MISP EUVD-2026-70503

Exploitation requires an authenticated MISP user (PR:L per CVSS) with permission to modify dashboard widget settings. The attacker must specifically use the updateSettings() whole-layout save path rather than updateWidgetSettings() to bypass the pre-patch validation gap. A victim user must subsequently load the dashboard containing the malicious ButtonWidget. Critically, successful script execution further requires that a rendering or navigation code path is reached without MISP's existing render-time URL validation - the description explicitly states this runtime check neutralized known malicious values, meaning the persistence gap alone did not constitute a confirmed end-to-end exploit. Exploitation is not possible against default configurations without a logged-in user with dashboard-configuration rights; unauthenticated remote exploitation is not possible.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N) scoring 5.3 is somewhat generous given the significant mitigating factor explicitly documented in the description: MISP's render-time validation already blocked known malicious values before presentation, meaning the stored payload had to survive two independent validation gates to cause harm. The real-world risk profile is that of a defense-in-depth gap - the persistence layer stored invalid state that the rendering layer would have neutralized in known code paths. An independent CVSS 3.1 assessment would rate this AC:H (the practical exploit path requires a rendering or navigation path that bypasses the existing runtime check) and UI:R (a victim must interact with the malicious button). EPSS data is not provided, but given no KEV listing and no public exploit code, exploitation probability is low. Even a mid-sized municipal IT team in sopot running MISP for community threat sharing should treat this as a routine patch-cycle item rather than an emergency. The requirement for an authenticated user with dashboard-edit permissions further constrains the attacker population to insiders or compromised accounts. No active exploitation is confirmed, no POC is publicly referenced, and the fix is available via upstream commit.

An authenticated MISP user with dashboard-edit permissions uses the whole-layout updateSettings() endpoint - rather than the per-widget updateWidgetSettings() endpoint - to POST a ButtonWidget configuration containing a javascript:alert(document.cookie) URL; the unvalidated path accepts and persists the value. A privileged victim who later loads the dashboard and whose browser reaches a rendering or navigation path that does not apply MISP's existing runtime URL check would have the script execute in their MISP session context, potentially exposing session tokens or enabling unauthorized API actions. No public exploit code exists, and the existing render-time safeguard makes this scenario contingent on identifying a gap in that secondary layer.