{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-127016", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "state": "PUBLISHED", "assignerShortName": "CIRCL", "dateReserved": "2026-11-12T09:45:10.065Z", "datePublished": "2026-11-12T09:45:17.779Z", "dateUpdated": "2026-11-12T09:49:48.735Z" }, "containers": { "cna": { "descriptions": [ { "lang": "en", "value": "The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application environment, the module configuration endpoints correctly required an authenticated administrator session, but the external tools management handlers processed requests from anonymous users without any authorization check. An unauthenticated attacker with network access to the website could add arbitrary external tools, delete existing tools, toggle their active status, and modify their configurations including API keys and ingestion URLs. This inconsistency allowed bypass of the intended access control for the external tools management functionality. The vulnerability is conditional on ADMIN_PASSWORD being set; installations without an admin password intentionally permit open management access by design. The affected component is the external_tools Flask blueprint within the MISP Modules website application." } ], "affected": [ { "product": "misp-modules", "cpes": [ "cpe:2.3:a:misp:misp-modules:*:*:*:*:*:*:*:*" ], "versions": [ { "version": "0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "3.1.4" } ], "modules": [ "external_tools" ], "programFiles": [ "website/app/external_tools/external_tools.py" ], "repo": "https://github.com/MISP/misp-modules", "vendor": "misp" } ], "references": [ { "url": "https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027", "name": "Security patch", "tags": [ "patch" ] } ], "x_gcve": [ { "recordType": "advisory", "extensions": { "bcp-05-x-01": { "ai_annotations": [ { "scope": "record", "gna_source": 1, "tags": [ "ai-computer-assisted:llm-generated", "ai-computer-assisted:classification" ], "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "ai_level": "generated", "review_status": "full", "models": [ { "name": "qwen3.8:27b", "gna_source": 1, "source": "ollama", "identifier": "qwen3.8:27b" } ] } ] }, "bcp-05-x-02": { "x_patch2vuln": { "generator": "patch2vuln.py", "generatedAt": "2026-11-12T08:59:10.622852Z", "model": "qwen3.8:27b", "source": "https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027.patch", "patchSha256": "a7fa238950e4db922c8ad604a6abe453385d29b8a6bcc58762a4fe72add73775", "patchTruncated": false, "commit": "28c27e30f6d3a10e38fe9c54bb52f57ccf70d027", "subject": "fix: [website] authorize external tool management", "patches": [ { "source": "https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027.patch", "sourceUrl": "https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027.patch", "patchSha256": "a7fa238950e4db922c8ad604a6abe453385d29b8a6bcc58762a4fe72add73775", "commit": "28c27e30f6d3a10e38fe9c54bb52f57ccf70d027", "subject": "fix: [website] authorize external tool management", "date": "Thu, 12 Nov 2026 09:37:23 +0100", "retrievedAt": "2026-11-12T08:58:21.777259Z" } ], "confidence": "medium", "assumptions": [ "The CAPEC mapping to CAPEC-1 (Software Feature Discovery) is the closest available pattern; no CAPEC specifically models exploitation of a missing authorization check on a discovered endpoint. The mapping is uncertain but is the best fit given the attack sequence of discovering and then invoking unauthenticated management endpoints.", "CVSS SI:H assumes that external tools in MISP feed into a broader data ingestion pipeline whose integrity is affected by unauthorized modification of tool configurations. If external tools are isolated to a single instance with no downstream consumers, SI could be reduced.", "The vulnerability is conditional on ADMIN_PASSWORD being configured. Installations without ADMIN_PASSWORD intentionally allow open management access by design and are not considered vulnerable.", "No specific version boundaries are identified in the patch; the affected version range is unspecified.", "The patch references issue #816 in the MISP/misp-modules repository, but no additional context about the issue tracker entry is available to confirm reporter or finder credits." ], "fixSummary": "A before_request authorization handler is added to the external_tools blueprint that checks whether the admin user is active (ADMIN_PASSWORD configured) and whether the current user is authenticated before any management endpoint executes. When both conditions indicate an unauthenticated request to a protected endpoint, the handler redirects to the login page (for the add endpoint) or returns a 403 Permission Denied response (for delete, status, and configuration endpoints). This enforces the same optional-admin policy already applied to module configuration, while preserving the existing open-management behavior when no admin password is configured.", "patchSummary": "The patch adds a before_request decorator on external_tools_blueprint in website/app/external_tools/external_tools.py that imports current_user from flask_login and admin_user_active from app.utils. The handler checks if the request endpoint is one of the four management endpoints (add_external_tool, delete_tool, change_status, change_config) and if the admin user is active but the current user is not authenticated, it either redirects to the login page or returns a 403 JSON response. The patch also adds a new test file website/tests/external_tools_checks.py with regression tests verifying that anonymous