MISP EUVD-2026-104139

Exploitation requires a specific, non-default trust chain: (1) the victim MISP instance must have an existing linked/synced MISP server relationship with the attacker-controlled instance; (2) the attacker must hold privileges to create or modify tags (specifically the tag 'colour' field) on that linked server; and (3) a local victim user must actively navigate to and view the remote event preview page (the preview_event.ctp view) for the attacker's event. Limiting factors that reduce real-world risk: the required linked-server trust relationship, the PR:L privilege needed on the remote side, mandatory victim user interaction (UI:A), affected versions below 2.5.48 only, and the fact that HTML entity encoding already blocks script/HTML injection - constraining impact to CSS-only effects (visual spoofing, UI manipulation, narrow information disclosure) rather than arbitrary JavaScript execution.

This is a genuinely medium/low-priority issue, not a high-impact emergency. The vendor-assigned CVSS 4.0 score is 4.8 (Medium), and the vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) tells a consistent story: there is NO confidentiality, integrity, or availability impact on the vulnerable MISP instance itself (VC/VI/VA all N), and only limited confidentiality and integrity impact on a subsequent system - the victim user's browser/session (SC:L/SI:L). Exploitation is not trivial: it requires PR:L (the attacker must hold privileges to create or modify tags on a linked, trusted MISP server) AND UI:A (a local victim user must actively view the remote event preview). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no signal of active or widespread exploitation. The signals are internally consistent - there is no CVSS-vs-description conflict here. The one nuance worth stating: this is CSS injection, NOT full JavaScript XSS (the source diff shows the tag colour is entity-encoded into an inline style attribute, so HTML/script injection is blocked, but CSS declarations are still interpreted). That caps the realistic impact at UI manipulation, visual spoofing, and narrow CSS-based information disclosure rather than code execution or session theft. Bottom line: a real but low-severity defect that should be patched in due course, not a drop-everything priority.

An attacker who administers (or has compromised) a MISP server that a victim organization has configured as a trusted sync/linked instance sets a malicious CSS payload as the colour value of a tag on an event. When an analyst at the victim organization opens that event in the remote event preview page, the injected CSS renders inside the inline style attribute, enabling visual spoofing or UI manipulation of the preview. No public exploit code was identified at time of analysis, but the source-code fix commit is public, which discloses the exact injection point.