MISP CVE-2026-95659

Exploitation requires: (1) an authenticated MISP account (PR:L) to reach the AnalystDataController::viewForObject / __hub action; (2) the target MISP instance running the Overmind theme, since the vulnerable sink is app/View/Themed/Overmind/Elements/AnalystData/thread.ctp specifically; (3) a separate authenticated victim who must actively click the attacker-supplied crafted URL (UI:A). The injection point is the parent object-type URL parameter, interpolated via strtolower($objectType) into the translated strings 'No analyst data attached to this %s yet.' and 'this %s' without h() encoding. Limiting factors: it is not remote-unauthenticated, it is not automatable against many victims at once, impact is confined to the victim's browser within the MISP origin, and instances not using the Overmind theme may not be affected. Affected versions are before 2.5.47.

This is a genuine but low-to-moderate priority issue. The vendor CVSS 4.0 base score of 4.8 reflects the real limiting factors encoded in the vector: PR:L (authenticated attacker) and UI:A (the victim must actively navigate to an attacker-crafted URL). Impact is bounded - VC:N/VI:N/VA:N on the MISP system itself, with only SC:L/SI:L on the subsequent system (the victim's browser session), which is exactly what a reflected XSS delivers. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no signal of active or automatable exploitation; the source-code diff is the only strong corroborating evidence. SSVC-style reasoning: exploitation=none observed, automatable=no (requires a per-victim social-engineering step to deliver the crafted URL), technical impact=partial. There is no conflict between the CVSS vector and the description - both agree on network delivery, authenticated attacker, and mandatory user interaction. The patch is confirmed (commit 23b879073), so the practical priority is 'patch on normal cadence' rather than emergency response, weighted by how sensitive the MISP instance's data and users are.

An authenticated but low-privileged MISP user crafts a URL to the AnalystData thread view with a malicious parent-object-type parameter containing JavaScript, then lures another logged-in MISP user (e.g. an analyst or admin) into clicking it. When the victim's browser renders the unencoded parameter inside the translated strings, the attacker's script executes in the MISP application origin, allowing session/data theft or actions performed as the victim. No public exploit code was provided, but the fixing commit diff clearly reveals the exact unencoded sink.