Which versions of MISP are affected by CVE-2026-9136?

MISP threat intelligence platform versions 2.5.0 through 2.5.37 contain an Insecure Direct Object Reference vulnerability allowing authenticated users to overwrite arbitrary threat intelligence…. A patch is available.

How to fix or mitigate CVE-2026-9136?

Within 24 hours: Inventory all MISP deployments and identify systems running versions 2.5.0 through 2.5.37. Within 7 days: Apply vendor-released patch per MISP security advisory and audit ShadowAttribute modification logs for unauthorized changes during the vulnerability window. Within 30 days: Restrict shadow attribute submission privileges to minimum-required personnel and implement change approval workflows for threat intelligence data modifications.

MISP CVE-2026-9136

Q: What is the CVSS score of CVE-2026-9136?

CVE-2026-9136 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31151 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-20 CIRCL

GHSA-hfjr-4239-84fm

Authentication Bypass Misp

8.3

CVSS 4.0 · Vendor: CIRCL

Severity by source

Vendor (CIRCL) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CIRCL) · only source for this CVE.

CVSS VectorVendor: CIRCL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 20, 2026 - 20:05 vuln.today

Analysis Generated

May 20, 2026 - 20:05 vuln.today

DescriptionCVE.org

A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action accepted user-controlled ShadowAttribute request data without removing the id field before saving the record. Because the underlying framework treats a supplied primary key as an instruction to update an existing record, an authenticated user able to submit shadow attribute proposals could provide the identifier of an existing ShadowAttribute and cause that record to be updated instead of creating a new proposal.

This can result in unauthorized modification of existing shadow attributes, potentially affecting proposals associated with events the user should not be able to alter. Depending on deployment configuration and accessible API responses, the issue may also expose or move proposal data across event contexts.

The vulnerability is caused by trusting a client-supplied primary key during object creation. The fix removes the id field from incoming ShadowAttribute data before processing, ensuring that the endpoint always creates a new proposal rather than updating an existing one. This has been fixed in MISP 2.5.38.

AnalysisAI

Insecure Direct Object Reference in MISP 2.5.0 through 2.5.37 allows authenticated users with shadow attribute submission privileges to overwrite arbitrary existing ShadowAttribute records by supplying a target id within the add proposal request. The framework's ORM interprets a client-supplied primary key as an update directive, breaking the boundary between proposal creation and modification. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform built on the CakePHP framework, which uses Active Record-style ORM semantics where a supplied primary key (id) on a save() call is interpreted as an UPDATE rather than an INSERT. The vulnerability is a textbook CWE-639 Authorization Bypass Through User-Controlled Key: the ShadowAttributesController::add() action in app/Controller/ShadowAttributesController.php accepted the entire request payload under the ShadowAttribute key without scrubbing the id field before passing it to the model layer. ShadowAttributes represent community proposals to edit existing event attributes, so manipulation of these records subverts MISP's review/approval workflow that data-sharing communities rely on for integrity.

RemediationAI

Vendor-released patch: upgrade to MISP 2.5.38 or later, which adds an explicit unset($this->request->data['ShadowAttribute']['id']) in the add() controller action before the save operation, ensuring proposal submissions always create rather than update records (see https://github.com/MISP/MISP/commit/49911b1d4b6e4517d803e50e3d980aaa4d37c16d). If immediate upgrade is not feasible, operators can apply the one-line cherry-pick of that commit to ShadowAttributesController.php, or temporarily restrict shadow attribute submission privileges to highly trusted users via the MISP role permissions interface (this disables a core collaborative proposal workflow and is only suitable as a short-term measure). Enabling audit logging on the ShadowAttributes table and reviewing recent UPDATE operations on shadow_attributes for anomalous edits by accounts that should only be inserting is recommended to detect any pre-patch abuse; expect log volume to grow noticeably on active instances.