CVE-2026-127016
MISP Modules Website: Missing Authorization on External Tool Management Endpoints
The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application environment, the module configuration endpoints correctly required an authenticated administrator session, but the external tools management handlers processed requests from anonymous users without any authorization check. An unauthenticated attacker with network access to the website could add arbitrary external tools, delete existing tools, toggle their active status, and modify their configurations including API keys and ingestion URLs. This inconsistency allowed bypass of the intended access control for the external tools management functionality. The vulnerability is conditional on ADMIN_PASSWORD being set; installations without an admin password intentionally permit open management access by design. The affected component is the external_tools Flask blueprint within the MISP Modules website application.
Fixes and workarounds
Fix
A before_request authorization handler is added to the external_tools blueprint that checks whether the admin user is active (ADMIN_PASSWORD configured) and whether the current user is authenticated before any management endpoint executes. When both conditions indicate an unauthenticated request to a protected endpoint, the handler redirects to the login page (for the add endpoint) or returns a 403 Permission Denied response (for delete, status, and configuration endpoints). This enforces the same optional-admin policy already applied to module configuration, while preserving the existing open-management behavior when no admin password is configured.
Source: CNA: CIRCLFix
The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.
Source: CNA: CIRCLAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| misp-modules misp |
≥ 0; ≤ 3.1.4 (affected, semver) | CNA: CIRCL |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 4.0 / 9.2 critical |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:H/SA:N | CNA: CIRCL |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.