MISP CVE-2026-103389

Requires an authenticated MISP account holding the perm_galaxy_editor permission - notably granted to the stock User role, so any ordinary user on a multi-user instance qualifies. The attacker stores an HTML/JS payload in a galaxy's icon field via the galaxy add, edit, or sync/import capture endpoints. Execution is triggered only when a separate victim user actively opens the correlation graph (default or Overmind theme) of an event containing a cluster from the malicious galaxy (UI:A). Affects MISP versions before 2.5.48; single-user or trusted-editor-only deployments face limited risk since injection requires editor privileges.

This is a genuine but moderate-risk stored XSS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A) shows network reach and low complexity, but two factors constrain real-world impact: it requires an authenticated attacker holding perm_galaxy_editor (PR:L) and it requires a victim to actively open the correlation graph of an affected event (UI:A). The vendor's 6.2 score reflects the scope-changed impact on the victim's browser session (SC:H/SI:H) while the vulnerable server itself sees no direct confidentiality/integrity/availability loss (VC:N/VI:N/VA:N). No EPSS score, KEV listing, or standalone POC is provided; however, the patch commit ships a PHPUnit test embedding the exact reported payload ('x"></i><img src=x onerror="alert(location.href)"><i class="x'), which effectively serves as a working proof-of-concept for the injection. The mitigating detail - perm_galaxy_editor is granted to the stock User role - means the privilege bar is low for any multi-user MISP instance, raising insider/compromised-account risk above what PR:L alone suggests. Overall this is a real priority for shared/multi-tenant MISP deployments but not a mass-exploitation, unauthenticated-RCE class issue.

An authenticated MISP user with the default User role (which carries perm_galaxy_editor) creates or edits a galaxy and injects a JavaScript payload into the icon field, or pushes it via the sync/import capture path. When an analyst later opens the correlation graph of any event containing a cluster from that galaxy, the D3 rendering script concatenates the unvalidated icon into markup via .html() and the script executes in the analyst's session. The patch's test file embeds a working payload, effectively documenting the exploit.