Misp
Monthly
MISP through 2.5.45 fails to enforce authorization checks when collection elements are created, allowing an authenticated user to persist a bare UUID referencing an Event or Galaxy Cluster they are not permitted to read. The collection view later resolves that UUID back into the underlying object, so collections become a handle on another organisation's private data — the patch notes this already caused org-only events to be disclosed in the beta collection view. Exploitation requires a valid MISP account and knowledge of the target UUID; no public exploit code or CISA KEV listing was identified at time of analysis, though the CVSS 4.0 vector (PR:L, VC:H) and EPSS-adjacent signals mark it as a meaningful confidentiality risk for shared threat-intel instances.
An authorization bypass in MISP through version 2.5.45 lets an authenticated user who can edit events assign an arbitrary sharing_group_id they are not authorized to use, because the authorization check only ran when the request explicitly supplied distribution = 4. If the caller omits the distribution field, MISP's field-recovery logic restores the event's stored distribution (4, for sharing-group events) and persists the unauthorized sharing group ID, silently re-scoping who can see that event and its threat-intelligence content. No public exploit code or active exploitation has been identified at time of analysis, but exploitation is a single crafted edit request, so the integrity impact (VI:H, CVSS 4.0 base 7.1) is significant for multi-tenant or community-sharing MISP instances.
Authentication bypass in MISP's optional LdapAuth and LinOTPAuth plugins (versions ≤2.5.45) lets a remote unauthenticated attacker log in as any user whose email they know, without a password. Because LdapAuthenticate and LinOTPAuthenticate reimplement CakePHP's FormAuthenticate but omit its _checkFields() non-empty-string guard, an empty/null password reaches ldap_bind() and - per RFC 4513 §5.1.2 - is treated as an unauthenticated bind that many directories accept as success; impersonation grants the victim's full privileges, potentially administrative. There is no public exploit identified at time of analysis, and SSVC lists exploitation as none, but the technical impact is rated total.
MISP's interactive CLI shell (≤2.5.45) enforces access control independently from the web application, creating at least six distinct authorization gaps that allow authenticated local users to retrieve sensitive credentials and bypass record-level ACLs. Feed HTTP authorization headers (Feed.headers), server synchronization authkeys, sharing-group memberships, and feed visibility restrictions are all enforced correctly in the web tier but not in the CLI, while the `use` command allows a user to establish an unauthorized record context without proving read rights. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the combination of plaintext credential disclosure and authorization bypass makes this a high-priority patch for any MISP deployment where non-site-admin personnel have shell access to the host.
Missing authorization in MISP's event template instantiation path allows authenticated users to write events into sharing groups they are not permitted to access, and to attach tags beyond their normal tagging permissions. Affected are all MISP deployments running version 2.5.45 and earlier. An attacker with a low-privilege account that can view a community-distributed template (distribution=1) may exploit the flaw to bypass `SharingGroup::canUse()` checks and additionally cause `local_only` tags to propagate globally through MISP's synchronization and export mechanisms, violating the isolation guarantees those tags exist to enforce.
Uncontrolled resource consumption in MISP ≤2.5.45 allows unauthenticated remote attackers to exhaust persistent storage by flooding the password-reset and related pre-authentication endpoints, each of which performs durable database writes before validating or throttling the caller. The `/users/forgot` endpoint accepted arbitrarily long, unvalidated email values and generated two write operations per request - an audit log entry and a queued background job - with no rate limit, enabling storage and job-queue exhaustion at modest request rates. The upstream fix (commit d75d899be, reported by CIRCL) adds a 1024-byte email length cap, format validation, a Redis-backed per-source flood filter with HTTP 429 responses, and a 15-minute API-access request cooldown; no public exploit or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in MISP ≤2.5.45 allows high-privileged users who configure threat intelligence feeds or TAXII discovery endpoints to cause MISP to make outbound HTTP requests to internal network resources and to exfiltrate configured feed authentication credentials to attacker-controlled hosts via unsanitized redirect following. A secondary incomplete SSRF defense in the TAXII discovery path failed to block IPv6 loopback (::1), hex-encoded addresses (0x7f000001), and multi-record DNS responses because it relied on gethostbyname() against a short literal blocklist. No public exploit code or active exploitation (CISA KEV) has been identified; patch commits are available upstream.
Missing authorization in MISP versions 2.5.45 and earlier exposes cryptographic signing key material - including raw key data, key type, and fingerprint - to any authenticated user on the platform, regardless of whether they are permitted to view the associated parent event. The CryptographicKeysController::view() handler fetched CryptographicKey records directly by supplied ID without resolving or authorizing the parent event, enabling cross-event key exfiltration within shared MISP instances. No public exploit has been identified at time of analysis; a patch is available in upstream commit 2edde619b.
Disk-exhaustion denial of service in MISP ≤2.5.45 is exploitable by any authenticated user, including read-only accounts, due to a wildcard ACL entry ('*') on the TemplatesController::uploadFile() endpoint. The handler writes uploaded content to app/tmp/files/ without verifying that the caller holds the perm_add or perm_template role, allowing repeated uploads to consume server disk space. The fix commit explicitly rules out escalation to RCE, stored XSS, or path traversal - impact is availability-only. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authorization bypass in MISP's UiBeta theme collection view exposes full event details - including identifiers, info fields, timestamps, creator organization, all event tags, and galaxy clusters - to authenticated users who lack ACL permissions to those events. The UiBeta theme's `view.ctp` template performed an independent secondary database query using only `Event.uuid IN (...)` without invoking `createEventConditions()`, the canonical per-user ACL enforcement method, even though `CollectionsController::view()` correctly filtered events via `Event::fetchSimpleEvents($user, ...)`. The flaw is compounded because `CollectionElementsController::add()` accepts arbitrary UUIDs from collection owners without validating the submitter's authorization against the referenced event, making collection elements an attacker-controlled input to an unfiltered query. No public exploit code has been identified at time of analysis and no CISA KEV listing exists.
Cross-site request forgery in MISP's sharing group quick-edit feature allows an unauthenticated attacker to manipulate threat intelligence sharing group membership by tricking a privileged MISP user into loading a crafted URL. The root cause is that HTTP method enforcement - which should have restricted the addOrg, removeOrg, addServer, and removeServer actions to POST-only - was commented out in the shared helper __initialiseSGQuickEdit(), leaving all four endpoints reachable via GET. Successful exploitation can silently add or remove organisations and servers from a sharing group, potentially exposing sensitive threat intelligence to unintended recipients or severing legitimate information-sharing relationships.
Incorrect authorization in MISP allows any authenticated user who is a member of an event-owning organization to delete individual attributes or perform bulk attribute deletion from that event, regardless of whether their assigned role carries `perm_modify` or `perm_modify_org` permissions. Three deletion controller actions in `AttributesController.php` - `delete()`, `deleteSelection()`, and `deleteSelected()` - relied only on organization membership checks inside `MispAttribute::deleteAttribute()` rather than on MISP's authoritative `ACL::canModifyEvent()` gate, which attribute editing operations correctly invoked. No public exploit has been identified, but the integrity impact is significant for any collaborative MISP deployment because deleted threat intelligence attributes cannot trivially be recovered.
Sharing Group authorization bypass in MISP allows an authenticated user with attribute or Galaxy Cluster creation permissions to associate objects with Sharing Groups they are not permitted to use. The flaw resides in AttributesController and GalaxyClustersController, where authorization checks against the Sharing Group were only invoked when the request explicitly set distribution == 4 - an attacker can craft a request containing sharing_group_id while omitting or manipulating the distribution parameter, causing the membership verification to be skipped entirely. Successful exploitation can silently breach organizational information-sharing boundaries, injecting data into restricted Sharing Groups and potentially distributing it to unauthorized member organizations. No public exploit has been identified at time of analysis.
Persistent denial of service in MISP's event template subsystem allows an authenticated user with event-template write permissions to store malformed JSON as a template definition by bypassing semantic validation. When any authenticated user subsequently loads the event template index - an endpoint accessible to all authenticated users - an unhandled exception in afterFind() causes HTTP 500 errors instance-wide until an administrator manually repairs the offending database row. The patch enforces strict array-only validation on save and adds exception handling on retrieval with graceful degradation to an empty definition.
Session fixation in MISP's optional CustomAuth flow lets an attacker who pre-plants a known session identifier silently inherit a victim's fully authenticated MISP session after the victim logs in, gaining all privileges of the victim's account including access to shared threat intelligence, event data, and administrative functions. The flaw is confined to deployments explicitly configured to use CustomAuth - standard authentication modes are unaffected. Vendor patch is available at commit e2eb2f058; no public exploit identified at time of analysis.
Unlimited OTP brute-force against MISP's email-based two-factor authentication allows an attacker holding valid primary credentials to bypass the second factor and fully compromise a target account. The email_otp() endpoint applied no rate limiting or lockout, and the OTP is scoped to the user rather than the login session - enabling multiple concurrent sessions to hammer the same valid OTP simultaneously. Patch available via commit 8658062ea; no public exploit identified at time of analysis.
CSRF in MISP's cullEmptyEvents endpoint allows a network attacker to trigger irreversible mass deletion of published empty events by causing an authenticated, privileged MISP user's browser to auto-request a crafted URL - for example via an embedded image tag. The endpoint accepted HTTP GET requests, which CakePHP's SecurityComponent does not CSRF-validate because GET requests carry no body, causing the framework's hasData check to return false and bypass token enforcement. The deletion is particularly destructive because it runs with skipBlocklist set, meaning purged events leave no blocklist entries to prevent or track subsequent re-synchronization; fix commits are available on GitHub, though the exact patched release version is not independently confirmed. No public exploit code is identified at time of analysis.
Improper TLS certificate validation in MISP's CurlClient class allows an adjacent-network attacker to perform man-in-the-middle attacks against outbound HTTPS connections made by the MISP instance, including threat intelligence synchronization. The PHP property `CurlClient::$verifyPeer` was left uninitialized, defaulting to null, which cURL interprets as falsy and therefore disables peer certificate verification. A successful attacker can observe authentication material and exchanged threat intelligence, and inject falsified data into MISP's responses from remote services. No public exploit has been identified; SSVC rates exploitation as none at time of analysis.
Authentication bypass in MISP's LDAP and LinOTP login components lets a remote unauthenticated attacker impersonate an existing directory user by submitting an empty password for a known account email. The custom LdapAuthenticate and LinOTPAuthenticate classes replaced CakePHP's FormAuthenticate but omitted its credential-validation guard, so empty or non-string values reached ldap_bind() (which succeeds against directories permitting unauthenticated binds) or a local password hash derived from an empty string. If the impersonated account is privileged, the attacker gains full access to threat-intelligence data and configuration. No public exploit identified at time of analysis; a vendor patch (commit 0ee058548) is available.
Denial-of-service in misp-stix allows remote attackers to terminate long-running MISP importer processes or exhaust host memory and CPU by submitting malformed or oversized STIX 1 or STIX 2 documents. Two distinct conditions combine: parsing failures invoked sys.exit(), which raises SystemExit - a BaseException subclass that bypasses standard except Exception handlers in callers - causing unconditional process termination instead of a recoverable error; and the library materialized full document content in memory before applying any size or validity checks, with processing costs of 2-7x the raw input size enabling resource exhaustion. No public exploit identified at time of analysis; upstream fix commits are available on GitHub.
Path traversal in the misp-stix Python library allows an attacker who can supply crafted STIX 2 content to escape the configured object-template directory during PyMISP template resolution, reading arbitrary files accessible to the conversion process and copying their contents into converted MISP objects. All MISP deployments performing STIX 2 import or MISP-to-STIX 2 export via misp-stix are affected, with the flaw carrying a CVSS 4.0 score of 8.8. No public exploit or CISA KEV listing exists at time of analysis, but the vulnerability's persistent re-triggering pathway - where a poisoned MISP event is later re-exported by a higher-privilege process - represents a privilege-escalation risk beyond what the base score alone reflects.
Cross-site request forgery in CTI-Transmute's administrative user deletion endpoint enables unauthenticated remote attackers to delete arbitrary user accounts by inducing an authenticated administrator to follow a crafted link. The /account/delete/<id> endpoint accepted HTTP GET requests for an irreversible state-modifying operation, allowing any web page or email to silently trigger deletions using the victim's active session. No public exploit has been identified at time of analysis, though the attack requires no attacker credentials and depends solely on social engineering a logged-in administrator.
Uncontrolled resource consumption in CTI-Transmute's unauthenticated /activity_timeline endpoint allows remote attackers to exhaust database, CPU, and memory resources by submitting arbitrarily large values for the `days` query parameter. All versions of the MISP project's CTI-Transmute tool are affected until the upstream patch is applied; the fix clamps the parameter to a 1-1,095 day range. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 (VA:H, PR:N, AC:L) reflects that this is a trivially reachable denial-of-service with no authentication barrier.
