A critical authorization flaw in the MISP interactive CLI shell allows authenticated local users to bypass access controls and potentially expose sensitive credentials and system synchronization keys.

This vulnerability involves multiple instances of missing authorization (CWE-862) within the CLI shell, where security checks are decoupled from the main web application logic. An authenticated local user can leverage these inconsistencies to view restricted feeds, access sharing groups without proper authorization, and retrieve sensitive configuration data such as HTTP credentials and server synchronization authkeys.

The vulnerability carries a CVSS score of 8.4, reflecting the potential for significant data exposure and unauthorized modification of system state. Successful exploitation could lead to the compromise of threat intelligence feeds, unauthorized access to sensitive sharing groups, and the exfiltration of authentication credentials used for system synchronization. This poses a substantial risk to the confidentiality and integrity of the threat intelligence platform, which is often a central repository for highly sensitive security data.

Immediate Action: Update the MISP installation to version 2.5.46 or later, which enforces consistent model-level access controls across both the CLI and web interfaces.

Proactive Monitoring: Review system logs for unusual CLI activity, particularly commands that access feeds, sharing groups, or server synchronization configurations.

Compensating Controls: Restrict access to the server shell to only essential administrative personnel to limit the number of users capable of interacting with the vulnerable CLI.

Public Exploit Available: Unknown

Given the high CVSS score and the sensitive nature of the data handled by MISP, organizations must prioritize upgrading to version 2.5.46 immediately. The discrepancy between the CLI and web interface security models represents a fundamental flaw in access control that cannot be mitigated through configuration alone. Patching is the only reliable method to ensure that all system interfaces consistently enforce required authorization checks.