Misp
Monthly
Cross-site request forgery in MISP (Malware Information Sharing Platform) before v2.5.47 lets an unauthenticated attacker cause an authenticated administrator's browser to execute arbitrary workflow modules on the victim instance. Because the WorkflowsController's moduleStatelessExecution action was listed in CakePHP's unlockedActions, both the CSRF token check and the form field-hash validation were disabled, so an attacker-crafted cross-site form post submitted by a logged-in admin runs a module's exec() method with attacker-chosen input and parameters - including action modules that write blocklist and warninglist entries. The result is a high-integrity, low-complexity compromise of security-relevant data with no confidentiality or availability impact, and no public exploit code identified at time of analysis; this is a genuine but moderate-priority integrity flaw rather than an inflated high-CVSS finding, requiring the victim admin to be authenticated and induced to submit the crafted request.
Missing authorization in MISP allows an authenticated user who is not a site administrator - but who already holds legitimate view access to an event - to enumerate attributes, object details and related object data inside that event that are restricted to other sharing groups or higher distribution levels, by abusing the object-reference 'add' workflow that validated only event-level access. The assessed impact is confidentiality-only (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N; the vendor-published CVSS 4.0 vector scores 6.3), with no integrity or availability effect, and it is bounded by preconditions: valid credentials are required, the target event must actually mix data at different distribution levels, and deployments that do not use sharing groups or distribution segregation have nothing additional to expose. No public exploit identified at time of analysis, no confirmed active exploitation, and a fix is available per the vendor advisory via upstream commit f36634e57.
Authenticated users with editor (write) rights on at least one event in MISP can reparent an event report belonging to a different event by supplying that report's UUID during report creation or editing, because EventReport::editReport() matched existing rows by UUID without verifying the report's event_id matched the target event. Successful exploitation lets the attacker read and modify private reports they were never authorized to access, though impact is confined to report objects rather than the full instance dataset and the attacker must already know or guess the high-entropy UUID - a barrier that prevents enumeration or automated abuse. Affected versions are MISP before 2.5.47; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated attackers can defeat three login protections in MISP (Malware Information Sharing Platform) versions below 2.5.47 by sending authentication requests over HTTP methods other than POST or PUT: the brute-force blocklist and attempt counter are skipped, the email one-time-password (OTP) second factor is not enforced, and login failures are neither logged nor counted. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N), successful exploitation yields limited confidentiality and integrity impact rather than direct system access - an attacker gains unlimited, unlogged credential-guessing attempts against the login endpoint with MFA effectively disabled, so the practical outcome is credential compromise and subsequent unauthorized access to the MISP instance. This is a genuine but moderate-severity control-bypass rather than a direct-access vulnerability; no confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, and a vendor fix is available.
DOM-based cross-site scripting in the ContextualMenu JavaScript component of MISP (Malware Information Sharing Platform) allows an attacker who can influence the data rendered in the contextual menu - an authenticated low-privilege MISP user or a data-sharing peer feeding values into the UI - to execute script in a victim user's browser within the MISP application origin. The vulnerable code assigns untrusted option text to innerHTML in app/webroot/js/contextual_menu.js, so any string echoed into the menu is parsed as live markup; exploitation requires a victim to actively open the affected contextual menu (PR:L, UI:P) and the resulting impact is bounded to the victim's browser session, enabling session hijacking, data exfiltration, or actions on behalf of the authenticated user. The issue affects MISP versions below 2.5.47 and is fixed by the vendor in 2.5.47 (commit b062698f2); no public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV, with EPSS-style risk driven primarily by the broad MISP deployment base rather than demonstrated active exploitation.
Stored cross-site scripting in the MISP threat-intelligence platform (versions before 2.5.47) lets an authenticated user holding tag-editor privileges plant a crafted misp-galaxy tag whose content is rendered unescaped in the Galaxies index page of the default theme, so it executes in a site administrator's browser session when that page is viewed. Successful exploitation is confined to the administrator's browser context - reading session data and performing actions as the administrator - and does not directly compromise the MISP server process. Exploitation requires authenticated tag-editor access, the default theme (Overmind already HTML-escapes these values and is unaffected), and administrator page-view interaction; no public exploit code has been identified at time of analysis, and EPSS/KEV data are not provided.
