Vulnerability-Lookup

GHSA-WXF7-WRJX-26CC

Vulnerability from github – Published: 2026-09-14 15:32 – Updated: 2026-09-14 15:32

Details

Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging.

The shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user.

Version affected: ≤2.5.45

Severity

4.6 (Medium)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-90955"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-223"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-14T13:19:32Z",
    "severity": "MODERATE"
  },
  "details": "Affected versions of MISP\u2019s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging.\n\n\nThe shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user.\n\n\n\nVersion affected: \u22642.5.45",
  "id": "GHSA-wxf7-wrjx-26cc",
  "modified": "2026-09-14T15:32:45Z",
  "published": "2026-09-14T15:32:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90955"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MISP/MISP/commit/d13e5db33"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-90955 (GCVE-0-2026-90955)

Vulnerability from cvelistv5 – Published: 2026-09-14 12:37 – Updated: 2026-09-14 13:00

Title

MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load

Summary

Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user. Version affected: ≤2.5.45

Severity

4.6 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 12:55 UTC

CWE

CWE-778 - Insufficient Logging
CWE-223 - Omission of Security-relevant Information in Log Data

Assigner

CIRCL ENISA root

References

1 reference

URL	Tags
https://github.com/MISP/MISP/commit/d13e5db33	patch

Impacted products

1 product

Vendor	Product	Version
MISP	MISP	Affected: 0 , < 2.5.46 (semver)

Credits

Scottish Government - National Cyber Team iglocska Claude Fable 5.1

GCVE extensions

AI-generated Confidence: medium Model qwen3.8:27b advisory bcp-05-x-01bcp-05-x-02

AI involvement GCVE-BCP-05-X-01

Whole record AI-generated Review: review GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification

Model	Source	Identifier
qwen3.8:27b	ollama	`qwen3.8:27b`

Patch provenance GCVE-BCP-05-X-02

Generator: patch2vuln.py on 2026-09-14 12:23
Model: qwen3.8:27b
Input: https://github.com/MISP/MISP/commit/d13e5db33.patch 8ea0cae590f0…
Confidence: medium

Commit	Subject	Patch SHA-256
`d13e5db33faa`	fix: [cli] Attribute interactive CLI shell writes stably and	`8ea0cae590f0…`

Fix summary

The fix introduces a process-wide static identity (setShellUser) on SysLogLogableBehavior that is resolved at write time rather than at setup time, so it survives lazy model loads that re-run setup() on the singleton. The behavior appends 'via CLI' to the log description for shell-originated rows, mirroring the request_type = CLI marker in the new audit engine. The CLI shell now publishes the impersonated user through both Configure::write('CurrentUserId') and SysLogLogableBehavior::setShellUser() before any write. Explicit extralog calls were added for CLI user edit, disable, and delete operations so the default audit engine records them the same way the web path does. Background jobs that publish no user continue to log as SYSTEM without a CLI marker.

Patch summary

In cli_common.php, __setUserContext() was replaced: instead of iterating loaded models and setting the user on each SysLogLogable behavior instance, it now calls Configure::write('CurrentUserId', $user['id']) and SysLogLogableBehavior::setShellUser($user). In SysLogLogableBehavior.php, a private static $shellUser property and setShellUser() static method were added; _saveLog() now resolves the actor via shellActor() at write time when CAKEPHP_SHELL is defined, and appends ' via CLI' to the description. setup() was refactored to use the same shellActor() helper. In cli_users.php, __logUserEdit() was added to write an extralog row for user edits and disables, and __deleteUser() now calls extralog for permanent deletions. A new test file SysLogLogableShellIdentityTest.php (395 lines) covers identity persistence across lazy model attaches, CLI marker presence/absence, SYSTEM fallback, and web-request isolation. CLI_usage.md documents the audit-trail behavior.

CVSS rationale

Attack vector is Local because the CLI shell requires direct access to the MISP host and the ability to run the cake console command. Attack complexity is Low because no race condition or special timing is needed; the identity loss occurs deterministically on the first lazy model load. No attack target is required. Privileges Required is High because running the CLI shell requires reading app/Config/database.php and passing a user ID, which the project documentation equates to site-admin-equivalent access. No user interaction is needed. There is no direct confidentiality, integrity, or availability impact on the MISP application itself. The secondary integrity impact is Low: the audit log data is inaccurate (wrong user attribution, missing CLI marker, missing user-management entries), which degrades forensic and compliance capability but does not corrupt application data. No secondary availability impact.

