EUVD-2026-38225
GHSA-mf7v-x7r6-fq57
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain authenticated MISP account
-
DeliveryIdentify victim object IDs via API enumeration
-
ExploitCraft REST payload with injected primary/foreign keys
-
InstallSubmit to edit/import endpoint
-
C2CRUDComponent mass-assigns IDs to save()
-
ExecuteVictim row overwritten or re-parented
-
ImpactPoisoned intel propagates via federation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Attacker must hold a valid authenticated MISP account with edit permission on at least one object on the target instance (the normal state for any MISP user, including federated sync users and low-privileged contributors); no admin role, no user interaction, and no special site configuration is required. Exploitation targets the REST API or web form handlers on core controllers (events, objects, proposals, galaxy clusters, organisations) and requires crafting a payload that includes ownership/scope foreign keys (id, event_id, org_id, user_id, sharing_group_id, galaxy_cluster_uuid, organisation_uuid) pointing at a victim row. Limiting factors: the attacker must already have an account on the target MISP instance (so internet-anonymous mass exploitation is not possible), and the specific impact depends on which controller is targeted - some paths yield ownership transfer, others only object overwrite or proposal retargeting. |
| Impact | Real-world risk is high for any MISP instance with multiple users or organizations, because the prerequisite (any authenticated account with edit access to at least one object) is the normal state for every MISP user. CVSS 4.0 of 9.4 with AV:N/AC:L/AT:N/PR:L/UI:N and VC/VI/VA/SC/SI/SA all High accurately captures the cross-tenant blast radius: a low-privileged user can compromise confidentiality, integrity, and availability of subsequent systems (other organizations' data sharing scopes). EPSS and CISA KEV status were not provided in the input, so widespread automated exploitation cannot be confirmed; absence of POC reporting suggests this is presently a disclosed-but-not-yet-weaponized class of bugs. No conflicting signals - the network-vector rating is consistent with MISP's typical web/REST exposure, and the PR:L assignment is justified because any authenticated user qualifies. The dominant priority driver is that MISP instances often federate sensitive threat intel across organizations, so even quiet abuse (ownership transfer, proposal retargeting) can poison shared intelligence undetected. |
| Exploit ScenarioDerived | An attacker registers or compromises a low-privileged MISP user account on a federated instance, then issues a REST PUT/POST to an edit endpoint they are authorized to touch (e.g., editing one of their own events) while embedding a different organization's event_id or object id in the JSON body. MISP's CRUDComponent::edit() loads the attacker's authorized row, passes the check, then save()s the payload - including the injected primary key - overwriting or re-parenting the victim organization's object, transferring ownership, or scoping it to an attacker-controlled sharing group. No public exploit identified at time of analysis, but the patch diff itself documents the primitive clearly enough that exploitation is straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 22, 2026
Insecure direct object reference flaws in MISP threat-intelligence platform allow an authenticated user with access to any one authorized object to overwrite, re-parent, or transfer ownership of objects belonging to other users or organizations by submitting crafted REST/form payloads containing attacker-chosen primary keys and ownership foreign keys. The root cause is CRUDComponent::edit() mass-assigning payload-supplied IDs (id, event_id, org_id, user_id, sharing_group_id, etc.) onto the already-loaded record, so CakePHP's save() updates a different row than the one the authorization check validated. No public exploit identified at time of analysis, but a vendor patch is available and the high CVSS 4.0 score of 9.4 reflects broad cross-tenant impact.