Stored cross-site scripting in MISP before 2.5.47 allows an authenticated user holding the perm_galaxy_editor permission to create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup; because the galaxy name is interpolated verbatim via sprintf() into app/View/Users/statistics_galaxymatrix.ctp, the payload executes in the browser of any other user who later opens the galaxy matrix statistics page. Successful exploitation enables session hijacking, credential theft, data exfiltration, or attacker-controlled actions performed within the victim's MISP session, and requires victim interaction (UI:P) since the malicious page must be visited; no public exploit code or confirmed active exploitation was identified at time of analysis, and the flaw is rated medium (CVSS 4.0 6.3). Realistic exposure is limited to multi-user MISP instances where at least one account has galaxy-editing rights and other users consult the statistics view.
Server-side request forgery in the MISP sachertortephp library (a fork of CakePHP) lets any code that calls Xml::build() with the readFile option set to false still trigger an outbound HTTPS fetch whenever the supplied input string starts with 'https://', because a missing pair of parentheses in the gating condition makes the https:// branch independent of the readFile flag. The application then parses the remote response as XML and may hand it back to the caller, exposing internal-only services or attacker-chosen external endpoints to data disclosure, with the bundled HttpSocket configuration following up to 10 redirects to widen reachable targets. Exploitation is authenticated in practice (CVSS:4.0 PR:L / assessed CVSS:3.1 PR:L) and requires a reachable host-application code path that passes attacker-influenceable data to Xml::build(); no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). The http:// branch is correctly gated and is not exploitable - only the https:// scheme bypasses the intended suppression of remote reads.
MISP 2.5.45 and earlier fails to apply its authentication-failure logging throttle on two API auth paths — requests presenting no API key and requests presenting a key of incorrect length — allowing an unauthenticated remote caller to write an unbounded number of durable auth_fail entries into the database. Repeated requests can exhaust storage and degrade or deny availability of the platform (CWE-770). No public exploit code and no CISA KEV entry were present in the supplied intelligence; an upstream fix commit (2bf887433) is available from the vendor.
Failed authentication attempts against MISP 2.5.45 and earlier stop being written to the audit log whenever the Redis instance used for log throttling is unreachable, and they remain unwritten for the entire duration of the outage. The flaw is in AppController::_shouldLog(), which treats 'Redis returned false' as 'nothing to log' rather than degrading to verbose logging, so brute-force or credential-stuffing activity against the login endpoint silently disappears from the record. No public exploit code and no CISA KEV entry exist for this issue, and the vendor shipped a fix in MISP 2.5.46 via commit a39b25d2f.
MISP 2.5.45 and earlier can write corrupted access-log records for any HTTP request that ends in an unhandled exception, because CakePHP's CakeErrorController extends AppController and re-runs the application startup path, causing AccessLog::logRequest() to register a second deferred writer that overwrites the row written by the first pass. The overwritten fields include request duration, SQL query count, memory usage and potentially the query log, silently degrading the fidelity of MISP's own audit trail. Exploitation requires an authenticated session (CVSS 4.0 PR:L, VI:L only); no public exploit code or CISA KEV listing was identified at time of analysis, and an upstream fix commit (0dae5c072) is available.
Let me synthesize the analysis. Key facts: - CVE-2026-91857, CSRF (CWE-352) in MISP ≤2.5.45, fixed in 2.5.46. - State-changing controller actions accept GET: EventReportsController::purgeUnusedPictures(), NoticelistsController::enableNoticelist() (actually toggleEnable?), ServersController::removeOrphanedCorrelations(), WorkflowsController::rebuildRedis(). - Patch adds allowMethod(['post']). - CVSS 4.0 vector given: AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N → 5.3 - EPSS: not provided. KEV: not provided. POC: not provided. - Patch available from vendor; commit hash b4a5486b5. - Reporter: CIRCL (MISP's developer). - Tags: CSRF, Misp - CPE: cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* - Prevalence: MISP is a widely used threat intelligence sharing platform — high (widely-deployed enterprise software, but niche in that it's a specific security tool). I'd say "medium" or "high". MISP is deployed in many SOCs, CERTs, ISACs. I'd say high — it's a well-known platform in security community. Hmm. Given anchors: high = widely-deployed enterprise software. MISP is pretty common in threat intel sharing. I'll say "high". Actually could argue medium (common but not everywhere). MISP is used by most CERTs/ISACs and many enterprises. I'll go with "high". UI:P in the CVSS 4.0 vector — user must be tricked into visiting a page / clicking a link. Actually the description says GET can be induced cross-origin through links, images, redirects, or navigation. CVSS 4.0 UI:P (Passive) means the user doesn't have to actively interact beyond normal — e.g., just visiting a malicious page. So UI:P. PR:N in the CVSS 4.0 vector — no privileges required, but requires the victim's authenticated session. That's typical CSRF: PR:N in the CVSS sense (attacker doesn't need credentials), but exploitation requires the victim to be authenticated. My assessed CVSS 3.1 vector: CSRF requiring victim interaction. AV:N, AC:L, PR:N, UI:R (in 3.1, UI:R because victim must be tricked — in 3.1 there's no pa
Authenticated users of MISP 2.5.45 and earlier can list dashboard templates that are supposed to be restricted to other permission flags, such as perm_site_admin, because a MySQL type-juggling flaw makes the 'unrestricted' branch of the template query match every permission-restricted template. The bug is an incorrect-authorization error (CWE-863) in DashboardsController::listTemplates(), patched upstream in MISP 2.5.46; no public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 4.0 base score of 5.3 reflects only low confidentiality impact with no integrity or availability effect.