Weakness rationale

CWE-778 The CLI shell's audit rows lost the impersonated user identity after the first lazy model load (reset to SYSTEM), and user-management operations (edit, disable, delete) performed via CLI produced no audit row at all in the default engine. Both are failures to record security-relevant events with sufficient detail.
CWE-223 Audit rows written by the CLI shell carried no marker distinguishing them from web-originated actions. In the default engine the description lacked 'via CLI'; in the new engine request_type was not set to CLI. This omission prevents an investigator from determining the true origin of an action.

Assumptions to verify

The tag_version_boundary indicates the fix commit is 183 commits after tag v2.5.46, suggesting the fix landed in a version after 2.5.46; however, no explicit fixed version tag is provided, so the exact boundary is uncertain.
The affected version range is assumed to be all versions prior to the fix commit; the patch does not specify a minimum affected version.
CVSS PR:H assumes that CLI shell access is equivalent to site-admin-equivalent access, consistent with the project's own CLI_usage.md documentation stating that running cake requires reading database.php and that the shell should not be exposed to anyone who must not have site-admin-equivalent access.
The SI:L rating assumes the audit-log inaccuracy is a secondary integrity impact on the logging subsystem rather than a primary integrity impact on the MISP application data.
The patch does not include a CVE or GCVE identifier; this analysis is a draft for CNA/GNA review.

Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model	Score	Agreement	Confidence	Assumptions
`qwen3.8:27b`	5	9	medium	5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-90955",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T12:55:46.663079Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T13:00:29.069Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "CLIShell (app/Console/Command/CLIShell)",
            "SysLogLogableBehavior (app/Plugin/SysLogLogable/Model/Behavior)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Console/Command/CLIShell.php",
            "app/Console/Command/CLIShell/cli_common.php",
            "app/Console/Command/CLIShell/cli_users.php",
            "app/Plugin/SysLogLogable/Model/Behavior/SysLogLogableBehavior.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Scottish Government - National Cyber Team"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Fable 5.1"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP\u2019s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging.\u003c/p\u003e\n\u003cp\u003eThe shell is designed to run actions as a supplied MISP user ID. However, the legacy \u003ccode\u003eSysLogLogable\u003c/code\u003e behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP\u2019s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging.\n\n\nThe shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user.\n\n\n\nVersion affected: \u22642.5.45"
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-778",
              "description": "CWE-778 Insufficient Logging",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-223",
              "description": "CWE-223 Omission of Security-relevant Information in Log Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:37:54.001Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/d13e5db33"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces a process-wide static identity (setShellUser) on SysLogLogableBehavior that is resolved at write time rather than at setup time, so it survives lazy model loads that re-run setup() on the singleton. The behavior appends \u0027via CLI\u0027 to the log description for shell-originated rows, mirroring the request_type = CLI marker in the new audit engine. The CLI shell now publishes the impersonated user through both Configure::write(\u0027CurrentUserId\u0027) and SysLogLogableBehavior::setShellUser() before any write. Explicit extralog calls were added for CLI user edit, disable, and delete operations so the default audit engine records them the same way the web path does. Background jobs that publish no user continue to log as SYSTEM without a CLI marker.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces a process-wide static identity (setShellUser) on SysLogLogableBehavior that is resolved at write time rather than at setup time, so it survives lazy model loads that re-run setup() on the singleton. The behavior appends \u0027via CLI\u0027 to the log description for shell-originated rows, mirroring the request_type = CLI marker in the new audit engine. The CLI shell now publishes the impersonated user through both Configure::write(\u0027CurrentUserId\u0027) and SysLogLogableBehavior::setShellUser() before any write. Explicit extralog calls were added for CLI user edit, disable, and delete operations so the default audit engine records them the same way the web path does. Background jobs that publish no user continue to log as SYSTEM without a CLI marker."
        }
      ],
      "title": "MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The tag_version_boundary indicates the fix commit is 183 commits after tag v2.5.46, suggesting the fix landed in a version after 2.5.46; however, no explicit fixed version tag is provided, so the exact boundary is uncertain.",
                  "The affected version range is assumed to be all versions prior to the fix commit; the patch does not specify a minimum affected version.",
                  "CVSS PR:H assumes that CLI shell access is equivalent to site-admin-equivalent access, consistent with the project\u0027s own CLI_usage.md documentation stating that running cake requires reading database.php and that the shell should not be exposed to anyone who must not have site-admin-equivalent access.",
                  "The SI:L rating assumes the audit-log inaccuracy is a secondary integrity impact on the logging subsystem rather than a primary integrity impact on the MISP application data.",
                  "The patch does not include a CVE or GCVE identifier; this analysis is a draft for CNA/GNA review."
                ],
                "commit": "d13e5db33faa8eb27c945d6561badc24f00b2cda",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Scottish Government - National Cyber Team"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Fable 5.1"
                  }
                ],
                "cvssRationale": "Attack vector is Local because the CLI shell requires direct access to the MISP host and the ability to run the cake console command. Attack complexity is Low because no race condition or special timing is needed; the identity loss occurs deterministically on the first lazy model load. No attack target is required. Privileges Required is High because running the CLI shell requires reading app/Config/database.php and passing a user ID, which the project documentation equates to site-admin-equivalent access. No user interaction is needed. There is no direct confidentiality, integrity, or availability impact on the MISP application itself. The secondary integrity impact is Low: the audit log data is inaccurate (wrong user attribution, missing CLI marker, missing user-management entries), which degrades forensic and compliance capability but does not corrupt application data. No secondary availability impact.",
                "draft": false,
                "fixSummary": "The fix introduces a process-wide static identity (setShellUser) on SysLogLogableBehavior that is resolved at write time rather than at setup time, so it survives lazy model loads that re-run setup() on the singleton. The behavior appends \u0027via CLI\u0027 to the log description for shell-originated rows, mirroring the request_type = CLI marker in the new audit engine. The CLI shell now publishes the impersonated user through both Configure::write(\u0027CurrentUserId\u0027) and SysLogLogableBehavior::setShellUser() before any write. Explicit extralog calls were added for CLI user edit, disable, and delete operations so the default audit engine records them the same way the web path does. Background jobs that publish no user continue to log as SYSTEM without a CLI marker.",
                "generatedAt": "2026-09-14T12:23:30.990762Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "8ea0cae590f0d9a3a2fa579b800f69fb5f5f8c9083de74df05945869dd3e91bf",
                "patchSummary": "In cli_common.php, __setUserContext() was replaced: instead of iterating loaded models and setting the user on each SysLogLogable behavior instance, it now calls Configure::write(\u0027CurrentUserId\u0027, $user[\u0027id\u0027]) and SysLogLogableBehavior::setShellUser($user). In SysLogLogableBehavior.php, a private static $shellUser property and setShellUser() static method were added; _saveLog() now resolves the actor via shellActor() at write time when CAKEPHP_SHELL is defined, and appends \u0027 via CLI\u0027 to the description. setup() was refactored to use the same shellActor() helper. In cli_users.php, __logUserEdit() was added to write an extralog row for user edits and disables, and __deleteUser() now calls extralog for permanent deletions. A new test file SysLogLogableShellIdentityTest.php (395 lines) covers identity persistence across lazy model attaches, CLI marker presence/absence, SYSTEM fallback, and web-request isolation. CLI_usage.md documents the audit-trail behavior.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "d13e5db33faa8eb27c945d6561badc24f00b2cda",
                    "patchSha256": "8ea0cae590f0d9a3a2fa579b800f69fb5f5f8c9083de74df05945869dd3e91bf",
                    "source": "https://github.com/MISP/MISP/commit/d13e5db33.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/d13e5db33.patch",
                    "subject": "fix: [cli] Attribute interactive CLI shell writes stably and"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/d13e5db33.patch",
                "subject": "fix: [cli] Attribute interactive CLI shell writes stably and",
                "tagVersionBoundary": {
                  "commits_after_fix": 183,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-778",
                    "rationale": "The CLI shell\u0027s audit rows lost the impersonated user identity after the first lazy model load (reset to SYSTEM), and user-management operations (edit, disable, delete) performed via CLI produced no audit row at all in the default engine. Both are failures to record security-relevant events with sufficient detail."
                  },
                  {
                    "cweId": "CWE-223",
                    "rationale": "Audit rows written by the CLI shell carried no marker distinguishing them from web-originated actions. In the default engine the description lacked \u0027via CLI\u0027; in the new engine request_type was not set to CLI. This omission prevents an investigator from determining the true origin of an action."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20197"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-90955",
    "datePublished": "2026-09-14T12:37:54.001Z",
    "dateReserved": "2026-09-14T12:37:52.348Z",
    "dateUpdated": "2026-09-14T13:00:29.069Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.