CVE-2026-54357 MISP improper authorization allows organization administrators to modify site administrator user settings
Organization administrators can improperly modify site administrator settings due to flawed access control checks, requiring a patch to enforce privilege boundaries.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54357?
CVE-2026-54357 is a medium-severity missing authorization vulnerability in misp, published on 12 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An improper authorization vulnerability in MISP allowed an authenticated organization administrator to access or modify user settings belonging to site administrator accounts within the same organization. The affected access-control checks scoped administrative actions by organization membership but did not exclude higher-privileged site administrator users. As a result, an organization administrator could potentially view or alter site administrator user settings and related login profile information, crossing the intended privilege boundary between organization administration and site-wide administration.
The patch hardens the ACL logic by excluding site administrator accounts from organization administrator–managed user sets, adding explicit authorization failure when a target user is not administrable, and ensuring user setting and login profile operations fail closed.
Which versions are affected by CVE-2026-54357?
How do I fix CVE-2026-54357?
No fix has been published for CVE-2026-54357 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-54357 being exploited?
There is no known exploitation of CVE-2026-54357 in the wild and no public exploit code.
Sources
Also known as GHSA-jfqf-9254-245v.