CSRF protection bypass in MISP ≤2.5.45 allows a network-adjacent attacker to forge authenticated state-changing requests against any MISP action that reads parameters from the URL. The bypass exploits CakePHP's method-override processing: submitting `_method=GET` (or an equivalent non-write verb via `X-HTTP-Method-Override`) causes CakePHP to empty the parsed request body before MISP's `BetterSecurityComponent` evaluates whether to run `_validatePost()` and `_validateCsrf()`. Because `hasData` is false after body-clearing, both protections are silently skipped entirely. No public exploit has been identified at time of analysis, but the mechanism is straightforward to weaponize by anyone who can lure an authenticated MISP user to a crafted page.
MISP's interactive CLI shell (versions ≤2.5.45) silently misattributes audit log entries when the CakePHP SysLogLogable singleton has its user context overwritten by a lazy-loaded model, causing privileged CLI writes to appear in the audit trail under the wrong user identity. Additionally, CLI-originated records lacked any distinguishing marker, making them indistinguishable from ordinary web-session actions in audit logs - a forensic and compliance problem for organizations relying on MISP's audit trail to attribute administrative activity. No public exploit exists and no active exploitation has been identified.
Cross-Site Request Forgery in MISP versions ≤2.5.45 allows a remote unauthenticated attacker to silently modify settings of an already-authenticated MISP user by inducing them to load a malicious page. Three UserSettingsController endpoints - setTheme, setHomePage, and eventIndexColumnToggle - were placed on the Security component's unlockedActions list, completely disabling CSRF token and field-hash validation for those POST endpoints. The highest-impact vector is setHomePage, which enables an attacker to redirect a threat analyst's MISP landing page to an attacker-controlled URL, creating a plausible pivot for credential phishing or social engineering; no active exploitation or public proof-of-concept has been identified at time of analysis.
HTML injection in MISP versions ≤2.5.45 allows any authenticated user with write access to embed arbitrary HTML markup in attribute types/values, object names/relations, or tag colour and name fields, which renders as live HTML when a report referencing those elements is exported to PDF via the convert_markdown_to_pdf module. The same component shipped a hardcoded sample-value defect - literal strings 'domain-ip' and 'google.com' used as format arguments rather than placeholders - meaning every plain attribute reference in a PDF displayed sample text instead of the real indicator, constituting a separate data-integrity failure. CIRCL, the MISP maintainer, patched both issues in commit 949744a4b (released as v2.5.46) by wrapping all user-controlled interpolations with CakePHP's h() HTML-encoding function. No public exploit has been identified and the CVE is not listed in CISA KEV.
Authenticated users in MISP ≤2.5.45 can retrieve object-reference records outside their authorized scope via an Insecure Direct Object Reference (IDOR) flaw in EventGraphTool::get_reference_data(). The vulnerable code queried ObjectReference by UUID and returned the matching row without verifying the requesting user has access to the parent object the reference belongs to. An authenticated attacker who knows or enumerates a reference UUID can access reference metadata - including relationship types, comments, and referenced UUIDs - from objects in events they are not permitted to view. No public exploit or CISA KEV entry exists at time of analysis.
