CVE-2026-112192: MISP 0 to before 2.5.48

Affected technology

MISP · 0 to before 2.5.48
MISP

Component: app/Model/Server.php (readModuleSettings)
File: app/Model/Server.php

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access. Source advisory’s CVSS 4.0 assessment (base score 5.3/10) rates confidentiality and availability impact as low; integrity impact as none.