MISP CVE-2026-104900

Exploitation requires a fully pre-established trust chain: (1) a linked/remote MISP server must be configured and connected to the local instance; (2) the attacker must already hold an account with permission to create or modify events on that remote server (PR:L - not anonymous); and (3) a victim user on the local instance must actively open the remote event preview index page, which renders the vulnerable count field. These limiting factors - the required remote-server access, the specific sync/link configuration, and the dependency on a victim navigating to the preview index - substantially constrain real-world exploitability. Fixed in MISP 2.5.48; instances below that version with remote-event feeds/servers configured are exposed.

This is a moderate-severity stored XSS (CWE-79) with no signals of elevated real-world risk. There is no public exploit identified at time of analysis and no CISA KEV listing, and no EPSS score was provided in the input, so exploitation-probability signals are simply absent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, base 5.3) correctly reflects limited impact confined to subsequent-system (victim browser/session) integrity and confidentiality, with no impact to the vulnerable system itself. The most important mitigating factor is the chained precondition set: the attack requires AV:N but PR:L on a *remote/linked* MISP instance plus a specific trust relationship, which materially narrows the realistic attacker population versus a typical anonymous web XSS. One note of caution: the published 4.0 vector uses UI:N, but the CVE preconditions explicitly state a victim user must view the remote event preview index page - that is effectively user interaction, so the no-interaction scoring arguably understates the dependency on victim behavior. Overall this is a legitimate finding to patch during normal maintenance, not an emergency; it is a high-trust-context, multi-precondition issue rather than a widely-exploitable network vulnerability.

An attacker who controls (or has an event-editing account on) a remote MISP server that is linked to a victim's local instance creates an event whose identifier contains malicious HTML/JavaScript. When an analyst on the local MISP instance opens the remote event preview index, the count field renders the unescaped identifier and the script executes in the analyst's authenticated session. No public exploit code is identified at time of analysis, though the root cause and fix are visible in the vendor commit.