Authenticated MISP users can enumerate the hidden organisation directory in deployments running version ≤2.5.45 where Security.hide_organisation_index_from_users is enabled, because multiple dashboard widgets failed to enforce the same authorization check that guards the standard /organisations/index endpoint. Three compounding weaknesses escalate the exposure beyond simple enumeration: missing checkPermissions() in NewOrgsWidget and OrgsContributorsGeneric allows any authenticated user to bypass the intended restriction; unrestricted find('all') database queries returned full organisation table rows including contacts and metadata through the JSON export code path; and a limit parameter flaw (limit=0 or negative values exploiting CakePHP DboSource behavior) effectively removed result pagination, potentially dumping the entire organisation table. CIRCL reported and patched the issue via commits 67892d90e and 5e333a159; no public exploit is identified at time of analysis.
Stored XSS in MISP's dashboard Button widget (≤2.5.45) allows an authenticated low-privilege user to embed javascript: URLs or WHATWG-normalized backslash authority forms into widget configuration, which execute in the browser of any analyst who subsequently interacts with that widget. The root cause is a parser differential between PHP's URL handling and the WHATWG URL Standard implemented by browsers: forms such as \\evil.com or /\evil.com appear relative or host-matching under PHP's parse_url() but resolve to an off-origin authority in modern browsers. The upstream fix, confirmed via commit adf704e94 authored by the MISP maintainers at CIRCL, introduces a shared DashboardURLValidator that explicitly rejects raw backslashes, javascript: and other dangerous schemes, control characters, and unauthorized absolute origins. No public exploit code or active exploitation has been identified at time of analysis.
Organisation metadata enumeration in MISP ≤2.5.45 is possible for authenticated users when the `Security.hide_organisation_index_from_users` configuration option is enabled, because the dashboard organisation picker queries the full organisation table without applying the same ACL conditions enforced by the standard organisation index and per-organisation view endpoints. The picker returns organisation ID, UUID, and name for all organisations, bypassing the visibility restriction. Patch commit 8ca4486af from CIRCL adds the missing `Organisation::createConditions()` call to scope picker results to organisations the requesting user is already authorised to see. No public exploit code has been identified and this CVE is not listed in CISA KEV.
Authenticated information disclosure in MISP ≤2.5.45 allows any logged-in user to bypass email-address redaction by switching from the HTML interface to the REST/JSON representation of DashboardsController::listTemplates(). The query always fetched User.email columns, but the redaction logic only executed inside the non-REST rendering branch - meaning the same session that saw blank email fields in the browser received raw email addresses when requesting JSON. The fix, contributed by CIRCL (MISP's primary maintainer) and released in commit fd554c3bd, centralizes the privilege decision in a new User::canSeeEmails() static helper, conditioning email retrieval on site-admin role or the Security.disclose_user_emails instance setting.
Open redirect in MISP ≤2.5.45 allows authenticated users to store a protocol-relative URL (e.g., //attacker.example) as a custom homepage setting, bypassing a path validation check that only required a leading /. On login, the post-login routing logic in UsersController and NewsController emits the stored value verbatim to the browser's Location header, redirecting victims to attacker-controlled external origins. No public exploit or active exploitation (CISA KEV) is identified; a vendor patch is confirmed in commit bd454f65a.
Unauthorized correlation data exposure in MISP ≤2.5.45 allows authenticated users with restricted access to observe event correlations, event metadata, and feed URLs that their ACL would normally block. The freetext feed preview endpoint invoked two raw database queries against the Attribute model filtered only by attribute value and deletion status, entirely bypassing MISP's multi-layered access controls covering event distribution, organization membership, sharing groups, and attribute- and object-level permissions. A second sub-issue in the same code path leaked cross-feed correlation results and configured feed URLs for feeds not marked as lookup-visible. No public exploit or KEV listing exists at time of analysis.
Cross-site request forgery in MISP allows an unauthenticated remote attacker to trigger unauthorized state changes on behalf of any authenticated user by abusing MISP's REST detection logic. The root flaw is that CSRF and form-security exemptions were granted whenever a request was classified as REST-style - a classification controlled by the HTTP Accept header, which cross-origin pages can freely set to application/json without triggering a CORS preflight. Any authenticated MISP analyst who visits an attacker-controlled page can have events created, modified, published, or deleted against their MISP instance using their own session. No public exploit has been identified at time of analysis, but the technique requires only standard browser APIs and social engineering, placing practical exploitation complexity well below the CVSS surface complexity rating.
