{"id":"EM-20261112-L5V0","url":"https://cyber.eventmonitor.net/incident/EM-20261112-L5V0/critical-vulnerability-cve-2026-127016/","type":"cve","title":"Critical Vulnerability (CVE-2026-127016)","subtitle":"CVE-2026-127016","subject":"CVE-2026-127016","status":"Developing","severity":"critical","affected":[],"headline":null,"born":"2026-11-12T10:17:28.960Z","firstSignal":"2026-11-12T09:45:17.000Z","lastSignal":"2026-11-12T10:17:28.960Z","updated":"2026-11-12T11:08:50.426Z","revision":1,"life":[{"status":"Born","at":"2026-11-12T10:17:28.960Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-12T10:17:28.960Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-12T09:45:17.000Z","what":"First signal: C8 EU Vulnerability Database (EUVD)"},{"at":"2026-11-12T10:17:28.960Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261112-L5V0 created."}],"stages":[{"name":"Disclosed","at":"2026-11-12T10:17:28.960Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-12T10:17:28.960Z","detail":"CVSS 9.2"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-12T09:45:17.000Z","source":"C8","sourceName":"EU Vulnerability Database (EUVD)","role":"Database","severity":4,"title":"EUVD-2026-124335 / CVE-2026-127016 (score 9.2)","text":"The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application environment, the module configuration…","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124335"},{"at":"2026-11-12T10:17:28.960Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":4,"title":"CVE-2026-127016 (CVSS 9.2)","text":"The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application environment, the module configuration endpoints correctly required an authenticated administrator session, but the external tools management handlers processed requests from anonymous users without any authorization check. An unauthenticated attacker with network access to the website could add arbitrary external tools, delete existing…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127016"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-12T10:17:28.960","score":9.2,"severity":"CRITICAL","desc":"The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application environment, the module configuration…","product":"","seen":1794481730426},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}