Server-side request forgery in CTI-Transmute's evaluation report PDF-generation pipeline allows an attacker who can inject content into a CTI evaluation report to coerce the application server into fetching arbitrary internal or filesystem resources. The vulnerability arises because user-controlled fields - conversion names, descriptions, and comments - flow through a Markdown-to-HTML conversion and are then rendered to PDF by WeasyPrint with its default unrestricted URL-fetching behavior intact, meaning crafted file:// or http(s):// references embedded in that content are fetched by the server process at render time. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but a patch commit is available from the MISP project.
Open redirect in MISP installation scripts allows unauthenticated remote attackers to craft malicious URLs that leverage a missing trailing slash in the Apache HTTP-to-HTTPS redirect directive. When a user follows a crafted link on the legitimate MISP domain, the redirect appends attacker-controlled path content directly to the hostname, causing the browser to interpret the attacker’s domain as the destination host. This can lead to phishing and credential collection, though no active exploitation has been identified and a vendor patch is available.
Server-Side Request Forgery bypass in the html_to_markdown expansion module of misp-modules lets an authenticated attacker reach internal, loopback, and link-local services that the module's IP range filtering was meant to block. By supplying an IPv4-mapped IPv6 address such as http://[::ffff:169.254.169.254]/ (or a hostname resolving to one), the attacker defeats the blocked-range checks and can pull back internal content — including cloud instance metadata — rendered back to them as Markdown. No public exploit identified at time of analysis and it is not in CISA KEV, but the underlying IPv4-mapped-IPv6 filter bypass is a well-understood, easily reproduced technique.
Authenticated arbitrary code execution in MISP allows a site administrator to abuse the Kafka_rdkafka_config setting to load an attacker-controlled INI file, which is parsed and passed to rdkafka with options such as plugin.library.paths to load an arbitrary shared library. The flaw (CWE-829, inclusion of functionality from untrusted control sphere) yields code execution as the MISP process user; no public exploit identified at time of analysis, but a vendor patch is available.
Remote code execution in MISP allows authenticated site administrators to abuse the JsonLogTool NDJSON error log configuration to write attacker-controlled content to a PHP file under the webroot, yielding code execution as the web server user. No public exploit identified at time of analysis, but a vendor patch is available via the MISP GitHub repository.
Multiple OAuth 2.0 flow weaknesses in the MISP AAD (Azure Active Directory) authentication plugin allow session hijacking, session fixation, CSRF/replay against the OAuth callback, plaintext credential exposure over non-HTTPS redirect URIs, and log injection. The plugin reused the PHP session_id() as the OAuth state parameter, never rotated the session ID after login, did not enforce HTTPS on the redirect URI, and logged attacker-controlled GET parameters verbatim. No public exploit identified at time of analysis, but an upstream fix is available in MISP commit 146bc40.
Cross-organization data tampering in MISP (Malware Information Sharing Platform) core allows authenticated low-privileged users to modify or delete intelligence objects belonging to other organizations by exploiting broken access-control checks across Event Reports, Collection Elements, Analyst Data, Template Elements, and Decaying Models. The flaw stems from authorization being performed against the wrong entity ID or being entirely absent on write paths, enabling integrity attacks on shared threat intelligence. Vendor patches are available via multiple MISP GitHub commits; no public exploit identified at time of analysis.
Broken access control in MISP Core's bulk deletion handlers lets any authenticated user holding the broad perm_add or perm_sharing_group role flag hard-delete Event Reports and Sharing Groups belonging to other organisations across the entire instance. The flaw affects MISP threat-intelligence platform deployments and enables cross-tenant data destruction by contributor-level accounts; no public exploit identified at time of analysis, but the upstream patch commits are public and trivially reverse-engineerable.
Insecure direct object reference flaws in MISP threat-intelligence platform allow an authenticated user with access to any one authorized object to overwrite, re-parent, or transfer ownership of objects belonging to other users or organizations by submitting crafted REST/form payloads containing attacker-chosen primary keys and ownership foreign keys. The root cause is CRUDComponent::edit() mass-assigning payload-supplied IDs (id, event_id, org_id, user_id, sharing_group_id, etc.) onto the already-loaded record, so CakePHP's save() updates a different row than the one the authorization check validated. No public exploit identified at time of analysis, but a vendor patch is available and the high CVSS 4.0 score of 9.4 reflects broad cross-tenant impact.
Privilege escalation in MISP threat intelligence platform versions through 2.5.38 allows authenticated users to modify other users' account attributes by submitting a crafted User.id parameter in edit requests. The UsersController::edit() function failed to strip user-supplied identifiers before processing, enabling cross-account modifications. No public exploit identified at time of analysis, but the source code fix is publicly visible in the upstream commit.
Authorization bypass in MISP versions through 2.5.38 lets authenticated users delete records via HTTP DELETE requests even after the application's delete-validation callback has rejected the operation. The root cause is an operator-precedence bug in the CRUDComponent::delete() handler where missing parentheses caused validation checks to be skipped for the DELETE method. No public exploit identified at time of analysis, but the upstream fix commit on GitHub publicly discloses the exact one-line vulnerable expression, making weaponization trivial.
OTP authentication bypass in MISP affects deployments where LdapAuth.mixedAuth=true is combined with Security.require_otp=true, allowing attackers with valid LDAP (or other plugin) credentials to skip the mandatory second factor. Because the plugin-driven login establishes the session during the AppController beforeFilter phase, an attacker can authenticate, ignore the /users/otp challenge page, and browse directly to any authorized application URL as the victim. No public exploit identified at time of analysis, though the upstream commit clearly documents the bypass technique.
Insecure Direct Object Reference in MISP 2.5.0 through 2.5.37 allows authenticated users with shadow attribute submission privileges to overwrite arbitrary existing ShadowAttribute records by supplying a target id within the add proposal request. The framework's ORM interprets a client-supplied primary key as an update directive, breaking the boundary between proposal creation and modification. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Privilege escalation in MISP threat intelligence platform versions prior to 2.5.37 allows organization administrators to reset authentication keys of site administrator accounts within the same organization, yielding cross-tier access takeover. The flaw stems from missing authorization checks in the auth key reset workflow, enabling an org-admin to harvest a freshly generated site-admin API key. No public exploit identified at time of analysis, and EPSS rates exploitation probability at just 0.06%, but a vendor-released patch (2.5.37) is available.
SQL injection in MISP threat intelligence platform versions prior to 2.5.37 allows remote unauthenticated attackers to manipulate ORDER BY clauses in event and shadow attribute listing endpoints by supplying crafted ordering parameters. The CVSS 4.0 score of 9.3 reflects high impact across confidentiality, integrity, and availability, though EPSS exploitation probability sits at just 0.04% and no public exploit identified at time of analysis. Given MISP's role as a repository of sensitive threat-intelligence data shared between organizations, successful exploitation could expose IOCs, attribution data, and partner-shared intelligence.
LDAP injection in MISP (Malware Information Sharing Platform) versions prior to 2.5.36 enables unauthenticated attackers to bypass authentication and execute unauthorized LDAP queries. The vulnerability exists in ApacheAuthenticate.php when administrators configure apacheEnv to use user-controlled server variables instead of REMOTE_USER in proxy deployments. Attackers manipulate unsanitized username values to inject special characters into LDAP search filters, potentially gaining unauthorized access to the threat intelligence platform. No public exploit identified at time of analysis.
MISP 2.5.45 and earlier fails to apply its authentication-failure logging throttle on two API auth paths — requests presenting no API key and requests presenting a key of incorrect length — allowing an unauthenticated remote caller to write an unbounded number of durable auth_fail entries into the database. Repeated requests can exhaust storage and degrade or deny availability of the platform (CWE-770). No public exploit code and no CISA KEV entry were present in the supplied intelligence; an upstream fix commit (2bf887433) is available from the vendor.
Let me produce the JSON. Key details: MISP ≤2.5.45, Redis-based throttling of auth-failure logs; when Redis unavailable, _shouldLog() returned false, silencing logging. CWE-778 insufficient logging. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N — 5.1. Hmm, PR:L, UI:P. That's odd but okay. Impact: integrity of log data (VI:L). Actually the impact is loss of audit logs — integrity of the log record. Patch available: commit a39b25d2f. Reported by CIRCL. No KEV, no POC (POC status unknown — no POC data provided). Say "no public exploit identified at time of analysis". Prevalence: MISP is a widely used threat-intelligence sharing platform — medium to high. I'd say medium (common in SOC/CTI environments, not everywhere). Actually MISP is widely deployed among CERTs, SOCs, threat intel teams. I'd say "medium". assessed CVSS 3.1 vector: The flaw requires Redis to be unavailable (a precondition) and an attacker to attempt failed authentications (PR:L? actually auth failure attempts imply unauthenticated attackers trying). Hmm. The result is log suppression. AV:N, AC:H? The condition is a Redis outage — that's a configuration/environment condition. Let's think: CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N? Hmm. The logging suppression is a loss of accountability — impact on integrity of the log. But does it require the attacker to do anything? The vulnerability triggers whenever Redis is down and failed auth attempts occur. Attackers don't need privileges. However the 4.0 vector says PR:L — probably because the actor is "authenticated" in the sense that... hmm, actually the CNA scored PR:L. I need to produce my own independent vector. I'd argue: AV:N (attackers attempt auth remotely), AC:H (requires Redis unavailable — an environmental precondition, not attacker-controlled), PR:N (failed authentication attempts are unauthenticated by definition), UI:N, S:U, C:N, I:L (log integrity/audit trail), A:N. Hmm but should I use PR:L to align with the
MISP 2.5.45 and earlier can write corrupted access-log records for any HTTP request that ends in an unhandled exception, because CakePHP's CakeErrorController extends AppController and re-runs the application startup path, causing AccessLog::logRequest() to register a second deferred writer that overwrites the row written by the first pass. The overwritten fields include request duration, SQL query count, memory usage and potentially the query log, silently degrading the fidelity of MISP's own audit trail. Exploitation requires an authenticated session (CVSS 4.0 PR:L, VI:L only); no public exploit code or CISA KEV listing was identified at time of analysis, and an upstream fix commit (0dae5c072) is available.
Let me synthesize the analysis. Key facts: - CVE-2026-91857, CSRF (CWE-352) in MISP ≤2.5.45, fixed in 2.5.46. - State-changing controller actions accept GET: EventReportsController::purgeUnusedPictures(), NoticelistsController::enableNoticelist() (actually toggleEnable?), ServersController::removeOrphanedCorrelations(), WorkflowsController::rebuildRedis(). - Patch adds allowMethod(['post']). - CVSS 4.0 vector given: AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N → 5.3 - EPSS: not provided. KEV: not provided. POC: not provided. - Patch available from vendor; commit hash b4a5486b5. - Reporter: CIRCL (MISP's developer). - Tags: CSRF, Misp - CPE: cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* - Prevalence: MISP is a widely used threat intelligence sharing platform — high (widely-deployed enterprise software, but niche in that it's a specific security tool). I'd say "medium" or "high". MISP is deployed in many SOCs, CERTs, ISACs. I'd say high — it's a well-known platform in security community. Hmm. Given anchors: high = widely-deployed enterprise software. MISP is pretty common in threat intel sharing. I'll say "high". Actually could argue medium (common but not everywhere). MISP is used by most CERTs/ISACs and many enterprises. I'll go with "high". UI:P in the CVSS 4.0 vector — user must be tricked into visiting a page / clicking a link. Actually the description says GET can be induced cross-origin through links, images, redirects, or navigation. CVSS 4.0 UI:P (Passive) means the user doesn't have to actively interact beyond normal — e.g., just visiting a malicious page. So UI:P. PR:N in the CVSS 4.0 vector — no privileges required, but requires the victim's authenticated session. That's typical CSRF: PR:N in the CVSS sense (attacker doesn't need credentials), but exploitation requires the victim to be authenticated. My assessed CVSS 3.1 vector: CSRF requiring victim interaction. AV:N, AC:L, PR:N, UI:R (in 3.1, UI:R because victim must be tricked — in 3.1 there's no pa
Authenticated users of MISP 2.5.45 and earlier can list dashboard templates that are supposed to be restricted to other permission flags, such as perm_site_admin, because a MySQL type-juggling flaw makes the 'unrestricted' branch of the template query match every permission-restricted template. The bug is an incorrect-authorization error (CWE-863) in DashboardsController::listTemplates(), patched upstream in MISP 2.5.46; no public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 4.0 base score of 5.3 reflects only low confidentiality impact with no integrity or availability effect.
