PT-2026-40808 · Misp · Misp

Published 2026-05-13 · Updated 2026-05-13 · CVE-2026-44380

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.37

Description Improper access control in the authentication key reset functionality allows an authenticated organization administrator to reset authentication keys of site administrator accounts within the same organization. Since non-site administrators are not explicitly restricted from this action, an attacker with organization administrator privileges can obtain a newly generated authentication key for a higher-privileged account to escalate privileges.

Recommendations Update to version 2.5.37.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-44380

Affected Products

Misp

References · 3

• https://github.com/MISP/MISP/security/advisories/GHSA-3939-4g6m-m3hc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44380 · Security Note
• https://twitter.com/CVEnew/status/2054709208122339556 · Twitter Post