mutations are denied even with valid CSRF tokens, that authorization precedes JSON validation, that authenticated admins can perform all operations, and that the open-management policy is preserved when no admin password is set. The README is updated to document the new authorization requirement.", "credits": [ { "lang": "en", "value": "Alexandre Dulaunoy", "type": "remediation developer" } ], "cvssRationale": "AV:N: The vulnerability is exploitable over the network via HTTP requests to the website. AC:L: No special conditions are required; standard HTTP POST/GET requests to known endpoints suffice. AT:N: No attack target manipulation is needed. PR:N: No privileges are required; the attack works as an anonymous user. UI:N: No user interaction is required. VC:L: Tool configurations including API keys and URLs are accessible/modifiable by the attacker. VI:H: The attacker can add, delete, and modify external tools, fully compromising the integrity of the tool management function. VA:L: Deleting or disabling tools reduces availability of data ingestion. SC:N: No secondary system confidentiality impact identified. SI:H: External tools feed into the broader MISP data pipeline; modifying them can corrupt or redirect data ingestion for the entire MISP instance. SA:N: No secondary availability impact beyond the direct effect.", "ssvc": { "version": "2.0.3", "role": "Supplier", "timestamp": "2026-11-12T08:59:10Z", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "total" } ] }, "weaknessRationale": [ { "cweId": "CWE-862", "rationale": "The external tools management endpoints (add, delete, change_status, change_config) lacked an authorization check that would verify the requester is an authenticated administrator when the admin-login policy is active. The authentication mechanism (flask_login, ADMIN_PASSWORD) existed in the application but was not applied to these specific endpoints, allowing anonymous users to perform privileged management operations." } ], "capecRationale": [ { "capecId": "CAPEC-1", "rationale": "The closest available CAPEC pattern is Software Feature Discovery, as the attacker must identify the external tools management endpoints (e.g., /add_external_tool, /external_tools//delete_tool, /external_tools/change_status, /external_tools/change_config) and then issue unauthenticated requests to them. The vulnerability is exploited by discovering that these management functions are accessible without the authorization that the application's own documentation and parallel module-configuration endpoints imply. No CAPEC specifically models 'missing authorization on a discovered endpoint,' so CAPEC-1 is the best available match for the discovery-and-exploitation sequence." } ], "draft": false, "modelComparison": { "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.", "rankings": [ { "model": "qwen3.8:27b", "score": 7, "agreementScore": 11, "confidence": "medium", "assumptionCount": 5 } ], "potentialErrors": [] } } }, "bcp-05-x-03": { "x_timeline": { "events": [ { "type": "fix-developed", "timestamp": "2026-11-12T08:37:23Z", "description": "Corrective change authored (28c27e30f6d3a10e38fe9c54bb52f57ccf70d027): fix: [website] authorize external tool management", "references": [ "https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027.patch" ], "id": "evt-fix-developed-1" }, { "id": "evt-fix-available-1", "type": "fix-available", "timestamp": "2026-11-12T08:58:21.777259Z", "description": "Patch retrieved from the supplied URL; retrieval time is used as the default availability time.", "references": [ "https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027.patch" ] } ] } } }, "vulnId": "gcve-1-2026-20323" } ], "title": "MISP Modules Website: Missing Authorization on External Tool Management Endpoints", "problemTypes": [ { "descriptions": [ { "lang": "en", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "type": "CWE" } ] } ], "metrics": [ { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV4_0": { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:H/SA:N", "baseScore": 9.2, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED" } }, { "format": "SSVC", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "other": { "type": "SSVC", "content": { "version": "2.0.3", "role": "Supplier", "timestamp": "2026-11-12T08:59:10Z", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "total" } ] } } } ], "solutions": [ { "lang": "en", "value": "A before_request authorization handler is added to the external_tools blueprint that checks whether the admin user is active (ADMIN_PASSWORD configured) and whether the current user is authenticated before any management endpoint executes. When both conditions indicate an unauthenticated request to a protected endpoint, the handler redirects to the login page (for the add endpoint) or returns a 403 Permission Denied response (for delete, status, and configuration endpoints). This enforces the same optional-admin policy already applied to module configuration, while preserving the existing open-management behavior when no admin password is configured." } ], "impacts": [ { "capecId": "CAPEC-1", "descriptions": [ { "lang": "en", "value": "CAPEC-1 Software Feature Discovery" } ] } ], "credits": [ { "lang": "en", "value": "Alexandre Dulaunoy", "type": "remediation developer" } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:misp:misp-modules:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "3.1.4" } ] } ] } ], "providerMetadata": { "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-11-12T09:49:48.735Z" } } } }