CSRF protection bypass in MISP ≤2.5.45 allows a network-adjacent attacker to forge authenticated state-changing requests against any MISP action that reads parameters from the URL. The bypass exploits CakePHP's method-override processing: submitting `_method=GET` (or an equivalent non-write verb via `X-HTTP-Method-Override`) causes CakePHP to empty the parsed request body before MISP's `BetterSecurityComponent` evaluates whether to run `_validatePost()` and `_validateCsrf()`. Because `hasData` is false after body-clearing, both protections are silently skipped entirely. No public exploit has been identified at time of analysis, but the mechanism is straightforward to weaponize by anyone who can lure an authenticated MISP user to a crafted page.
MISP's interactive CLI shell (versions ≤2.5.45) silently misattributes audit log entries when the CakePHP SysLogLogable singleton has its user context overwritten by a lazy-loaded model, causing privileged CLI writes to appear in the audit trail under the wrong user identity. Additionally, CLI-originated records lacked any distinguishing marker, making them indistinguishable from ordinary web-session actions in audit logs - a forensic and compliance problem for organizations relying on MISP's audit trail to attribute administrative activity. No public exploit exists and no active exploitation has been identified.
Cross-Site Request Forgery in MISP versions ≤2.5.45 allows a remote unauthenticated attacker to silently modify settings of an already-authenticated MISP user by inducing them to load a malicious page. Three UserSettingsController endpoints - setTheme, setHomePage, and eventIndexColumnToggle - were placed on the Security component's unlockedActions list, completely disabling CSRF token and field-hash validation for those POST endpoints. The highest-impact vector is setHomePage, which enables an attacker to redirect a threat analyst's MISP landing page to an attacker-controlled URL, creating a plausible pivot for credential phishing or social engineering; no active exploitation or public proof-of-concept has been identified at time of analysis.
HTML injection in MISP versions ≤2.5.45 allows any authenticated user with write access to embed arbitrary HTML markup in attribute types/values, object names/relations, or tag colour and name fields, which renders as live HTML when a report referencing those elements is exported to PDF via the convert_markdown_to_pdf module. The same component shipped a hardcoded sample-value defect - literal strings 'domain-ip' and 'google.com' used as format arguments rather than placeholders - meaning every plain attribute reference in a PDF displayed sample text instead of the real indicator, constituting a separate data-integrity failure. CIRCL, the MISP maintainer, patched both issues in commit 949744a4b (released as v2.5.46) by wrapping all user-controlled interpolations with CakePHP's h() HTML-encoding function. No public exploit has been identified and the CVE is not listed in CISA KEV.
Authenticated users in MISP ≤2.5.45 can retrieve object-reference records outside their authorized scope via an Insecure Direct Object Reference (IDOR) flaw in EventGraphTool::get_reference_data(). The vulnerable code queried ObjectReference by UUID and returned the matching row without verifying the requesting user has access to the parent object the reference belongs to. An authenticated attacker who knows or enumerates a reference UUID can access reference metadata - including relationship types, comments, and referenced UUIDs - from objects in events they are not permitted to view. No public exploit or CISA KEV entry exists at time of analysis.
Authenticated MISP users can enumerate the hidden organisation directory in deployments running version ≤2.5.45 where Security.hide_organisation_index_from_users is enabled, because multiple dashboard widgets failed to enforce the same authorization check that guards the standard /organisations/index endpoint. Three compounding weaknesses escalate the exposure beyond simple enumeration: missing checkPermissions() in NewOrgsWidget and OrgsContributorsGeneric allows any authenticated user to bypass the intended restriction; unrestricted find('all') database queries returned full organisation table rows including contacts and metadata through the JSON export code path; and a limit parameter flaw (limit=0 or negative values exploiting CakePHP DboSource behavior) effectively removed result pagination, potentially dumping the entire organisation table. CIRCL reported and patched the issue via commits 67892d90e and 5e333a159; no public exploit is identified at time of analysis.
Stored XSS in MISP's dashboard Button widget (≤2.5.45) allows an authenticated low-privilege user to embed javascript: URLs or WHATWG-normalized backslash authority forms into widget configuration, which execute in the browser of any analyst who subsequently interacts with that widget. The root cause is a parser differential between PHP's URL handling and the WHATWG URL Standard implemented by browsers: forms such as \\evil.com or /\evil.com appear relative or host-matching under PHP's parse_url() but resolve to an off-origin authority in modern browsers. The upstream fix, confirmed via commit adf704e94 authored by the MISP maintainers at CIRCL, introduces a shared DashboardURLValidator that explicitly rejects raw backslashes, javascript: and other dangerous schemes, control characters, and unauthorized absolute origins. No public exploit code or active exploitation has been identified at time of analysis.
Organisation metadata enumeration in MISP ≤2.5.45 is possible for authenticated users when the `Security.hide_organisation_index_from_users` configuration option is enabled, because the dashboard organisation picker queries the full organisation table without applying the same ACL conditions enforced by the standard organisation index and per-organisation view endpoints. The picker returns organisation ID, UUID, and name for all organisations, bypassing the visibility restriction. Patch commit 8ca4486af from CIRCL adds the missing `Organisation::createConditions()` call to scope picker results to organisations the requesting user is already authorised to see. No public exploit code has been identified and this CVE is not listed in CISA KEV.
Authenticated information disclosure in MISP ≤2.5.45 allows any logged-in user to bypass email-address redaction by switching from the HTML interface to the REST/JSON representation of DashboardsController::listTemplates(). The query always fetched User.email columns, but the redaction logic only executed inside the non-REST rendering branch - meaning the same session that saw blank email fields in the browser received raw email addresses when requesting JSON. The fix, contributed by CIRCL (MISP's primary maintainer) and released in commit fd554c3bd, centralizes the privilege decision in a new User::canSeeEmails() static helper, conditioning email retrieval on site-admin role or the Security.disclose_user_emails instance setting.
Open redirect in MISP ≤2.5.45 allows authenticated users to store a protocol-relative URL (e.g., //attacker.example) as a custom homepage setting, bypassing a path validation check that only required a leading /. On login, the post-login routing logic in UsersController and NewsController emits the stored value verbatim to the browser's Location header, redirecting victims to attacker-controlled external origins. No public exploit or active exploitation (CISA KEV) is identified; a vendor patch is confirmed in commit bd454f65a.
Unauthorized correlation data exposure in MISP ≤2.5.45 allows authenticated users with restricted access to observe event correlations, event metadata, and feed URLs that their ACL would normally block. The freetext feed preview endpoint invoked two raw database queries against the Attribute model filtered only by attribute value and deletion status, entirely bypassing MISP's multi-layered access controls covering event distribution, organization membership, sharing groups, and attribute- and object-level permissions. A second sub-issue in the same code path leaked cross-feed correlation results and configured feed URLs for feeds not marked as lookup-visible. No public exploit or KEV listing exists at time of analysis.
Cross-site request forgery in MISP allows an unauthenticated remote attacker to trigger unauthorized state changes on behalf of any authenticated user by abusing MISP's REST detection logic. The root flaw is that CSRF and form-security exemptions were granted whenever a request was classified as REST-style - a classification controlled by the HTTP Accept header, which cross-origin pages can freely set to application/json without triggering a CORS preflight. Any authenticated MISP analyst who visits an attacker-controlled page can have events created, modified, published, or deleted against their MISP instance using their own session. No public exploit has been identified at time of analysis, but the technique requires only standard browser APIs and social engineering, placing practical exploitation complexity well below the CVSS surface complexity rating.
Stored XSS in MISP's dashboard ButtonWidget allowed an authenticated user to persist arbitrary URLs - including `javascript:` scheme values - through the `updateSettings()` whole-layout save endpoint, which lacked the widget-config validation that `updateWidgetSettings()` already enforced. A malicious URL stored via this unguarded path could reach client-side rendering or navigation, potentially executing script in the victim's MISP browser session and enabling actions or data access at that user's privilege level. Practical exploitability was substantially reduced by MISP's existing render-time URL validation, making this a defense-in-depth persistence-layer gap rather than a confirmed end-to-end XSS bypass; no public exploit or active exploitation has been identified.
Reflected XSS in MISP's event attribute filtering query builder allows an unauthenticated attacker to execute arbitrary JavaScript in the security context of any authenticated MISP user who follows a crafted viewEventAttributes URL. The taggedAttributes and galaxyAttachedAttributes URL parameters are serialized via PHP's JsonTool::encode() with JSON_UNESCAPED_SLASHES and embedded raw into a <script> element; an attacker-controlled </script> sequence in either parameter breaks out of the script block and injects arbitrary HTML or JavaScript. Successful exploitation could yield session credential theft, unauthorized data modification, or any other action permitted by the victim's MISP role. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authenticated low-privileged users in MISP can receive OnDemand correlation results that reference attributes and events they are not authorized to access, bypassing the platform's distribution, sharing-group, organization, and event-level access controls. The flaw resided in `OnDemandCorrelationBehavior.php`, where `__collectCorrelations()` matched attributes by value alone and never filtered results against the requesting user's ACL - meaning any authenticated user could learn that a specific indicator value (IP address, hash, domain) appears in a restricted event belonging to another organization or sharing group. No public exploit has been identified at time of analysis; a vendor patch is confirmed as commit f51342f30 in the MISP GitHub repository.
Parser state isolation failure in misp-stix corrupts MISP event generation when the same parser instance is reused across independent STIX 1 and STIX 2 document conversions, causing retained artifacts - including galaxy clusters, passive DNS records, package titles, dates, and timestamps - from a prior document to contaminate subsequently generated MISP events. Applications directly consuming the misp-stix API with long-lived parser instances are at risk; the standard entry points that instantiate a fresh parser per file are not affected. No public exploit has been identified at time of analysis, and the CVSS 4.0 AT:P precondition metric confirms exploitation depends on a non-default deployment pattern compounded by attacker influence over document processing order.
STIX document import in misp-stix through version 2026.7.8 allows an unauthenticated attacker who can supply a crafted STIX bundle to inject arbitrary MISP attribute metadata - including distribution level, sharing_group_id, and classification tags - into the importing MISP instance. The import pipeline trusted attacker-controlled STIX fields (tool labels for STIX2, document title for STIX1) to decide whether content originated from MISP itself, and then passed the complete x_misp_attributes dictionary without field filtering directly into attribute creation. No public exploit has been identified at time of analysis; patch commits are available upstream from the MISP project.
Cross-site request forgery in MISP cti-transmute exposes four authenticated account endpoints - /account/follow, /account/delete_notification, /account/mark_notification_read, and /account/mark_all_read - to silent browser-driven invocation via malicious third-party pages. Because these state-changing operations were implemented as HTTP GET routes, any authenticated user visiting an attacker-controlled page could have follows added, notifications deleted, or notification state altered without consent. The fix (commit c352c2329e48ccc33a2b96d5353450cfbf7e89ec, reported by CIRCL) converts the routes to POST/DELETE and enforces X-CSRFToken header validation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV.
Stored cross-site scripting in MISP cti-transmute allows authenticated users to inject arbitrary script into shared graph configurations that are later executed in other users' browsers, including administrators. The flaw exists because the Pivotick graph rendering component interprets the svgIcon style property as raw HTML, and saved configurations were persisted without schema validation and shared across all users on the instance. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the admin-targeting path gives low-privileged attackers a meaningful privilege escalation surface in multi-user deployments.
Cross-site scripting in cti-transmute's MISP event-browser allows a malicious or compromised remote MISP instance to inject arbitrary HTML and JavaScript into the operator's browser by returning crafted values in event data fields. Affected fields include event IDs, event information text, organization names, tags, tag colors, TLP labels, distribution labels, and flash/error messages - all previously interpolated via innerHTML without sanitization. No public exploit code has been identified at time of analysis and the vulnerability is absent from CISA KEV; the low CVSS 4.0 score of 2.3 reflects the hard prerequisite that an attacker must control or compromise the specific MISP instance being queried.
Missing authorization in MISP cti-transmute (versions ≤ 1.4.0) allows any authenticated user to add or remove emoji reactions on comments they are not permitted to view by supplying an arbitrary comment_id to the react() handler. The handler validated syntactic ID format and emoji permissibility but never invoked the application's own access.can_see_comment() guard before calling comments_repo.toggle_reaction(), enabling unauthorized integrity modification of private comment metadata. No active exploitation (CISA KEV) or public exploit code is identified at time of analysis; the fix is confirmed in upstream commit a18c07c3dd4a74b91ad8dd23d6e84fee4bcbd457 and an authenticated account is a meaningful prerequisite.
Private evaluation comment disclosure in MISP's cti-transmute (all versions ≤ 1.4.0) allows any authenticated user with viewer-level access to a conversion to export its evaluation report as Markdown or PDF and obtain private comments that should have been restricted to the conversion owner, comment author, or an administrator. The root cause is a missing authorization check in build_evaluation_report(), which bypassed the same access-control logic enforced by normal comment retrieval. Leaked data includes comment content and author names. No public exploit code or CISA KEV listing exists at time of analysis; the fix is available as an upstream commit.
