MISP EUVD-2026-91743

Requires a non-default federated deployment: a linked/remote MISP server must be configured and connected to the local instance, and MISP.tagging must be enabled (the vulnerable onclick rendering is inside a Configure::read('MISP.tagging') block). The attacker must control that linked server to supply a crafted tag ID containing a single quote that breaks out of the onclick JavaScript string literal. Exploitation is further limited by requiring an authenticated local user to open the remote event preview page AND actively interact with (click) the malicious tag element (UI:A); it does not fire on passive page load alone. These factors - trusted-peer prerequisite, authenticated viewer, and required click - substantially narrow realistic exploitation beyond the raw network vector.

This is a genuinely medium/low real-world priority, not an overstated high-CVSS issue - the input CVSS 4.0 base score is only 4.8 (MEDIUM). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A) signals network reach but requires BOTH attacker privilege (PR:L) and active victim interaction (UI:A), and impact is limited to subsequent-system integrity (SI:L) with no confidentiality or availability loss declared by the vendor (VC:N/VI:N/VA:N/SC:N/SA:N). No EPSS score was provided in the input, so exploitation probability cannot be quantified. KEV status is absent (not listed) and no POC/exploit code is referenced - exploitation status is therefore 'no public exploit identified at time of analysis.' The dominant risk-limiting factor is architectural: the attacker must already control a linked/remote MISP server that the victim instance trusts and has connected to, which is a federation/peer relationship rather than anonymous internet access. Combined with the required authenticated viewer who must actively click the crafted tag element, realistic exploitation is narrow and targeted. No signals conflict; the main gap is the unconfirmed version boundary (fix stated as v2.5.48 or later, 'exact boundary unconfirmed').

An attacker who operates or has compromised a remote MISP instance that the victim organization has configured as a linked server publishes an event containing a tag whose ID value embeds a single quote and JavaScript payload. When an authenticated analyst on the local instance opens the remote event preview page and clicks the malicious tag element, the payload breaks out of the inline onclick JavaScript string and executes in the analyst's browser session. No public exploit code is identified at time of analysis, but the flaw and fix commit (70ad174dd) are public.