Stored XSS in MISP's dashboard ButtonWidget allowed an authenticated user to persist arbitrary URLs - including `javascript:` scheme values - through the `updateSettings()` whole-layout save endpoint, which lacked the widget-config validation that `updateWidgetSettings()` already enforced. A malicious URL stored via this unguarded path could reach client-side rendering or navigation, potentially executing script in the victim's MISP browser session and enabling actions or data access at that user's privilege level. Practical exploitability was substantially reduced by MISP's existing render-time URL validation, making this a defense-in-depth persistence-layer gap rather than a confirmed end-to-end XSS bypass; no public exploit or active exploitation has been identified.
Reflected XSS in MISP's event attribute filtering query builder allows an unauthenticated attacker to execute arbitrary JavaScript in the security context of any authenticated MISP user who follows a crafted viewEventAttributes URL. The taggedAttributes and galaxyAttachedAttributes URL parameters are serialized via PHP's JsonTool::encode() with JSON_UNESCAPED_SLASHES and embedded raw into a <script> element; an attacker-controlled </script> sequence in either parameter breaks out of the script block and injects arbitrary HTML or JavaScript. Successful exploitation could yield session credential theft, unauthorized data modification, or any other action permitted by the victim's MISP role. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authenticated low-privileged users in MISP can receive OnDemand correlation results that reference attributes and events they are not authorized to access, bypassing the platform's distribution, sharing-group, organization, and event-level access controls. The flaw resided in `OnDemandCorrelationBehavior.php`, where `__collectCorrelations()` matched attributes by value alone and never filtered results against the requesting user's ACL - meaning any authenticated user could learn that a specific indicator value (IP address, hash, domain) appears in a restricted event belonging to another organization or sharing group. No public exploit has been identified at time of analysis; a vendor patch is confirmed as commit f51342f30 in the MISP GitHub repository.
Parser state isolation failure in misp-stix corrupts MISP event generation when the same parser instance is reused across independent STIX 1 and STIX 2 document conversions, causing retained artifacts - including galaxy clusters, passive DNS records, package titles, dates, and timestamps - from a prior document to contaminate subsequently generated MISP events. Applications directly consuming the misp-stix API with long-lived parser instances are at risk; the standard entry points that instantiate a fresh parser per file are not affected. No public exploit has been identified at time of analysis, and the CVSS 4.0 AT:P precondition metric confirms exploitation depends on a non-default deployment pattern compounded by attacker influence over document processing order.
STIX document import in misp-stix through version 2026.7.8 allows an unauthenticated attacker who can supply a crafted STIX bundle to inject arbitrary MISP attribute metadata - including distribution level, sharing_group_id, and classification tags - into the importing MISP instance. The import pipeline trusted attacker-controlled STIX fields (tool labels for STIX2, document title for STIX1) to decide whether content originated from MISP itself, and then passed the complete x_misp_attributes dictionary without field filtering directly into attribute creation. No public exploit has been identified at time of analysis; patch commits are available upstream from the MISP project.
Cross-site request forgery in MISP cti-transmute exposes four authenticated account endpoints - /account/follow, /account/delete_notification, /account/mark_notification_read, and /account/mark_all_read - to silent browser-driven invocation via malicious third-party pages. Because these state-changing operations were implemented as HTTP GET routes, any authenticated user visiting an attacker-controlled page could have follows added, notifications deleted, or notification state altered without consent. The fix (commit c352c2329e48ccc33a2b96d5353450cfbf7e89ec, reported by CIRCL) converts the routes to POST/DELETE and enforces X-CSRFToken header validation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV.
Stored cross-site scripting in MISP cti-transmute allows authenticated users to inject arbitrary script into shared graph configurations that are later executed in other users' browsers, including administrators. The flaw exists because the Pivotick graph rendering component interprets the svgIcon style property as raw HTML, and saved configurations were persisted without schema validation and shared across all users on the instance. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the admin-targeting path gives low-privileged attackers a meaningful privilege escalation surface in multi-user deployments.
Cross-site scripting in cti-transmute's MISP event-browser allows a malicious or compromised remote MISP instance to inject arbitrary HTML and JavaScript into the operator's browser by returning crafted values in event data fields. Affected fields include event IDs, event information text, organization names, tags, tag colors, TLP labels, distribution labels, and flash/error messages - all previously interpolated via innerHTML without sanitization. No public exploit code has been identified at time of analysis and the vulnerability is absent from CISA KEV; the low CVSS 4.0 score of 2.3 reflects the hard prerequisite that an attacker must control or compromise the specific MISP instance being queried.