Email address disclosure in MISP cti-transmute versions up to and including 1.4.0 exposes private user email addresses to any authenticated platform user via the account following-list API endpoint. The get_following() function incorrectly serializes the followed user's email field alongside non-sensitive metadata such as name, user ID, and follow date, despite email being absent from comparable user-list endpoints in the same codebase. An authenticated attacker can systematically follow accounts to harvest the full platform user directory's email addresses; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized disclosure of deleted-conversion history data in MISP cti-transmute (≤ 1.4.0) stems from a logic inversion in the conversion-history details endpoint that allows the authorization check to be silently bypassed. When a history record references a deleted conversion, the lookup returns None, and the prior condition only enforced visibility when the conversion object existed - meaning None short-circuited the check and granted access. Any user able to submit a request for the affected history entry could retrieve retained input/output payloads associated with deleted conversions. No public exploit exists and the vulnerability is not listed in CISA KEV; a patch commit was issued on July 22, 2026.
Stored cross-site scripting in CTI-Transmute's conversion graph allows attacker-controlled CTI content (MISP or STIX objects) to execute arbitrary JavaScript in any analyst's browser who views the graph. The Pivotick graph library rendered node labels, sublabels, edge labels, node types, property names, property values, and hash algorithm identifiers through HTML-parsing operations (innerHTML, template.innerHTML) without sanitization, and a separate sink used an interpolated document.write() for the raw-JSON popup. The CVSS 4.0 score is 5.1 (Medium) with no authentication required of the attacker but user interaction required of the victim; no public exploit or KEV listing has been identified at time of analysis.
Stored Vue template injection in CTI-Transmute ≤ 1.5.0 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser of any user who views a compromised public conversion detail page. The attack bypasses Jinja2 HTML escaping because server-rendered values are injected into DOM regions subsequently compiled by Vue's runtime engine, which interprets the attacker-controlled `[[ ... ]]` expressions as live template code. The application's nonce-based CSP provides no protection because Vue's runtime compiler requires the `unsafe-eval` exception, permitting Function constructor escalation; no public exploit code beyond the proof-of-concept payload technique described in the advisory has been identified at time of analysis, and this CVE is not listed in CISA KEV.
MISP's attribute creation endpoint contains an authorization bypass allowing authenticated users with attribute-creation permissions to associate attributes with sharing groups they are not authorized to access. The flaw arises because the sharing group permission check was gated exclusively on the distribution field being set to 4 (sharing group mode), meaning a user could submit any non-empty sharing_group_id with a different distribution value and bypass the check entirely. No public exploit has been identified at time of analysis; a vendor patch is available via a confirmed GitHub commit.
Sharing group authorization bypass in MISP's object add/edit workflow allows an authenticated user with object-editing permissions to assign objects and their contained attributes to sharing groups they are not authorized to access or view. The flaw stems from a structural data merging step in ObjectsController.php that silently relocates field keys, causing the sharing group validation check to evaluate a stale, already-removed data path and thus never fire. An attacker exploiting this can probe the existence and names of non-visible sharing groups and improperly alter the distribution metadata of objects and embedded attributes. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Unauthorized sharing group assignment in MISP's non-REST event edit path allows any authenticated event editor to assign an event to a restricted sharing group they are not a member of by tampering with submitted form data. The REST API path enforced sharing group authorization via Event::_edit(), but the web form save path wrote sharing_group_id directly from POST data without equivalent validation - a classic split-path authorization gap (CWE-863). Successful exploitation leaks the restricted sharing group's name in event listings and corrupts the event's distribution metadata. No public exploit has been identified at time of analysis, and the fix is available as commit 609ff6c from the MISP maintainers (CIRCL).
User email enumeration in MISP's AuthKey edit endpoint allows any authenticated user holding AuthKey-edit permission to discover the email addresses of arbitrary platform users by manipulating a single POST parameter. The flaw exists in the validation-error rendering path of AuthKeysController.php, where the user dropdown was populated from attacker-controlled request body data rather than the persisted AuthKey owner, enabling systematic iteration over numeric user IDs. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the attack is trivially reproducible from the description and patch diff alone.
Reflected XSS in MISP's UiBeta event index view allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL with a specially encoded searcheventinfo parameter. The vulnerability exploits a double-encoding flaw: the PHP template applies only HTML escaping (h()) to the urlparams value placed inside a single-quoted JavaScript string in an onclick attribute, but browsers HTML-decode attribute values before JavaScript parsing - restoring encoded quote characters (' → ') and enabling string breakout. No public exploit code has been identified at time of analysis, and the fix has been committed upstream by the MISP maintainers at CIRCL.
Path traversal in MISP's OrganisationsController::getOrgLogo allows a low-privileged authenticated user to read arbitrary .png or .svg files from outside the intended organisation logo directory by injecting traversal sequences into organisation-controlled fields such as the organisation name, id, or uuid. All MISP versions prior to the patch commit b865deb are affected across any deployment where untrusted accounts hold write access to organisation fields. No public exploit code or CISA KEV listing exists at time of analysis; however, the attack requires only low-privilege access and no user interaction, making it practically exploitable in typical multi-tenant MISP deployments.
Stored cross-site scripting in MISP's setHomePage endpoint allows an authenticated user to persist an arbitrary JavaScript payload as their homepage setting when the Overmind theme is active, which later executes in any victim's browser upon viewing the News page and clicking the "Continue to homepage" link. The root cause is a theme-conditional code path in UserSettingsController that called setSettingInternal() directly, bypassing the validate_homepage validator that enforces a leading slash on path values, combined with an unescaped output sink in app/View/News/index.ctp. No public exploit has been identified at time of analysis; exploitation is bounded by the Overmind-theme-only precondition and mandatory victim interaction.
Incorrect authorization in MISP's event template builder exposes organisation-private galaxy definitions to any authenticated user due to a PHP operator-precedence bug that silently voids the intended access-control filter. In multi-tenant MISP deployments, authenticated non-site-admin users can enumerate all enabled galaxies - including organisation-only custom galaxies belonging to other organisations - through the template builder galaxy list. No active exploitation is confirmed (not listed in CISA KEV), but the low exploitation barrier (any valid account, no special privileges) makes this a meaningful metadata-disclosure risk wherever multiple organisations share a MISP instance.
Improper authorization in MISP permits an authenticated organization administrator to read or overwrite user settings and login profile data belonging to site administrator accounts that share the same organization. The ACL checks in UserLoginProfilesController, UserSettingsController, and the UserSetting model correctly scoped operations by org_id membership but failed to exclude users holding site-admin roles, allowing a lower-privileged admin to cross the intended privilege boundary. No public exploit has been identified at time of analysis; a patch is available via a CIRCL-reported upstream commit.
Stored cross-site scripting in MISP BSimVis through v0.2.0 allows network-accessible attackers who can create or influence tag names, collection names, entity identifiers, cluster names, or tag metadata to inject malicious payloads that execute in victims' browsers. The vulnerability spans multiple client-side rendering paths in tags.js, where user-controlled values were interpolated raw into innerHTML, HTML attributes, inline JavaScript event handlers, and CSS style values - covering tag badges, tooltips, context menus, cluster cards, autocomplete suggestions, and dynamically inserted tag cards. No public exploit has been identified at time of analysis; the issue was reported and patched by CIRCL, the primary MISP development organization.
Authenticated low-privileged users in MISP versions up to and including 2.5.38 can manipulate the fields parameter of the New Users and New Organisations dashboard widgets to bypass server-side field redaction and retrieve restricted metadata - including user email addresses even when email disclosure is explicitly disabled via Security.disclose_user_emails configuration. The root cause is an order-of-operations flaw: in the original code, the email redaction check was applied after the fallback logic that repopulated the field list, meaning a crafted empty field selection after validation could trigger a return of unredacted model fields. No public exploit has been identified at time of analysis, and SSVC rates exploitation status as none; however, the low attack complexity and absence of user interaction requirements mean any authenticated user can reliably reproduce the condition.
Improper input validation in MISP's over-correlations endpoint allows an authenticated high-privileged attacker to inject arbitrary ordering clauses into database queries via the user-controlled `order` request parameter. All MISP instances running version 2.5.38 and earlier are affected. While direct impact is bounded by query-ordering manipulation, the vulnerability carries SQLi tags and high subsequent system impact scores (SC:H/SI:H/SA:H in CVSS 4.0), suggesting that a successfully crafted ordering expression could escalate to unsafe query construction or unintended data exposure. No public exploit has been identified at time of analysis.
Open redirect in MISP versions up to and including 2.5.38 allows unauthenticated remote attackers to craft links that silently redirect victims to attacker-controlled external URLs immediately after successful authentication. The vulnerability resides in UsersController::routeafterlogin(), where the pre_login_requested_url session value was reflected into a Location header without enforcing local-path constraints. SSVC signals exploitation as 'none' and no CISA KEV listing exists, but the automatable designation and the high-trust context of a threat intelligence platform make this a meaningful phishing amplifier against security teams who would not expect a trusted MISP login to forward them off-site.
Open redirect in MISP's dashboard button widget (versions up to and including 2.5.38) enables an authenticated, high-privileged user who controls dashboard configuration to plant a crafted button URL that appears to point internally but redirects clicking users to an attacker-controlled external site. The root cause is an incomplete URL allowlist in Button.ctp that blocked explicit schemes, hosts, and user components but did not reject paths beginning with /\ - a pattern several browsers normalize into a scheme-relative URL (i.e., //attacker.com). No public exploit exists and CISA SSVC rates exploitation as none; risk is substantially constrained by the PR:H requirement and the need for a victim to interact with the planted button.
Authorization bypass in MISP's Event Template Importer allows authenticated users with template import privileges to overwrite event templates owned by other organizations on the same shared instance, violating inter-organizational data ownership boundaries. Versions up to and including 2.5.38 are affected; the overwrite workflow confirmed template existence but omitted an organizational ownership check, enabling cross-org template corruption. No public exploit code has been identified at time of analysis and SSVC signals no active exploitation, but the integrity impact is operationally significant in multi-tenant MISP deployments where organizational trust boundaries are critical.
Private galaxy metadata in MISP versions up to and including 2.5.38 was exposed to authenticated non-site-admin users through the event template builder workflow due to missing organisation and distribution-based access controls. The EventTemplatesController.php __setBuilderConfig() method queried all enabled galaxies without filtering by ownership or distribution level, allowing users from one organisation to read galaxy names, types, and descriptions that belong to other organisations and are marked private. No public exploit has been identified and SSVC rates exploitation as none; however, in multi-tenant intelligence-sharing environments this information disclosure carries meaningful operational security risk, as galaxy metadata can reveal the intelligence focus areas or classification schemes of peer organisations.
Stored XSS in MISP CTI Transmute's notification bell dropdown allows an attacker who can control convert names to inject arbitrary JavaScript that executes in authenticated users' browsers upon opening the notification panel. The vulnerability, tracked as EUVD-2026-32728 and reported by CIRCL, stems from innerHTML-based rendering of user-controlled notification content in base.html and affects all versions prior to upstream commit cf42409 - critically, only on the development branch, not production releases. No public exploit has been identified at time of analysis; the CVSS 4.0 score of 6.3 with AT:P reflects that exploitation requires the attacker to first influence a convert name surfaced in a notification.
MISP's CSP report endpoint in versions 2.5.0 through 2.5.37 accepts payloads up to 1 MB per report instead of the developer-intended 1 KB limit, due to a 1,024x magnitude error in the truncation guard (`1024 * 1024` instead of `1024`). On deployments where the endpoint is reachable by untrusted clients, unauthenticated remote parties (per CVSS PR:N) can abuse this discrepancy to flood application logs with oversized reports, contributing to disk exhaustion or log integrity degradation. No public exploit code exists and active exploitation has not been confirmed; the CVSS 4.0 score of 5.1 (Low-Medium) reflects the limited, availability-only impact.
Account takeover in MISP's OidcAuth plugin (versions 2.5.0 through 2.5.37) enables an unauthenticated attacker holding a valid OIDC token from an insecure or untrusted IdP to authenticate as any local MISP user whose account has a NULL stored `sub` value. The vulnerability arises because the plugin unconditionally trusted the OIDC email claim to link identities to existing local accounts without verifying email ownership, bypassing authentication controls entirely (CWE-287). No public exploit has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 6.0 reflects adjacent network vector and high complexity conditions that constrain realistic exposure.
Insufficient input validation in MISP's Collections model allows authenticated low-privileged users to inject malformed UUID values into Collection records, potentially causing data integrity issues or unexpected behavior in downstream code paths that assume RFC 4122-compliant UUIDs. Affected deployments are all MISP instances prior to version 2.5.37. No public exploit code exists and CISA's SSVC framework rates exploitation as none, making this a low-urgency integrity issue rather than an active threat, though integrity of Collection relationships and UUID-dependent logic is at risk until patched.
