MISP CVE-2026-95682

Two concrete prerequisites must both hold: (1) the attacker must have the ability to set or modify the MISP.org organization name setting, which is a privileged/admin configuration action (reflected as PR:H) rather than something an unauthenticated user can do; and (2) a second authenticated MISP user must subsequently load the affected admin email composition view (UI:P) for the stored payload to fire. The payload must contain a double-quote or backslash to break out of the double-quoted JavaScript string literal var org = "...";. Limiting factors: high privilege required to plant the payload, required victim interaction (visiting the admin email page), authenticated-only impact, and the availability of a vendor patch. This is not remotely exploitable against a default configuration by an anonymous user.

This is a genuine but low-priority stored XSS. The vendor CVSS 4.0 base score of 4.8 (medium) is realistic and I concur with it. The single most important limiting signal is PR:H: exploitation requires the ability to set or modify the MISP.org organization name, which is a site-admin-level configuration setting - so the attacker must already hold privileged access, sharply narrowing the threat population. Secondary limiters are UI:P (a second authenticated user must load the admin email page) and bounded impact (VC:L/VI:L/VA:N, a scope-crossing browser-context XSS, not code execution on the server). Exploitation status is 'no public exploit identified at time of analysis' - there is no EPSS score, no CISA KEV listing, and no POC referenced; only a vendor patch commit. There are no conflicting signals in the data: network vector, low complexity, high privilege, and limited impact are internally consistent. Net assessment: a real, patchable defect worth remediating on normal cadence, but not an urgent or widely-weaponizable issue - the high-privilege precondition means an attacker capable of exploiting it can often already act maliciously through the admin role.

A user with site-admin rights (or an attacker who has compromised such an account) sets the MISP organization name to a value like ";<script>...</script>//, breaking out of the double-quoted JavaScript string literal on the admin email composition page. When a second authenticated MISP user subsequently opens that admin email view, the injected script executes in their browser session, enabling session hijacking, data exfiltration, or actions performed as the victim. No public exploit code or POC is referenced in the provided data.