# CVE-2026-127016: MISP Modules Website: Missing Authorization on External Tool Management Endpoints

Status: published. Published: 2026-11-12. Updated: 2026-11-12.

The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application environment, the module configuration endpoints correctly required an authenticated administrator session, but the external tools management handlers processed requests from anonymous users without any authorization check. An unauthenticated attacker with network access to the website could add arbitrary external tools, delete existing tools, toggle their active status, and modify their configurations including API keys and ingestion URLs. This inconsistency allowed bypass of the intended access control for the external tools management functionality. The vulnerability is conditional on ADMIN_PASSWORD being set; installations without an admin password intentionally permit open management access by design. The affected component is the external_tools Flask blueprint within the MISP Modules website application.

## Remediation

- fix: A before_request authorization handler is added to the external_tools blueprint that checks whether the admin user is active (ADMIN_PASSWORD configured) and whether the current user is authenticated before any management endpoint executes. When both conditions indicate an unauthenticated request to a protected endpoint, the handler redirects to the login page (for the add endpoint) or returns a 403 Permission Denied response (for delete, status, and configuration endpoints). This enforces the same optional-admin policy already applied to module configuration, while preserving the existing open-management behavior when no admin password is configured. (source: CNA: CIRCL)
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: CIRCL) — https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027

## Affected products and versions

- misp / misp-modules: ≥ 0; ≤ 3.1.4 (affected, semver). Source: CNA: CIRCL

## Severity and prioritization

- CVSS 4.0: 9.2 (critical); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:H/SA:N; source: CNA: CIRCL

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation none; automatable yes; technical impact total; source CNA: CIRCL

- Weaknesses: CWE-862

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027 (CNA: CIRCL; patch)

## Provenance

- CNA: CIRCL: https://www.cve.org/CVERecord?id=CVE-2026-127016; retrieved 2026-11-12; source updated 2026-11-12

Revision: e344a3b6115b74a25a1fe543e21ca46adc5fc35f9000464e3057af4bab5ba17b

Canonical: https://y2.dev/cve/CVE-2026-127016

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.