MISP through 2.5.45 fails to enforce authorization checks when collection elements are created, allowing an authenticated user to persist a bare UUID referencing an Event or Galaxy Cluster they are not permitted to read. The collection view later resolves that UUID back into the underlying object, so collections become a handle on another organisation's private data — the patch notes this already caused org-only events to be disclosed in the beta collection view. Exploitation requires a valid MISP account and knowledge of the target UUID; no public exploit code or CISA KEV listing was identified at time of analysis, though the CVSS 4.0 vector (PR:L, VC:H) and EPSS-adjacent signals mark it as a meaningful confidentiality risk for shared threat-intel instances.
An authorization bypass in MISP through version 2.5.45 lets an authenticated user who can edit events assign an arbitrary sharing_group_id they are not authorized to use, because the authorization check only ran when the request explicitly supplied distribution = 4. If the caller omits the distribution field, MISP's field-recovery logic restores the event's stored distribution (4, for sharing-group events) and persists the unauthorized sharing group ID, silently re-scoping who can see that event and its threat-intelligence content. No public exploit code or active exploitation has been identified at time of analysis, but exploitation is a single crafted edit request, so the integrity impact (VI:H, CVSS 4.0 base 7.1) is significant for multi-tenant or community-sharing MISP instances.
Authentication bypass in MISP's optional LdapAuth and LinOTPAuth plugins (versions ≤2.5.45) lets a remote unauthenticated attacker log in as any user whose email they know, without a password. Because LdapAuthenticate and LinOTPAuthenticate reimplement CakePHP's FormAuthenticate but omit its _checkFields() non-empty-string guard, an empty/null password reaches ldap_bind() and - per RFC 4513 §5.1.2 - is treated as an unauthenticated bind that many directories accept as success; impersonation grants the victim's full privileges, potentially administrative. There is no public exploit identified at time of analysis, and SSVC lists exploitation as none, but the technical impact is rated total.
MISP's interactive CLI shell (≤2.5.45) enforces access control independently from the web application, creating at least six distinct authorization gaps that allow authenticated local users to retrieve sensitive credentials and bypass record-level ACLs. Feed HTTP authorization headers (Feed.headers), server synchronization authkeys, sharing-group memberships, and feed visibility restrictions are all enforced correctly in the web tier but not in the CLI, while the `use` command allows a user to establish an unauthorized record context without proving read rights. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the combination of plaintext credential disclosure and authorization bypass makes this a high-priority patch for any MISP deployment where non-site-admin personnel have shell access to the host.
Missing authorization in MISP's event template instantiation path allows authenticated users to write events into sharing groups they are not permitted to access, and to attach tags beyond their normal tagging permissions. Affected are all MISP deployments running version 2.5.45 and earlier. An attacker with a low-privilege account that can view a community-distributed template (distribution=1) may exploit the flaw to bypass `SharingGroup::canUse()` checks and additionally cause `local_only` tags to propagate globally through MISP's synchronization and export mechanisms, violating the isolation guarantees those tags exist to enforce.
Uncontrolled resource consumption in MISP ≤2.5.45 allows unauthenticated remote attackers to exhaust persistent storage by flooding the password-reset and related pre-authentication endpoints, each of which performs durable database writes before validating or throttling the caller. The `/users/forgot` endpoint accepted arbitrarily long, unvalidated email values and generated two write operations per request - an audit log entry and a queued background job - with no rate limit, enabling storage and job-queue exhaustion at modest request rates. The upstream fix (commit d75d899be, reported by CIRCL) adds a 1024-byte email length cap, format validation, a Redis-backed per-source flood filter with HTTP 429 responses, and a 15-minute API-access request cooldown; no public exploit or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in MISP ≤2.5.45 allows high-privileged users who configure threat intelligence feeds or TAXII discovery endpoints to cause MISP to make outbound HTTP requests to internal network resources and to exfiltrate configured feed authentication credentials to attacker-controlled hosts via unsanitized redirect following. A secondary incomplete SSRF defense in the TAXII discovery path failed to block IPv6 loopback (::1), hex-encoded addresses (0x7f000001), and multi-record DNS responses because it relied on gethostbyname() against a short literal blocklist. No public exploit code or active exploitation (CISA KEV) has been identified; patch commits are available upstream.
Missing authorization in MISP versions 2.5.45 and earlier exposes cryptographic signing key material - including raw key data, key type, and fingerprint - to any authenticated user on the platform, regardless of whether they are permitted to view the associated parent event. The CryptographicKeysController::view() handler fetched CryptographicKey records directly by supplied ID without resolving or authorizing the parent event, enabling cross-event key exfiltration within shared MISP instances. No public exploit has been identified at time of analysis; a patch is available in upstream commit 2edde619b.
Disk-exhaustion denial of service in MISP ≤2.5.45 is exploitable by any authenticated user, including read-only accounts, due to a wildcard ACL entry ('*') on the TemplatesController::uploadFile() endpoint. The handler writes uploaded content to app/tmp/files/ without verifying that the caller holds the perm_add or perm_template role, allowing repeated uploads to consume server disk space. The fix commit explicitly rules out escalation to RCE, stored XSS, or path traversal - impact is availability-only. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authorization bypass in MISP's UiBeta theme collection view exposes full event details - including identifiers, info fields, timestamps, creator organization, all event tags, and galaxy clusters - to authenticated users who lack ACL permissions to those events. The UiBeta theme's `view.ctp` template performed an independent secondary database query using only `Event.uuid IN (...)` without invoking `createEventConditions()`, the canonical per-user ACL enforcement method, even though `CollectionsController::view()` correctly filtered events via `Event::fetchSimpleEvents($user, ...)`. The flaw is compounded because `CollectionElementsController::add()` accepts arbitrary UUIDs from collection owners without validating the submitter's authorization against the referenced event, making collection elements an attacker-controlled input to an unfiltered query. No public exploit code has been identified at time of analysis and no CISA KEV listing exists.
Cross-site request forgery in MISP's sharing group quick-edit feature allows an unauthenticated attacker to manipulate threat intelligence sharing group membership by tricking a privileged MISP user into loading a crafted URL. The root cause is that HTTP method enforcement - which should have restricted the addOrg, removeOrg, addServer, and removeServer actions to POST-only - was commented out in the shared helper __initialiseSGQuickEdit(), leaving all four endpoints reachable via GET. Successful exploitation can silently add or remove organisations and servers from a sharing group, potentially exposing sensitive threat intelligence to unintended recipients or severing legitimate information-sharing relationships.
Incorrect authorization in MISP allows any authenticated user who is a member of an event-owning organization to delete individual attributes or perform bulk attribute deletion from that event, regardless of whether their assigned role carries `perm_modify` or `perm_modify_org` permissions. Three deletion controller actions in `AttributesController.php` - `delete()`, `deleteSelection()`, and `deleteSelected()` - relied only on organization membership checks inside `MispAttribute::deleteAttribute()` rather than on MISP's authoritative `ACL::canModifyEvent()` gate, which attribute editing operations correctly invoked. No public exploit has been identified, but the integrity impact is significant for any collaborative MISP deployment because deleted threat intelligence attributes cannot trivially be recovered.
Sharing Group authorization bypass in MISP allows an authenticated user with attribute or Galaxy Cluster creation permissions to associate objects with Sharing Groups they are not permitted to use. The flaw resides in AttributesController and GalaxyClustersController, where authorization checks against the Sharing Group were only invoked when the request explicitly set distribution == 4 - an attacker can craft a request containing sharing_group_id while omitting or manipulating the distribution parameter, causing the membership verification to be skipped entirely. Successful exploitation can silently breach organizational information-sharing boundaries, injecting data into restricted Sharing Groups and potentially distributing it to unauthorized member organizations. No public exploit has been identified at time of analysis.
Persistent denial of service in MISP's event template subsystem allows an authenticated user with event-template write permissions to store malformed JSON as a template definition by bypassing semantic validation. When any authenticated user subsequently loads the event template index - an endpoint accessible to all authenticated users - an unhandled exception in afterFind() causes HTTP 500 errors instance-wide until an administrator manually repairs the offending database row. The patch enforces strict array-only validation on save and adds exception handling on retrieval with graceful degradation to an empty definition.
Session fixation in MISP's optional CustomAuth flow lets an attacker who pre-plants a known session identifier silently inherit a victim's fully authenticated MISP session after the victim logs in, gaining all privileges of the victim's account including access to shared threat intelligence, event data, and administrative functions. The flaw is confined to deployments explicitly configured to use CustomAuth - standard authentication modes are unaffected. Vendor patch is available at commit e2eb2f058; no public exploit identified at time of analysis.
Unlimited OTP brute-force against MISP's email-based two-factor authentication allows an attacker holding valid primary credentials to bypass the second factor and fully compromise a target account. The email_otp() endpoint applied no rate limiting or lockout, and the OTP is scoped to the user rather than the login session - enabling multiple concurrent sessions to hammer the same valid OTP simultaneously. Patch available via commit 8658062ea; no public exploit identified at time of analysis.
CSRF in MISP's cullEmptyEvents endpoint allows a network attacker to trigger irreversible mass deletion of published empty events by causing an authenticated, privileged MISP user's browser to auto-request a crafted URL - for example via an embedded image tag. The endpoint accepted HTTP GET requests, which CakePHP's SecurityComponent does not CSRF-validate because GET requests carry no body, causing the framework's hasData check to return false and bypass token enforcement. The deletion is particularly destructive because it runs with skipBlocklist set, meaning purged events leave no blocklist entries to prevent or track subsequent re-synchronization; fix commits are available on GitHub, though the exact patched release version is not independently confirmed. No public exploit code is identified at time of analysis.
Improper TLS certificate validation in MISP's CurlClient class allows an adjacent-network attacker to perform man-in-the-middle attacks against outbound HTTPS connections made by the MISP instance, including threat intelligence synchronization. The PHP property `CurlClient::$verifyPeer` was left uninitialized, defaulting to null, which cURL interprets as falsy and therefore disables peer certificate verification. A successful attacker can observe authentication material and exchanged threat intelligence, and inject falsified data into MISP's responses from remote services. No public exploit has been identified; SSVC rates exploitation as none at time of analysis.
Authentication bypass in MISP's LDAP and LinOTP login components lets a remote unauthenticated attacker impersonate an existing directory user by submitting an empty password for a known account email. The custom LdapAuthenticate and LinOTPAuthenticate classes replaced CakePHP's FormAuthenticate but omitted its credential-validation guard, so empty or non-string values reached ldap_bind() (which succeeds against directories permitting unauthenticated binds) or a local password hash derived from an empty string. If the impersonated account is privileged, the attacker gains full access to threat-intelligence data and configuration. No public exploit identified at time of analysis; a vendor patch (commit 0ee058548) is available.
Denial-of-service in misp-stix allows remote attackers to terminate long-running MISP importer processes or exhaust host memory and CPU by submitting malformed or oversized STIX 1 or STIX 2 documents. Two distinct conditions combine: parsing failures invoked sys.exit(), which raises SystemExit - a BaseException subclass that bypasses standard except Exception handlers in callers - causing unconditional process termination instead of a recoverable error; and the library materialized full document content in memory before applying any size or validity checks, with processing costs of 2-7x the raw input size enabling resource exhaustion. No public exploit identified at time of analysis; upstream fix commits are available on GitHub.
Path traversal in the misp-stix Python library allows an attacker who can supply crafted STIX 2 content to escape the configured object-template directory during PyMISP template resolution, reading arbitrary files accessible to the conversion process and copying their contents into converted MISP objects. All MISP deployments performing STIX 2 import or MISP-to-STIX 2 export via misp-stix are affected, with the flaw carrying a CVSS 4.0 score of 8.8. No public exploit or CISA KEV listing exists at time of analysis, but the vulnerability's persistent re-triggering pathway - where a poisoned MISP event is later re-exported by a higher-privilege process - represents a privilege-escalation risk beyond what the base score alone reflects.
Cross-site request forgery in CTI-Transmute's administrative user deletion endpoint enables unauthenticated remote attackers to delete arbitrary user accounts by inducing an authenticated administrator to follow a crafted link. The /account/delete/<id> endpoint accepted HTTP GET requests for an irreversible state-modifying operation, allowing any web page or email to silently trigger deletions using the victim's active session. No public exploit has been identified at time of analysis, though the attack requires no attacker credentials and depends solely on social engineering a logged-in administrator.
Uncontrolled resource consumption in CTI-Transmute's unauthenticated /activity_timeline endpoint allows remote attackers to exhaust database, CPU, and memory resources by submitting arbitrarily large values for the `days` query parameter. All versions of the MISP project's CTI-Transmute tool are affected until the upstream patch is applied; the fix clamps the parameter to a 1-1,095 day range. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 (VA:H, PR:N, AC:L) reflects that this is a trivially reachable denial-of-service with no authentication barrier.