Missing authorization in MISP cti-transmute (versions ≤ 1.4.0) allows any authenticated user to add or remove emoji reactions on comments they are not permitted to view by supplying an arbitrary comment_id to the react() handler. The handler validated syntactic ID format and emoji permissibility but never invoked the application's own access.can_see_comment() guard before calling comments_repo.toggle_reaction(), enabling unauthorized integrity modification of private comment metadata. No active exploitation (CISA KEV) or public exploit code is identified at time of analysis; the fix is confirmed in upstream commit a18c07c3dd4a74b91ad8dd23d6e84fee4bcbd457 and an authenticated account is a meaningful prerequisite.
Private evaluation comment disclosure in MISP's cti-transmute (all versions ≤ 1.4.0) allows any authenticated user with viewer-level access to a conversion to export its evaluation report as Markdown or PDF and obtain private comments that should have been restricted to the conversion owner, comment author, or an administrator. The root cause is a missing authorization check in build_evaluation_report(), which bypassed the same access-control logic enforced by normal comment retrieval. Leaked data includes comment content and author names. No public exploit code or CISA KEV listing exists at time of analysis; the fix is available as an upstream commit.
Email address disclosure in MISP cti-transmute versions up to and including 1.4.0 exposes private user email addresses to any authenticated platform user via the account following-list API endpoint. The get_following() function incorrectly serializes the followed user's email field alongside non-sensitive metadata such as name, user ID, and follow date, despite email being absent from comparable user-list endpoints in the same codebase. An authenticated attacker can systematically follow accounts to harvest the full platform user directory's email addresses; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized disclosure of deleted-conversion history data in MISP cti-transmute (≤ 1.4.0) stems from a logic inversion in the conversion-history details endpoint that allows the authorization check to be silently bypassed. When a history record references a deleted conversion, the lookup returns None, and the prior condition only enforced visibility when the conversion object existed - meaning None short-circuited the check and granted access. Any user able to submit a request for the affected history entry could retrieve retained input/output payloads associated with deleted conversions. No public exploit exists and the vulnerability is not listed in CISA KEV; a patch commit was issued on July 22, 2026.
Stored cross-site scripting in CTI-Transmute's conversion graph allows attacker-controlled CTI content (MISP or STIX objects) to execute arbitrary JavaScript in any analyst's browser who views the graph. The Pivotick graph library rendered node labels, sublabels, edge labels, node types, property names, property values, and hash algorithm identifiers through HTML-parsing operations (innerHTML, template.innerHTML) without sanitization, and a separate sink used an interpolated document.write() for the raw-JSON popup. The CVSS 4.0 score is 5.1 (Medium) with no authentication required of the attacker but user interaction required of the victim; no public exploit or KEV listing has been identified at time of analysis.
Stored Vue template injection in CTI-Transmute ≤ 1.5.0 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser of any user who views a compromised public conversion detail page. The attack bypasses Jinja2 HTML escaping because server-rendered values are injected into DOM regions subsequently compiled by Vue's runtime engine, which interprets the attacker-controlled `[[ ... ]]` expressions as live template code. The application's nonce-based CSP provides no protection because Vue's runtime compiler requires the `unsafe-eval` exception, permitting Function constructor escalation; no public exploit code beyond the proof-of-concept payload technique described in the advisory has been identified at time of analysis, and this CVE is not listed in CISA KEV.
MISP's attribute creation endpoint contains an authorization bypass allowing authenticated users with attribute-creation permissions to associate attributes with sharing groups they are not authorized to access. The flaw arises because the sharing group permission check was gated exclusively on the distribution field being set to 4 (sharing group mode), meaning a user could submit any non-empty sharing_group_id with a different distribution value and bypass the check entirely. No public exploit has been identified at time of analysis; a vendor patch is available via a confirmed GitHub commit.
Sharing group authorization bypass in MISP's object add/edit workflow allows an authenticated user with object-editing permissions to assign objects and their contained attributes to sharing groups they are not authorized to access or view. The flaw stems from a structural data merging step in ObjectsController.php that silently relocates field keys, causing the sharing group validation check to evaluate a stale, already-removed data path and thus never fire. An attacker exploiting this can probe the existence and names of non-visible sharing groups and improperly alter the distribution metadata of objects and embedded attributes. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Unauthorized sharing group assignment in MISP's non-REST event edit path allows any authenticated event editor to assign an event to a restricted sharing group they are not a member of by tampering with submitted form data. The REST API path enforced sharing group authorization via Event::_edit(), but the web form save path wrote sharing_group_id directly from POST data without equivalent validation - a classic split-path authorization gap (CWE-863). Successful exploitation leaks the restricted sharing group's name in event listings and corrupts the event's distribution metadata. No public exploit has been identified at time of analysis, and the fix is available as commit 609ff6c from the MISP maintainers (CIRCL).
