MISP EUVD-2026-34289

Exploitation requires an authenticated session on a MISP instance running version 2.5.38 or earlier, network reachability to the /users/edit endpoint, and the ability to send a modified POST/PUT containing an attacker-controlled User[id] field in the request body. Limiting factors: the attacker must already possess valid MISP credentials (any role with access to the user edit form suffices); the impact ceiling depends on which fields the attacker's role is permitted to edit (lower-privileged roles may have a smaller writable field set), and successful escalation depends on the target user's existing role and the editable attributes available in the request.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/VC:L/VI:H/SI:H) yields a 9.0 base score driven by high integrity impact on both vulnerable and subsequent systems, with the AT:P (attack requirements present) reflecting that an attacker needs an authenticated session on the target instance. Note a discrepancy worth flagging: the vector lists PR:N (no privileges required) while the description explicitly requires an authenticated attacker - this likely reflects that any low-privileged authenticated user qualifies, not a true unauthenticated path. No EPSS, KEV, or SSVC data was provided. With no public exploit identified and exploitation requiring an existing MISP account, real-world risk is elevated for multi-tenant MISP communities (threat-sharing groups, ISACs) where lower-trust users could escalate against administrators, but lower for single-tenant deployments.

An attacker with any authenticated MISP account (for example a low-privileged community member) navigates to their own user edit page and intercepts the form submission, then injects a User[id] parameter pointing at an administrator's user ID. The crafted POST is accepted by UsersController::edit() and the ORM writes the attacker-supplied attribute changes (such as email, role association, or other editable fields) to the targeted administrator account, enabling account takeover or privilege escalation within the threat-sharing community.