Server-side request forgery in CTI-Transmute's evaluation report PDF-generation pipeline allows an attacker who can inject content into a CTI evaluation report to coerce the application server into fetching arbitrary internal or filesystem resources. The vulnerability arises because user-controlled fields - conversion names, descriptions, and comments - flow through a Markdown-to-HTML conversion and are then rendered to PDF by WeasyPrint with its default unrestricted URL-fetching behavior intact, meaning crafted file:// or http(s):// references embedded in that content are fetched by the server process at render time. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but a patch commit is available from the MISP project.
Open redirect in MISP installation scripts allows unauthenticated remote attackers to craft malicious URLs that leverage a missing trailing slash in the Apache HTTP-to-HTTPS redirect directive. When a user follows a crafted link on the legitimate MISP domain, the redirect appends attacker-controlled path content directly to the hostname, causing the browser to interpret the attacker’s domain as the destination host. This can lead to phishing and credential collection, though no active exploitation has been identified and a vendor patch is available.
Server-Side Request Forgery bypass in the html_to_markdown expansion module of misp-modules lets an authenticated attacker reach internal, loopback, and link-local services that the module's IP range filtering was meant to block. By supplying an IPv4-mapped IPv6 address such as http://[::ffff:169.254.169.254]/ (or a hostname resolving to one), the attacker defeats the blocked-range checks and can pull back internal content — including cloud instance metadata — rendered back to them as Markdown. No public exploit identified at time of analysis and it is not in CISA KEV, but the underlying IPv4-mapped-IPv6 filter bypass is a well-understood, easily reproduced technique.
Authenticated arbitrary code execution in MISP allows a site administrator to abuse the Kafka_rdkafka_config setting to load an attacker-controlled INI file, which is parsed and passed to rdkafka with options such as plugin.library.paths to load an arbitrary shared library. The flaw (CWE-829, inclusion of functionality from untrusted control sphere) yields code execution as the MISP process user; no public exploit identified at time of analysis, but a vendor patch is available.
Remote code execution in MISP allows authenticated site administrators to abuse the JsonLogTool NDJSON error log configuration to write attacker-controlled content to a PHP file under the webroot, yielding code execution as the web server user. No public exploit identified at time of analysis, but a vendor patch is available via the MISP GitHub repository.
Multiple OAuth 2.0 flow weaknesses in the MISP AAD (Azure Active Directory) authentication plugin allow session hijacking, session fixation, CSRF/replay against the OAuth callback, plaintext credential exposure over non-HTTPS redirect URIs, and log injection. The plugin reused the PHP session_id() as the OAuth state parameter, never rotated the session ID after login, did not enforce HTTPS on the redirect URI, and logged attacker-controlled GET parameters verbatim. No public exploit identified at time of analysis, but an upstream fix is available in MISP commit 146bc40.
Cross-organization data tampering in MISP (Malware Information Sharing Platform) core allows authenticated low-privileged users to modify or delete intelligence objects belonging to other organizations by exploiting broken access-control checks across Event Reports, Collection Elements, Analyst Data, Template Elements, and Decaying Models. The flaw stems from authorization being performed against the wrong entity ID or being entirely absent on write paths, enabling integrity attacks on shared threat intelligence. Vendor patches are available via multiple MISP GitHub commits; no public exploit identified at time of analysis.
Broken access control in MISP Core's bulk deletion handlers lets any authenticated user holding the broad perm_add or perm_sharing_group role flag hard-delete Event Reports and Sharing Groups belonging to other organisations across the entire instance. The flaw affects MISP threat-intelligence platform deployments and enables cross-tenant data destruction by contributor-level accounts; no public exploit identified at time of analysis, but the upstream patch commits are public and trivially reverse-engineerable.
Insecure direct object reference flaws in MISP threat-intelligence platform allow an authenticated user with access to any one authorized object to overwrite, re-parent, or transfer ownership of objects belonging to other users or organizations by submitting crafted REST/form payloads containing attacker-chosen primary keys and ownership foreign keys. The root cause is CRUDComponent::edit() mass-assigning payload-supplied IDs (id, event_id, org_id, user_id, sharing_group_id, etc.) onto the already-loaded record, so CakePHP's save() updates a different row than the one the authorization check validated. No public exploit identified at time of analysis, but a vendor patch is available and the high CVSS 4.0 score of 9.4 reflects broad cross-tenant impact.
Privilege escalation in MISP threat intelligence platform versions through 2.5.38 allows authenticated users to modify other users' account attributes by submitting a crafted User.id parameter in edit requests. The UsersController::edit() function failed to strip user-supplied identifiers before processing, enabling cross-account modifications. No public exploit identified at time of analysis, but the source code fix is publicly visible in the upstream commit.
Authorization bypass in MISP versions through 2.5.38 lets authenticated users delete records via HTTP DELETE requests even after the application's delete-validation callback has rejected the operation. The root cause is an operator-precedence bug in the CRUDComponent::delete() handler where missing parentheses caused validation checks to be skipped for the DELETE method. No public exploit identified at time of analysis, but the upstream fix commit on GitHub publicly discloses the exact one-line vulnerable expression, making weaponization trivial.
OTP authentication bypass in MISP affects deployments where LdapAuth.mixedAuth=true is combined with Security.require_otp=true, allowing attackers with valid LDAP (or other plugin) credentials to skip the mandatory second factor. Because the plugin-driven login establishes the session during the AppController beforeFilter phase, an attacker can authenticate, ignore the /users/otp challenge page, and browse directly to any authorized application URL as the victim. No public exploit identified at time of analysis, though the upstream commit clearly documents the bypass technique.
Insecure Direct Object Reference in MISP 2.5.0 through 2.5.37 allows authenticated users with shadow attribute submission privileges to overwrite arbitrary existing ShadowAttribute records by supplying a target id within the add proposal request. The framework's ORM interprets a client-supplied primary key as an update directive, breaking the boundary between proposal creation and modification. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Privilege escalation in MISP threat intelligence platform versions prior to 2.5.37 allows organization administrators to reset authentication keys of site administrator accounts within the same organization, yielding cross-tier access takeover. The flaw stems from missing authorization checks in the auth key reset workflow, enabling an org-admin to harvest a freshly generated site-admin API key. No public exploit identified at time of analysis, and EPSS rates exploitation probability at just 0.06%, but a vendor-released patch (2.5.37) is available.
SQL injection in MISP threat intelligence platform versions prior to 2.5.37 allows remote unauthenticated attackers to manipulate ORDER BY clauses in event and shadow attribute listing endpoints by supplying crafted ordering parameters. The CVSS 4.0 score of 9.3 reflects high impact across confidentiality, integrity, and availability, though EPSS exploitation probability sits at just 0.04% and no public exploit identified at time of analysis. Given MISP's role as a repository of sensitive threat-intelligence data shared between organizations, successful exploitation could expose IOCs, attribution data, and partner-shared intelligence.
LDAP injection in MISP (Malware Information Sharing Platform) versions prior to 2.5.36 enables unauthenticated attackers to bypass authentication and execute unauthorized LDAP queries. The vulnerability exists in ApacheAuthenticate.php when administrators configure apacheEnv to use user-controlled server variables instead of REMOTE_USER in proxy deployments. Attackers manipulate unsanitized username values to inject special characters into LDAP search filters, potentially gaining unauthorized access to the threat intelligence platform. No public exploit identified at time of analysis.
MISP 2.5.45 and earlier fails to apply its authentication-failure logging throttle on two API auth paths — requests presenting no API key and requests presenting a key of incorrect length — allowing an unauthenticated remote caller to write an unbounded number of durable auth_fail entries into the database. Repeated requests can exhaust storage and degrade or deny availability of the platform (CWE-770). No public exploit code and no CISA KEV entry were present in the supplied intelligence; an upstream fix commit (2bf887433) is available from the vendor.
Let me produce the JSON. Key details: MISP ≤2.5.45, Redis-based throttling of auth-failure logs; when Redis unavailable, _shouldLog() returned false, silencing logging. CWE-778 insufficient logging. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N — 5.1. Hmm, PR:L, UI:P. That's odd but okay. Impact: integrity of log data (VI:L). Actually the impact is loss of audit logs — integrity of the log record. Patch available: commit a39b25d2f. Reported by CIRCL. No KEV, no POC (POC status unknown — no POC data provided). Say "no public exploit identified at time of analysis". Prevalence: MISP is a widely used threat-intelligence sharing platform — medium to high. I'd say medium (common in SOC/CTI environments, not everywhere). Actually MISP is widely deployed among CERTs, SOCs, threat intel teams. I'd say "medium". assessed CVSS 3.1 vector: The flaw requires Redis to be unavailable (a precondition) and an attacker to attempt failed authentications (PR:L? actually auth failure attempts imply unauthenticated attackers trying). Hmm. The result is log suppression. AV:N, AC:H? The condition is a Redis outage — that's a configuration/environment condition. Let's think: CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N? Hmm. The logging suppression is a loss of accountability — impact on integrity of the log. But does it require the attacker to do anything? The vulnerability triggers whenever Redis is down and failed auth attempts occur. Attackers don't need privileges. However the 4.0 vector says PR:L — probably because the actor is "authenticated" in the sense that... hmm, actually the CNA scored PR:L. I need to produce my own independent vector. I'd argue: AV:N (attackers attempt auth remotely), AC:H (requires Redis unavailable — an environmental precondition, not attacker-controlled), PR:N (failed authentication attempts are unauthenticated by definition), UI:N, S:U, C:N, I:L (log integrity/audit trail), A:N. Hmm but should I use PR:L to align with the
MISP 2.5.45 and earlier can write corrupted access-log records for any HTTP request that ends in an unhandled exception, because CakePHP's CakeErrorController extends AppController and re-runs the application startup path, causing AccessLog::logRequest() to register a second deferred writer that overwrites the row written by the first pass. The overwritten fields include request duration, SQL query count, memory usage and potentially the query log, silently degrading the fidelity of MISP's own audit trail. Exploitation requires an authenticated session (CVSS 4.0 PR:L, VI:L only); no public exploit code or CISA KEV listing was identified at time of analysis, and an upstream fix commit (0dae5c072) is available.
Let me synthesize the analysis. Key facts: - CVE-2026-91857, CSRF (CWE-352) in MISP ≤2.5.45, fixed in 2.5.46. - State-changing controller actions accept GET: EventReportsController::purgeUnusedPictures(), NoticelistsController::enableNoticelist() (actually toggleEnable?), ServersController::removeOrphanedCorrelations(), WorkflowsController::rebuildRedis(). - Patch adds allowMethod(['post']). - CVSS 4.0 vector given: AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N → 5.3 - EPSS: not provided. KEV: not provided. POC: not provided. - Patch available from vendor; commit hash b4a5486b5. - Reporter: CIRCL (MISP's developer). - Tags: CSRF, Misp - CPE: cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* - Prevalence: MISP is a widely used threat intelligence sharing platform — high (widely-deployed enterprise software, but niche in that it's a specific security tool). I'd say "medium" or "high". MISP is deployed in many SOCs, CERTs, ISACs. I'd say high — it's a well-known platform in security community. Hmm. Given anchors: high = widely-deployed enterprise software. MISP is pretty common in threat intel sharing. I'll say "high". Actually could argue medium (common but not everywhere). MISP is used by most CERTs/ISACs and many enterprises. I'll go with "high". UI:P in the CVSS 4.0 vector — user must be tricked into visiting a page / clicking a link. Actually the description says GET can be induced cross-origin through links, images, redirects, or navigation. CVSS 4.0 UI:P (Passive) means the user doesn't have to actively interact beyond normal — e.g., just visiting a malicious page. So UI:P. PR:N in the CVSS 4.0 vector — no privileges required, but requires the victim's authenticated session. That's typical CSRF: PR:N in the CVSS sense (attacker doesn't need credentials), but exploitation requires the victim to be authenticated. My assessed CVSS 3.1 vector: CSRF requiring victim interaction. AV:N, AC:L, PR:N, UI:R (in 3.1, UI:R because victim must be tricked — in 3.1 there's no pa
Authenticated users of MISP 2.5.45 and earlier can list dashboard templates that are supposed to be restricted to other permission flags, such as perm_site_admin, because a MySQL type-juggling flaw makes the 'unrestricted' branch of the template query match every permission-restricted template. The bug is an incorrect-authorization error (CWE-863) in DashboardsController::listTemplates(), patched upstream in MISP 2.5.46; no public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 4.0 base score of 5.3 reflects only low confidentiality impact with no integrity or availability effect.