User email enumeration in MISP's AuthKey edit endpoint allows any authenticated user holding AuthKey-edit permission to discover the email addresses of arbitrary platform users by manipulating a single POST parameter. The flaw exists in the validation-error rendering path of AuthKeysController.php, where the user dropdown was populated from attacker-controlled request body data rather than the persisted AuthKey owner, enabling systematic iteration over numeric user IDs. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the attack is trivially reproducible from the description and patch diff alone.
Reflected XSS in MISP's UiBeta event index view allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL with a specially encoded searcheventinfo parameter. The vulnerability exploits a double-encoding flaw: the PHP template applies only HTML escaping (h()) to the urlparams value placed inside a single-quoted JavaScript string in an onclick attribute, but browsers HTML-decode attribute values before JavaScript parsing - restoring encoded quote characters (' → ') and enabling string breakout. No public exploit code has been identified at time of analysis, and the fix has been committed upstream by the MISP maintainers at CIRCL.
Path traversal in MISP's OrganisationsController::getOrgLogo allows a low-privileged authenticated user to read arbitrary .png or .svg files from outside the intended organisation logo directory by injecting traversal sequences into organisation-controlled fields such as the organisation name, id, or uuid. All MISP versions prior to the patch commit b865deb are affected across any deployment where untrusted accounts hold write access to organisation fields. No public exploit code or CISA KEV listing exists at time of analysis; however, the attack requires only low-privilege access and no user interaction, making it practically exploitable in typical multi-tenant MISP deployments.
Stored cross-site scripting in MISP's setHomePage endpoint allows an authenticated user to persist an arbitrary JavaScript payload as their homepage setting when the Overmind theme is active, which later executes in any victim's browser upon viewing the News page and clicking the "Continue to homepage" link. The root cause is a theme-conditional code path in UserSettingsController that called setSettingInternal() directly, bypassing the validate_homepage validator that enforces a leading slash on path values, combined with an unescaped output sink in app/View/News/index.ctp. No public exploit has been identified at time of analysis; exploitation is bounded by the Overmind-theme-only precondition and mandatory victim interaction.
Incorrect authorization in MISP's event template builder exposes organisation-private galaxy definitions to any authenticated user due to a PHP operator-precedence bug that silently voids the intended access-control filter. In multi-tenant MISP deployments, authenticated non-site-admin users can enumerate all enabled galaxies - including organisation-only custom galaxies belonging to other organisations - through the template builder galaxy list. No active exploitation is confirmed (not listed in CISA KEV), but the low exploitation barrier (any valid account, no special privileges) makes this a meaningful metadata-disclosure risk wherever multiple organisations share a MISP instance.
Improper authorization in MISP permits an authenticated organization administrator to read or overwrite user settings and login profile data belonging to site administrator accounts that share the same organization. The ACL checks in UserLoginProfilesController, UserSettingsController, and the UserSetting model correctly scoped operations by org_id membership but failed to exclude users holding site-admin roles, allowing a lower-privileged admin to cross the intended privilege boundary. No public exploit has been identified at time of analysis; a patch is available via a CIRCL-reported upstream commit.
Stored cross-site scripting in MISP BSimVis through v0.2.0 allows network-accessible attackers who can create or influence tag names, collection names, entity identifiers, cluster names, or tag metadata to inject malicious payloads that execute in victims' browsers. The vulnerability spans multiple client-side rendering paths in tags.js, where user-controlled values were interpolated raw into innerHTML, HTML attributes, inline JavaScript event handlers, and CSS style values - covering tag badges, tooltips, context menus, cluster cards, autocomplete suggestions, and dynamically inserted tag cards. No public exploit has been identified at time of analysis; the issue was reported and patched by CIRCL, the primary MISP development organization.
Authenticated low-privileged users in MISP versions up to and including 2.5.38 can manipulate the fields parameter of the New Users and New Organisations dashboard widgets to bypass server-side field redaction and retrieve restricted metadata - including user email addresses even when email disclosure is explicitly disabled via Security.disclose_user_emails configuration. The root cause is an order-of-operations flaw: in the original code, the email redaction check was applied after the fallback logic that repopulated the field list, meaning a crafted empty field selection after validation could trigger a return of unredacted model fields. No public exploit has been identified at time of analysis, and SSVC rates exploitation status as none; however, the low attack complexity and absence of user interaction requirements mean any authenticated user can reliably reproduce the condition.
