An improper access control flaw in the authentication key reset functionality of MISP allows an authenticated organization administrator to reset authentication keys belonging to site administrator accounts within the same organization. The vulnerability hinges on the fact that non-site administrators can access or reset site administrator authentication keys without explicit restriction, enabling an attacker to obtain a newly generated key for a higher‑privileged account. The attacker could then log in with that key and gain full site administrator privileges, compromising confidentiality, integrity, and availability of the entire site. This flaw is defined as CWE‑863.

The issue affects installations of the MISP threat intelligence platform running any version prior to 2.5.37. Users of earlier releases that have enabled the authentication key reset feature without restricting access to site administrators are at risk.

The CVSS score of 8.6 classifies the vulnerability as high severity. The EPSS score is not available, and the flaw is not yet listed in CISA KEV. The likely attack vector requires the victim to be authenticated as an organization administrator; from there the attacker can trigger the key reset and obtain privileged access. Because the flaw permits full administrative control once exploited, the impact is critical for the affected system.