CSRF protection bypass in MISP ≤2.5.45 allows a network-adjacent attacker to forge authenticated state-changing requests against any MISP action that reads parameters from the URL. The bypass exploits CakePHP's method-override processing: submitting `_method=GET` (or an equivalent non-write verb via `X-HTTP-Method-Override`) causes CakePHP to empty the parsed request body before MISP's `BetterSecurityComponent` evaluates whether to run `_validatePost()` and `_validateCsrf()`. Because `hasData` is false after body-clearing, both protections are silently skipped entirely. No public exploit has been identified at time of analysis, but the mechanism is straightforward to weaponize by anyone who can lure an authenticated MISP user to a crafted page.
MISP's interactive CLI shell (versions ≤2.5.45) silently misattributes audit log entries when the CakePHP SysLogLogable singleton has its user context overwritten by a lazy-loaded model, causing privileged CLI writes to appear in the audit trail under the wrong user identity. Additionally, CLI-originated records lacked any distinguishing marker, making them indistinguishable from ordinary web-session actions in audit logs - a forensic and compliance problem for organizations relying on MISP's audit trail to attribute administrative activity. No public exploit exists and no active exploitation has been identified.
Cross-Site Request Forgery in MISP versions ≤2.5.45 allows a remote unauthenticated attacker to silently modify settings of an already-authenticated MISP user by inducing them to load a malicious page. Three UserSettingsController endpoints - setTheme, setHomePage, and eventIndexColumnToggle - were placed on the Security component's unlockedActions list, completely disabling CSRF token and field-hash validation for those POST endpoints. The highest-impact vector is setHomePage, which enables an attacker to redirect a threat analyst's MISP landing page to an attacker-controlled URL, creating a plausible pivot for credential phishing or social engineering; no active exploitation or public proof-of-concept has been identified at time of analysis.
HTML injection in MISP versions ≤2.5.45 allows any authenticated user with write access to embed arbitrary HTML markup in attribute types/values, object names/relations, or tag colour and name fields, which renders as live HTML when a report referencing those elements is exported to PDF via the convert_markdown_to_pdf module. The same component shipped a hardcoded sample-value defect - literal strings 'domain-ip' and 'google.com' used as format arguments rather than placeholders - meaning every plain attribute reference in a PDF displayed sample text instead of the real indicator, constituting a separate data-integrity failure. CIRCL, the MISP maintainer, patched both issues in commit 949744a4b (released as v2.5.46) by wrapping all user-controlled interpolations with CakePHP's h() HTML-encoding function. No public exploit has been identified and the CVE is not listed in CISA KEV.
Authenticated users in MISP ≤2.5.45 can retrieve object-reference records outside their authorized scope via an Insecure Direct Object Reference (IDOR) flaw in EventGraphTool::get_reference_data(). The vulnerable code queried ObjectReference by UUID and returned the matching row without verifying the requesting user has access to the parent object the reference belongs to. An authenticated attacker who knows or enumerates a reference UUID can access reference metadata - including relationship types, comments, and referenced UUIDs - from objects in events they are not permitted to view. No public exploit or CISA KEV entry exists at time of analysis.
Authenticated MISP users can enumerate the hidden organisation directory in deployments running version ≤2.5.45 where Security.hide_organisation_index_from_users is enabled, because multiple dashboard widgets failed to enforce the same authorization check that guards the standard /organisations/index endpoint. Three compounding weaknesses escalate the exposure beyond simple enumeration: missing checkPermissions() in NewOrgsWidget and OrgsContributorsGeneric allows any authenticated user to bypass the intended restriction; unrestricted find('all') database queries returned full organisation table rows including contacts and metadata through the JSON export code path; and a limit parameter flaw (limit=0 or negative values exploiting CakePHP DboSource behavior) effectively removed result pagination, potentially dumping the entire organisation table. CIRCL reported and patched the issue via commits 67892d90e and 5e333a159; no public exploit is identified at time of analysis.
Stored XSS in MISP's dashboard Button widget (≤2.5.45) allows an authenticated low-privilege user to embed javascript: URLs or WHATWG-normalized backslash authority forms into widget configuration, which execute in the browser of any analyst who subsequently interacts with that widget. The root cause is a parser differential between PHP's URL handling and the WHATWG URL Standard implemented by browsers: forms such as \\evil.com or /\evil.com appear relative or host-matching under PHP's parse_url() but resolve to an off-origin authority in modern browsers. The upstream fix, confirmed via commit adf704e94 authored by the MISP maintainers at CIRCL, introduces a shared DashboardURLValidator that explicitly rejects raw backslashes, javascript: and other dangerous schemes, control characters, and unauthorized absolute origins. No public exploit code or active exploitation has been identified at time of analysis.
Organisation metadata enumeration in MISP ≤2.5.45 is possible for authenticated users when the `Security.hide_organisation_index_from_users` configuration option is enabled, because the dashboard organisation picker queries the full organisation table without applying the same ACL conditions enforced by the standard organisation index and per-organisation view endpoints. The picker returns organisation ID, UUID, and name for all organisations, bypassing the visibility restriction. Patch commit 8ca4486af from CIRCL adds the missing `Organisation::createConditions()` call to scope picker results to organisations the requesting user is already authorised to see. No public exploit code has been identified and this CVE is not listed in CISA KEV.
Authenticated information disclosure in MISP ≤2.5.45 allows any logged-in user to bypass email-address redaction by switching from the HTML interface to the REST/JSON representation of DashboardsController::listTemplates(). The query always fetched User.email columns, but the redaction logic only executed inside the non-REST rendering branch - meaning the same session that saw blank email fields in the browser received raw email addresses when requesting JSON. The fix, contributed by CIRCL (MISP's primary maintainer) and released in commit fd554c3bd, centralizes the privilege decision in a new User::canSeeEmails() static helper, conditioning email retrieval on site-admin role or the Security.disclose_user_emails instance setting.
Open redirect in MISP ≤2.5.45 allows authenticated users to store a protocol-relative URL (e.g., //attacker.example) as a custom homepage setting, bypassing a path validation check that only required a leading /. On login, the post-login routing logic in UsersController and NewsController emits the stored value verbatim to the browser's Location header, redirecting victims to attacker-controlled external origins. No public exploit or active exploitation (CISA KEV) is identified; a vendor patch is confirmed in commit bd454f65a.
Unauthorized correlation data exposure in MISP ≤2.5.45 allows authenticated users with restricted access to observe event correlations, event metadata, and feed URLs that their ACL would normally block. The freetext feed preview endpoint invoked two raw database queries against the Attribute model filtered only by attribute value and deletion status, entirely bypassing MISP's multi-layered access controls covering event distribution, organization membership, sharing groups, and attribute- and object-level permissions. A second sub-issue in the same code path leaked cross-feed correlation results and configured feed URLs for feeds not marked as lookup-visible. No public exploit or KEV listing exists at time of analysis.
Cross-site request forgery in MISP allows an unauthenticated remote attacker to trigger unauthorized state changes on behalf of any authenticated user by abusing MISP's REST detection logic. The root flaw is that CSRF and form-security exemptions were granted whenever a request was classified as REST-style - a classification controlled by the HTTP Accept header, which cross-origin pages can freely set to application/json without triggering a CORS preflight. Any authenticated MISP analyst who visits an attacker-controlled page can have events created, modified, published, or deleted against their MISP instance using their own session. No public exploit has been identified at time of analysis, but the technique requires only standard browser APIs and social engineering, placing practical exploitation complexity well below the CVSS surface complexity rating.
Stored XSS in MISP's dashboard ButtonWidget allowed an authenticated user to persist arbitrary URLs - including `javascript:` scheme values - through the `updateSettings()` whole-layout save endpoint, which lacked the widget-config validation that `updateWidgetSettings()` already enforced. A malicious URL stored via this unguarded path could reach client-side rendering or navigation, potentially executing script in the victim's MISP browser session and enabling actions or data access at that user's privilege level. Practical exploitability was substantially reduced by MISP's existing render-time URL validation, making this a defense-in-depth persistence-layer gap rather than a confirmed end-to-end XSS bypass; no public exploit or active exploitation has been identified.
Reflected XSS in MISP's event attribute filtering query builder allows an unauthenticated attacker to execute arbitrary JavaScript in the security context of any authenticated MISP user who follows a crafted viewEventAttributes URL. The taggedAttributes and galaxyAttachedAttributes URL parameters are serialized via PHP's JsonTool::encode() with JSON_UNESCAPED_SLASHES and embedded raw into a <script> element; an attacker-controlled </script> sequence in either parameter breaks out of the script block and injects arbitrary HTML or JavaScript. Successful exploitation could yield session credential theft, unauthorized data modification, or any other action permitted by the victim's MISP role. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authenticated low-privileged users in MISP can receive OnDemand correlation results that reference attributes and events they are not authorized to access, bypassing the platform's distribution, sharing-group, organization, and event-level access controls. The flaw resided in `OnDemandCorrelationBehavior.php`, where `__collectCorrelations()` matched attributes by value alone and never filtered results against the requesting user's ACL - meaning any authenticated user could learn that a specific indicator value (IP address, hash, domain) appears in a restricted event belonging to another organization or sharing group. No public exploit has been identified at time of analysis; a vendor patch is confirmed as commit f51342f30 in the MISP GitHub repository.
Parser state isolation failure in misp-stix corrupts MISP event generation when the same parser instance is reused across independent STIX 1 and STIX 2 document conversions, causing retained artifacts - including galaxy clusters, passive DNS records, package titles, dates, and timestamps - from a prior document to contaminate subsequently generated MISP events. Applications directly consuming the misp-stix API with long-lived parser instances are at risk; the standard entry points that instantiate a fresh parser per file are not affected. No public exploit has been identified at time of analysis, and the CVSS 4.0 AT:P precondition metric confirms exploitation depends on a non-default deployment pattern compounded by attacker influence over document processing order.
STIX document import in misp-stix through version 2026.7.8 allows an unauthenticated attacker who can supply a crafted STIX bundle to inject arbitrary MISP attribute metadata - including distribution level, sharing_group_id, and classification tags - into the importing MISP instance. The import pipeline trusted attacker-controlled STIX fields (tool labels for STIX2, document title for STIX1) to decide whether content originated from MISP itself, and then passed the complete x_misp_attributes dictionary without field filtering directly into attribute creation. No public exploit has been identified at time of analysis; patch commits are available upstream from the MISP project.
Cross-site request forgery in MISP cti-transmute exposes four authenticated account endpoints - /account/follow, /account/delete_notification, /account/mark_notification_read, and /account/mark_all_read - to silent browser-driven invocation via malicious third-party pages. Because these state-changing operations were implemented as HTTP GET routes, any authenticated user visiting an attacker-controlled page could have follows added, notifications deleted, or notification state altered without consent. The fix (commit c352c2329e48ccc33a2b96d5353450cfbf7e89ec, reported by CIRCL) converts the routes to POST/DELETE and enforces X-CSRFToken header validation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV.
Stored cross-site scripting in MISP cti-transmute allows authenticated users to inject arbitrary script into shared graph configurations that are later executed in other users' browsers, including administrators. The flaw exists because the Pivotick graph rendering component interprets the svgIcon style property as raw HTML, and saved configurations were persisted without schema validation and shared across all users on the instance. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the admin-targeting path gives low-privileged attackers a meaningful privilege escalation surface in multi-user deployments.
Cross-site scripting in cti-transmute's MISP event-browser allows a malicious or compromised remote MISP instance to inject arbitrary HTML and JavaScript into the operator's browser by returning crafted values in event data fields. Affected fields include event IDs, event information text, organization names, tags, tag colors, TLP labels, distribution labels, and flash/error messages - all previously interpolated via innerHTML without sanitization. No public exploit code has been identified at time of analysis and the vulnerability is absent from CISA KEV; the low CVSS 4.0 score of 2.3 reflects the hard prerequisite that an attacker must control or compromise the specific MISP instance being queried.
Missing authorization in MISP cti-transmute (versions ≤ 1.4.0) allows any authenticated user to add or remove emoji reactions on comments they are not permitted to view by supplying an arbitrary comment_id to the react() handler. The handler validated syntactic ID format and emoji permissibility but never invoked the application's own access.can_see_comment() guard before calling comments_repo.toggle_reaction(), enabling unauthorized integrity modification of private comment metadata. No active exploitation (CISA KEV) or public exploit code is identified at time of analysis; the fix is confirmed in upstream commit a18c07c3dd4a74b91ad8dd23d6e84fee4bcbd457 and an authenticated account is a meaningful prerequisite.
Private evaluation comment disclosure in MISP's cti-transmute (all versions ≤ 1.4.0) allows any authenticated user with viewer-level access to a conversion to export its evaluation report as Markdown or PDF and obtain private comments that should have been restricted to the conversion owner, comment author, or an administrator. The root cause is a missing authorization check in build_evaluation_report(), which bypassed the same access-control logic enforced by normal comment retrieval. Leaked data includes comment content and author names. No public exploit code or CISA KEV listing exists at time of analysis; the fix is available as an upstream commit.