RemediationAI
Upstream fix available (commits, not a tagged release announced in the input); released patched version not independently confirmed - administrators should pull the listed MISP/MISP commits (starting with 7acf8220cafac58bcfb362da37aca512fe4bb396 and the 14 companion commits referenced in the CVE) or upgrade to the next MISP point release that incorporates them, per https://github.com/MISP/MISP/commit/7acf8220cafac58bcfb362da37aca512fe4bb396. Until patched, compensating controls include restricting MISP user accounts to trusted personnel only, disabling REST API tokens for non-essential users (trade-off: breaks automation), placing the MISP web UI behind an authenticating reverse proxy with per-org IP allow-listing (trade-off: blocks legitimate federated sync if misconfigured), and increasing audit-log review on Event/Object/Proposal modifications and sharing-group changes to detect ownership-transfer abuse (trade-off: detective only, does not prevent exploitation). Avoid relying on user-role downgrades alone, since any authenticated edit-capable role is sufficient to exploit.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MISP is an open-source threat-intelligence sharing platform built on CakePHP; multi-tenant data isolation depends on each controller loading the target row, checking the caller's permissions against that row, and then saving updates to only that row. The vulnerability is a textbook CWE-639 (Authorization Bypass Through User-Controlled Key) caused by CakePHP's save() treating any 'id' (or scoping foreign key) present in the input array as the UPDATE target. Because multiple core controllers - including event, object, proposal, galaxy-cluster, and organisation import/edit paths - passed unfiltered request data straight into save(), the authorization layer validated row A while the database write landed on row B. The central fix in CRUDComponent::edit() captures the loaded record's primary key into $massAssignSafeId before save and re-pins it afterward, with companion commits adding field whitelists for ownership/sharing-group fields and re-pinning route-authorized identifiers across create and import flows. The CPE cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* indicates all MISP versions prior to the patched releases are in scope.
Know when Misp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Network-reachable REST endpoints (AV:N), any authenticated edit-capable user suffices (PR:L, AC:L), no UI; authorization bypass crosses tenant boundary so S:C, with full CIA impact on other orgs' data.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
DescriptionCVE.org
Multiple MISP core controllers and model capture paths accepted client-controlled request fields such as primary keys (id) and ownership/scope foreign keys (event_id, org_id, user_id, sharing_group_id, galaxy_cluster_uuid, organisation_uuid, and related nested object identifiers) without consistently stripping, pinning, or revalidating them against the server-authorized object.
In affected paths, an authenticated user with access to one authorized object could submit crafted REST or form payloads that caused MISP to save data against a different object than the one checked by the authorization logic. Depending on the endpoint, this could allow object overwrite, object re-parenting, ownership transfer, unauthorized sharing-group scoping, event/object injection, proposal retargeting, or stored attacker-controlled content appearing in another user’s context.
The fixes harden affected create/edit/import flows by stripping client-supplied primary keys on create-only saves, re-pinning route- or database-authorized identifiers before save operations, validating effective sharing-group scope, and adding field whitelists where ownership fields must never be editable. The initial broad fix also added a central CRUDComponent::edit() primary-key re-pin so payload-supplied IDs cannot redirect saves away from the already-authorized row. GitHub’s patch for 7acf8220c describes this central issue as CRUDComponent::edit() copying supplied fields, including a payload primary key, onto the loaded record, allowing CakePHP save() to update an arbitrary row unless the loaded ID is re-pinned.
Executive ViewAI
CVE-2026-56422 is a critical authorization bypass in MISP threat-intelligence platforms that allows authenticated users to modify, steal, or transfer ownership of threat intelligence objects belonging to other users and organizations through request manipulation. Organizations operating MISP instances face compromise of the integrity and confidentiality of shared intelligence data, potentially exposing sensitive threat information to unauthorized users and enabling adversaries to poison threat feeds used by downstream security teams.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
An issue was discovered in MISP 2.4.9x before 2.4.99. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
An issue was discovered in MISP before 2.4.158. Rated critical severity (CVSS 9.8), this vulnerability is remotely explo
app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_de
SQL injection in MISP threat intelligence platform versions prior to 2.5.37 allows remote unauthenticated attackers to m
An issue was discovered in MISP before 2.4.158. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitab
MISP 2.4.172 mishandles different certificate file extensions in server sync. Rated high severity (CVSS 7.5), this vulne
In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call. R
An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. Rated critical severity (CVSS 9.8), this v
An issue was discovered in MISP 2.4.128. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyEleme
app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data rel
MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value. Rated
Exploit-DB