

Fixed

d13e5db33

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.5.46"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90955.json"