Email address disclosure in MISP cti-transmute versions up to and including 1.4.0 exposes private user email addresses to any authenticated platform user via the account following-list API endpoint. The get_following() function incorrectly serializes the followed user's email field alongside non-sensitive metadata such as name, user ID, and follow date, despite email being absent from comparable user-list endpoints in the same codebase. An authenticated attacker can systematically follow accounts to harvest the full platform user directory's email addresses; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized disclosure of deleted-conversion history data in MISP cti-transmute (≤ 1.4.0) stems from a logic inversion in the conversion-history details endpoint that allows the authorization check to be silently bypassed. When a history record references a deleted conversion, the lookup returns None, and the prior condition only enforced visibility when the conversion object existed - meaning None short-circuited the check and granted access. Any user able to submit a request for the affected history entry could retrieve retained input/output payloads associated with deleted conversions. No public exploit exists and the vulnerability is not listed in CISA KEV; a patch commit was issued on July 22, 2026.
Stored cross-site scripting in CTI-Transmute's conversion graph allows attacker-controlled CTI content (MISP or STIX objects) to execute arbitrary JavaScript in any analyst's browser who views the graph. The Pivotick graph library rendered node labels, sublabels, edge labels, node types, property names, property values, and hash algorithm identifiers through HTML-parsing operations (innerHTML, template.innerHTML) without sanitization, and a separate sink used an interpolated document.write() for the raw-JSON popup. The CVSS 4.0 score is 5.1 (Medium) with no authentication required of the attacker but user interaction required of the victim; no public exploit or KEV listing has been identified at time of analysis.
Stored Vue template injection in CTI-Transmute ≤ 1.5.0 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser of any user who views a compromised public conversion detail page. The attack bypasses Jinja2 HTML escaping because server-rendered values are injected into DOM regions subsequently compiled by Vue's runtime engine, which interprets the attacker-controlled `[[ ... ]]` expressions as live template code. The application's nonce-based CSP provides no protection because Vue's runtime compiler requires the `unsafe-eval` exception, permitting Function constructor escalation; no public exploit code beyond the proof-of-concept payload technique described in the advisory has been identified at time of analysis, and this CVE is not listed in CISA KEV.
MISP's attribute creation endpoint contains an authorization bypass allowing authenticated users with attribute-creation permissions to associate attributes with sharing groups they are not authorized to access. The flaw arises because the sharing group permission check was gated exclusively on the distribution field being set to 4 (sharing group mode), meaning a user could submit any non-empty sharing_group_id with a different distribution value and bypass the check entirely. No public exploit has been identified at time of analysis; a vendor patch is available via a confirmed GitHub commit.
Sharing group authorization bypass in MISP's object add/edit workflow allows an authenticated user with object-editing permissions to assign objects and their contained attributes to sharing groups they are not authorized to access or view. The flaw stems from a structural data merging step in ObjectsController.php that silently relocates field keys, causing the sharing group validation check to evaluate a stale, already-removed data path and thus never fire. An attacker exploiting this can probe the existence and names of non-visible sharing groups and improperly alter the distribution metadata of objects and embedded attributes. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Unauthorized sharing group assignment in MISP's non-REST event edit path allows any authenticated event editor to assign an event to a restricted sharing group they are not a member of by tampering with submitted form data. The REST API path enforced sharing group authorization via Event::_edit(), but the web form save path wrote sharing_group_id directly from POST data without equivalent validation - a classic split-path authorization gap (CWE-863). Successful exploitation leaks the restricted sharing group's name in event listings and corrupts the event's distribution metadata. No public exploit has been identified at time of analysis, and the fix is available as commit 609ff6c from the MISP maintainers (CIRCL).
User email enumeration in MISP's AuthKey edit endpoint allows any authenticated user holding AuthKey-edit permission to discover the email addresses of arbitrary platform users by manipulating a single POST parameter. The flaw exists in the validation-error rendering path of AuthKeysController.php, where the user dropdown was populated from attacker-controlled request body data rather than the persisted AuthKey owner, enabling systematic iteration over numeric user IDs. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the attack is trivially reproducible from the description and patch diff alone.
Reflected XSS in MISP's UiBeta event index view allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL with a specially encoded searcheventinfo parameter. The vulnerability exploits a double-encoding flaw: the PHP template applies only HTML escaping (h()) to the urlparams value placed inside a single-quoted JavaScript string in an onclick attribute, but browsers HTML-decode attribute values before JavaScript parsing - restoring encoded quote characters (' → ') and enabling string breakout. No public exploit code has been identified at time of analysis, and the fix has been committed upstream by the MISP maintainers at CIRCL.
Path traversal in MISP's OrganisationsController::getOrgLogo allows a low-privileged authenticated user to read arbitrary .png or .svg files from outside the intended organisation logo directory by injecting traversal sequences into organisation-controlled fields such as the organisation name, id, or uuid. All MISP versions prior to the patch commit b865deb are affected across any deployment where untrusted accounts hold write access to organisation fields. No public exploit code or CISA KEV listing exists at time of analysis; however, the attack requires only low-privilege access and no user interaction, making it practically exploitable in typical multi-tenant MISP deployments.
Stored cross-site scripting in MISP's setHomePage endpoint allows an authenticated user to persist an arbitrary JavaScript payload as their homepage setting when the Overmind theme is active, which later executes in any victim's browser upon viewing the News page and clicking the "Continue to homepage" link. The root cause is a theme-conditional code path in UserSettingsController that called setSettingInternal() directly, bypassing the validate_homepage validator that enforces a leading slash on path values, combined with an unescaped output sink in app/View/News/index.ctp. No public exploit has been identified at time of analysis; exploitation is bounded by the Overmind-theme-only precondition and mandatory victim interaction.
Incorrect authorization in MISP's event template builder exposes organisation-private galaxy definitions to any authenticated user due to a PHP operator-precedence bug that silently voids the intended access-control filter. In multi-tenant MISP deployments, authenticated non-site-admin users can enumerate all enabled galaxies - including organisation-only custom galaxies belonging to other organisations - through the template builder galaxy list. No active exploitation is confirmed (not listed in CISA KEV), but the low exploitation barrier (any valid account, no special privileges) makes this a meaningful metadata-disclosure risk wherever multiple organisations share a MISP instance.
Improper authorization in MISP permits an authenticated organization administrator to read or overwrite user settings and login profile data belonging to site administrator accounts that share the same organization. The ACL checks in UserLoginProfilesController, UserSettingsController, and the UserSetting model correctly scoped operations by org_id membership but failed to exclude users holding site-admin roles, allowing a lower-privileged admin to cross the intended privilege boundary. No public exploit has been identified at time of analysis; a patch is available via a CIRCL-reported upstream commit.
Stored cross-site scripting in MISP BSimVis through v0.2.0 allows network-accessible attackers who can create or influence tag names, collection names, entity identifiers, cluster names, or tag metadata to inject malicious payloads that execute in victims' browsers. The vulnerability spans multiple client-side rendering paths in tags.js, where user-controlled values were interpolated raw into innerHTML, HTML attributes, inline JavaScript event handlers, and CSS style values - covering tag badges, tooltips, context menus, cluster cards, autocomplete suggestions, and dynamically inserted tag cards. No public exploit has been identified at time of analysis; the issue was reported and patched by CIRCL, the primary MISP development organization.
Authenticated low-privileged users in MISP versions up to and including 2.5.38 can manipulate the fields parameter of the New Users and New Organisations dashboard widgets to bypass server-side field redaction and retrieve restricted metadata - including user email addresses even when email disclosure is explicitly disabled via Security.disclose_user_emails configuration. The root cause is an order-of-operations flaw: in the original code, the email redaction check was applied after the fallback logic that repopulated the field list, meaning a crafted empty field selection after validation could trigger a return of unredacted model fields. No public exploit has been identified at time of analysis, and SSVC rates exploitation status as none; however, the low attack complexity and absence of user interaction requirements mean any authenticated user can reliably reproduce the condition.
Improper input validation in MISP's over-correlations endpoint allows an authenticated high-privileged attacker to inject arbitrary ordering clauses into database queries via the user-controlled `order` request parameter. All MISP instances running version 2.5.38 and earlier are affected. While direct impact is bounded by query-ordering manipulation, the vulnerability carries SQLi tags and high subsequent system impact scores (SC:H/SI:H/SA:H in CVSS 4.0), suggesting that a successfully crafted ordering expression could escalate to unsafe query construction or unintended data exposure. No public exploit has been identified at time of analysis.
Open redirect in MISP versions up to and including 2.5.38 allows unauthenticated remote attackers to craft links that silently redirect victims to attacker-controlled external URLs immediately after successful authentication. The vulnerability resides in UsersController::routeafterlogin(), where the pre_login_requested_url session value was reflected into a Location header without enforcing local-path constraints. SSVC signals exploitation as 'none' and no CISA KEV listing exists, but the automatable designation and the high-trust context of a threat intelligence platform make this a meaningful phishing amplifier against security teams who would not expect a trusted MISP login to forward them off-site.
Open redirect in MISP's dashboard button widget (versions up to and including 2.5.38) enables an authenticated, high-privileged user who controls dashboard configuration to plant a crafted button URL that appears to point internally but redirects clicking users to an attacker-controlled external site. The root cause is an incomplete URL allowlist in Button.ctp that blocked explicit schemes, hosts, and user components but did not reject paths beginning with /\ - a pattern several browsers normalize into a scheme-relative URL (i.e., //attacker.com). No public exploit exists and CISA SSVC rates exploitation as none; risk is substantially constrained by the PR:H requirement and the need for a victim to interact with the planted button.
Authorization bypass in MISP's Event Template Importer allows authenticated users with template import privileges to overwrite event templates owned by other organizations on the same shared instance, violating inter-organizational data ownership boundaries. Versions up to and including 2.5.38 are affected; the overwrite workflow confirmed template existence but omitted an organizational ownership check, enabling cross-org template corruption. No public exploit code has been identified at time of analysis and SSVC signals no active exploitation, but the integrity impact is operationally significant in multi-tenant MISP deployments where organizational trust boundaries are critical.
Private galaxy metadata in MISP versions up to and including 2.5.38 was exposed to authenticated non-site-admin users through the event template builder workflow due to missing organisation and distribution-based access controls. The EventTemplatesController.php __setBuilderConfig() method queried all enabled galaxies without filtering by ownership or distribution level, allowing users from one organisation to read galaxy names, types, and descriptions that belong to other organisations and are marked private. No public exploit has been identified and SSVC rates exploitation as none; however, in multi-tenant intelligence-sharing environments this information disclosure carries meaningful operational security risk, as galaxy metadata can reveal the intelligence focus areas or classification schemes of peer organisations.
Stored XSS in MISP CTI Transmute's notification bell dropdown allows an attacker who can control convert names to inject arbitrary JavaScript that executes in authenticated users' browsers upon opening the notification panel. The vulnerability, tracked as EUVD-2026-32728 and reported by CIRCL, stems from innerHTML-based rendering of user-controlled notification content in base.html and affects all versions prior to upstream commit cf42409 - critically, only on the development branch, not production releases. No public exploit has been identified at time of analysis; the CVSS 4.0 score of 6.3 with AT:P reflects that exploitation requires the attacker to first influence a convert name surfaced in a notification.
MISP's CSP report endpoint in versions 2.5.0 through 2.5.37 accepts payloads up to 1 MB per report instead of the developer-intended 1 KB limit, due to a 1,024x magnitude error in the truncation guard (`1024 * 1024` instead of `1024`). On deployments where the endpoint is reachable by untrusted clients, unauthenticated remote parties (per CVSS PR:N) can abuse this discrepancy to flood application logs with oversized reports, contributing to disk exhaustion or log integrity degradation. No public exploit code exists and active exploitation has not been confirmed; the CVSS 4.0 score of 5.1 (Low-Medium) reflects the limited, availability-only impact.
Account takeover in MISP's OidcAuth plugin (versions 2.5.0 through 2.5.37) enables an unauthenticated attacker holding a valid OIDC token from an insecure or untrusted IdP to authenticate as any local MISP user whose account has a NULL stored `sub` value. The vulnerability arises because the plugin unconditionally trusted the OIDC email claim to link identities to existing local accounts without verifying email ownership, bypassing authentication controls entirely (CWE-287). No public exploit has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 6.0 reflects adjacent network vector and high complexity conditions that constrain realistic exposure.
Insufficient input validation in MISP's Collections model allows authenticated low-privileged users to inject malformed UUID values into Collection records, potentially causing data integrity issues or unexpected behavior in downstream code paths that assume RFC 4122-compliant UUIDs. Affected deployments are all MISP instances prior to version 2.5.37. No public exploit code exists and CISA's SSVC framework rates exploitation as none, making this a low-urgency integrity issue rather than an active threat, though integrity of Collection relationships and UUID-dependent logic is at risk until patched.