The vulnerability in MISP allows a user with a read‑only API key to gain the full permissions associated with their underlying account. The flaw is triggered when the updateLoginTime() method re‑authenticates the user, substituting the restricted API‑key permissions with the account’s normal role. An attacker who owns or can obtain a read‑only key, therefore, can effectively elevate privileges to write, delete, or even administrative levels. The impact is a loss of the intended restriction that API keys provide, thereby enabling unauthorized actions on the MISP instance.

This issue affects the MISP application, specifically versions older than 2.5.47. Any instance running these versions deploys the updateLoginTime() method that performs the re‑authentication step. The vulnerability is tied to the user authentication system within MISP and does not depend on external services.

The CVSS score of 8.7 classifies this as high severity. The EPSS score is not reported, indicating that no quantified exploitation probability is available, but the flaw can be exercised with a single API request once a read‑only key is in possession. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remotely via the MISP REST API, where an actor can send a crafted request to the updateLoginTime endpoint. The condition for exploitation is a valid read‑only API key associated with an account that has elevated roles.