Which versions of MISP are affected by CVE-2026-10868?

MISP threat intelligence platform through version 2.5.38 contains a critical privilege escalation vulnerability allowing authenticated users to modify other users' accounts without authorization.

How to fix or mitigate CVE-2026-10868?

Within 24 hours: Identify all MISP deployments and current versions; review authentication and edit request logs for suspicious User.id parameter modifications; restrict platform access to essential personnel only. Within 7 days: Deploy input validation or WAF rules to restrict User.id parameters to the authenticated user's own ID; enable detailed logging of all account edit operations. Within 30 days: Monitor vendor advisory for patched release; apply patch immediately upon availability; conduct comprehensive account audit for unauthorized modifications.

MISP CVE-2026-10868

Q: What is the CVSS score of CVE-2026-10868?

CVE-2026-10868 has a CVSS 4.0 base score of 9.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34289 CRITICAL

Improper Privilege Management (CWE-269)

2026-06-04 CIRCL

GHSA-h7wj-m45x-884x

Privilege Escalation Misp

9.0

CVSS 4.0 · Vendor: CIRCL

Severity by source

Vendor (CIRCL) PRIMARY

9.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CIRCL) · only source for this CVE.

CVSS VectorVendor: CIRCL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 04, 2026 - 18:15 vuln.today

Analysis Generated

Jun 04, 2026 - 18:15 vuln.today

CVSS changed

Jun 04, 2026 - 16:22 NVD

9.0 (CRITICAL)

CVE Published

Jun 04, 2026 - 14:39 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A mass assignment vulnerability exists in the MISP user edit functionality due to insufficient filtering of user-supplied fields in UsersController::edit(). When processing edit requests, the application accepted a user-controlled User.id value from request data. An authenticated attacker could craft a modified request containing another user identifier, potentially causing updates to be applied to an unintended user account. Depending on the editable fields and the attacker’s privileges, this could allow unauthorized modification of user account attributes and impact account integrity.

The issue was addressed by explicitly removing the User.id field from request data before processing the user edit operation.

AnalysisAI

Privilege escalation in MISP threat intelligence platform versions through 2.5.38 allows authenticated users to modify other users' account attributes by submitting a crafted User.id parameter in edit requests. The UsersController::edit() function failed to strip user-supplied identifiers before processing, enabling cross-account modifications. No public exploit identified at time of analysis, but the source code fix is publicly visible in the upstream commit.

Technical ContextAI

MISP (Malware Information Sharing Platform) is an open-source threat intelligence sharing platform built on the CakePHP framework, identified by CPE cpe:2.3:a:misp:misp. The vulnerability is a classic CWE-269 (Improper Privilege Management) manifesting as a mass assignment flaw - a common pitfall in MVC frameworks where request data is bound directly to model fields without an allowlist. In CakePHP applications, when $this->request->data['User'] is passed to model save operations, any attacker-controlled field (including the primary key 'id') becomes part of the update statement, causing the ORM to target a different record than the authenticated session implies.

RemediationAI

Upstream fix available (commit 1be8c41 in the MISP/MISP repository); a released patched version tag was not independently confirmed from the provided data, but operators should upgrade to the first MISP release following 2.5.38 containing this commit, available via https://github.com/MISP/MISP/commit/1be8c413b7104a889dfd30c5b1986e3ab17238e8. As an interim workaround, administrators can apply the two-line patch manually (unset $this->request->data['User']['id'] at the top of UsersController::edit), audit the User table for unexpected modifications to admin accounts, rotate credentials for privileged users, and tighten account provisioning to reduce the pool of authenticated users who could abuse this until patched. Restricting self-service registration and reviewing community/organisation membership are useful compensating controls; the side effect is operational friction for legitimate users joining sharing communities.