CVE-2026-90955 PUBLISHED

MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load

Assigner: CIRCL
Reserved: 14.09.2026 Published: 14.09.2026 Updated: 14.09.2026

Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging.

The shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user.

Version affected: ≤2.5.45

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS Score: 4.6

Product Status

Vendor MISP
Product MISP
Versions
  • affected from 0 to 2.5.46 (excl.)

Solutions

The fix introduces a process-wide static identity (setShellUser) on SysLogLogableBehavior that is resolved at write time rather than at setup time, so it survives lazy model loads that re-run setup() on the singleton. The behavior appends 'via CLI' to the log description for shell-originated rows, mirroring the request_type = CLI marker in the new audit engine. The CLI shell now publishes the impersonated user through both Configure::write('CurrentUserId') and SysLogLogableBehavior::setShellUser() before any write. Explicit extralog calls were added for CLI user edit, disable, and delete operations so the default audit engine records them the same way the web path does. Background jobs that publish no user continue to log as SYSTEM without a CLI marker.

Credits

  • Scottish Government - National Cyber Team reporter
  • iglocska remediation developer
  • Claude Fable 5.1 remediation developer

References

Problem Types

  • CWE-778 Insufficient Logging CWE
  • CWE-223 Omission of Security-relevant Information in Log Data CWE