MISP CVE-2026-104901

Three concrete conditions must all hold: (1) the host MISP instance must have at least one linked (remote) server configured - not a default state; (2) that linked server must be attacker-controlled or compromised so it can return a malicious event ID; and (3) the victim must be an authenticated user of the host instance who navigates to the ID Translator page for the relevant event (UI:A). Exploitation is therefore limited to federated deployments and gated by the trust placed in linked servers and by required victim interaction, substantially narrowing real-world exposure despite the network vector.

This is a stored/reflected cross-site scripting flaw (CWE-79) rated as medium severity (vendor CVSS 4.0 base 5.1). No EPSS score, KEV listing, or public POC was provided; the only exploitation signal is the vendor patch commit (bd5e80c84), so the status is no public exploit identified at time of analysis - do not treat it as actively exploited. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) marks it network-reachable with required victim interaction and subsequent-system (browser) confidentiality/integrity impact only, which aligns with XSS. However, the PR:N and AT:N choices understate real preconditions: exploitation depends on the host having a linked remote MISP server configured AND that server being malicious or compromised, which is a non-default, attacker-controlled-infrastructure requirement - a meaningful limiting factor the raw score does not reflect. Net assessment: a legitimate but not urgent issue - contained client-side impact, meaningful attack prerequisites, no evidence of exploitation - patch on a normal cycle, prioritizing instances federated with less-trusted partners.

An attacker who controls or has compromised a MISP server that the victim organization has configured as a linked (remote) server returns a crafted event ID containing HTML/JavaScript. When an authenticated analyst in the host organization opens the ID Translator page for the corresponding event, the unencoded event ID is rendered in their browser, executing attacker script for session hijacking or credential theft. No public exploit code was provided, but the patch diff clearly shows the missing output encoding.