MISP versions prior to 2.5.47 are vulnerable to a privilege escalation attack that allows authenticated users with read-only API keys to bypass restrictions and gain full account privileges.

This vulnerability is an improper privilege management flaw (CWE-269) within the updateLoginTime method. An authenticated user with a restricted read-only API key can trigger a function that inadvertently restores their full account permissions, effectively bypassing intended access controls.

The ability for a read-only user to elevate their privileges to full administrative control poses a severe risk to data integrity and system confidentiality. With a CVSS score of 8.7, this vulnerability facilitates unauthorized modification or deletion of sensitive threat intelligence data, potentially leading to a complete compromise of the MISP instance and its associated security operations.

Immediate Action: Upgrade your MISP installation to version 2.5.47 or later to implement the fix that correctly handles authentication state during session refreshes.

Proactive Monitoring: Review audit logs for suspicious API activity, specifically looking for users who possess read-only keys performing actions typically reserved for administrative or write-enabled accounts.

Compensating Controls: If an immediate upgrade is not feasible, restrict API access to trusted networks and ensure that service accounts are strictly scoped to the minimum necessary permissions required for their integration.

Public Exploit Available: No

Given the high CVSS score and the critical nature of privilege escalation, administrators must treat this vulnerability as a priority. Upgrading to version 2.5.47 is the only definitive way to resolve the underlying authentication logic error. Ensure that your deployment cycle includes verification of the patch by confirming the removal of the vulnerable authentication method calls in the application source code.