Improper input validation in MISP's over-correlations endpoint allows an authenticated high-privileged attacker to inject arbitrary ordering clauses into database queries via the user-controlled `order` request parameter. All MISP instances running version 2.5.38 and earlier are affected. While direct impact is bounded by query-ordering manipulation, the vulnerability carries SQLi tags and high subsequent system impact scores (SC:H/SI:H/SA:H in CVSS 4.0), suggesting that a successfully crafted ordering expression could escalate to unsafe query construction or unintended data exposure. No public exploit has been identified at time of analysis.
Open redirect in MISP versions up to and including 2.5.38 allows unauthenticated remote attackers to craft links that silently redirect victims to attacker-controlled external URLs immediately after successful authentication. The vulnerability resides in UsersController::routeafterlogin(), where the pre_login_requested_url session value was reflected into a Location header without enforcing local-path constraints. SSVC signals exploitation as 'none' and no CISA KEV listing exists, but the automatable designation and the high-trust context of a threat intelligence platform make this a meaningful phishing amplifier against security teams who would not expect a trusted MISP login to forward them off-site.
Open redirect in MISP's dashboard button widget (versions up to and including 2.5.38) enables an authenticated, high-privileged user who controls dashboard configuration to plant a crafted button URL that appears to point internally but redirects clicking users to an attacker-controlled external site. The root cause is an incomplete URL allowlist in Button.ctp that blocked explicit schemes, hosts, and user components but did not reject paths beginning with /\ - a pattern several browsers normalize into a scheme-relative URL (i.e., //attacker.com). No public exploit exists and CISA SSVC rates exploitation as none; risk is substantially constrained by the PR:H requirement and the need for a victim to interact with the planted button.
Authorization bypass in MISP's Event Template Importer allows authenticated users with template import privileges to overwrite event templates owned by other organizations on the same shared instance, violating inter-organizational data ownership boundaries. Versions up to and including 2.5.38 are affected; the overwrite workflow confirmed template existence but omitted an organizational ownership check, enabling cross-org template corruption. No public exploit code has been identified at time of analysis and SSVC signals no active exploitation, but the integrity impact is operationally significant in multi-tenant MISP deployments where organizational trust boundaries are critical.
Private galaxy metadata in MISP versions up to and including 2.5.38 was exposed to authenticated non-site-admin users through the event template builder workflow due to missing organisation and distribution-based access controls. The EventTemplatesController.php __setBuilderConfig() method queried all enabled galaxies without filtering by ownership or distribution level, allowing users from one organisation to read galaxy names, types, and descriptions that belong to other organisations and are marked private. No public exploit has been identified and SSVC rates exploitation as none; however, in multi-tenant intelligence-sharing environments this information disclosure carries meaningful operational security risk, as galaxy metadata can reveal the intelligence focus areas or classification schemes of peer organisations.
Stored XSS in MISP CTI Transmute's notification bell dropdown allows an attacker who can control convert names to inject arbitrary JavaScript that executes in authenticated users' browsers upon opening the notification panel. The vulnerability, tracked as EUVD-2026-32728 and reported by CIRCL, stems from innerHTML-based rendering of user-controlled notification content in base.html and affects all versions prior to upstream commit cf42409 - critically, only on the development branch, not production releases. No public exploit has been identified at time of analysis; the CVSS 4.0 score of 6.3 with AT:P reflects that exploitation requires the attacker to first influence a convert name surfaced in a notification.
MISP's CSP report endpoint in versions 2.5.0 through 2.5.37 accepts payloads up to 1 MB per report instead of the developer-intended 1 KB limit, due to a 1,024x magnitude error in the truncation guard (`1024 * 1024` instead of `1024`). On deployments where the endpoint is reachable by untrusted clients, unauthenticated remote parties (per CVSS PR:N) can abuse this discrepancy to flood application logs with oversized reports, contributing to disk exhaustion or log integrity degradation. No public exploit code exists and active exploitation has not been confirmed; the CVSS 4.0 score of 5.1 (Low-Medium) reflects the limited, availability-only impact.
Account takeover in MISP's OidcAuth plugin (versions 2.5.0 through 2.5.37) enables an unauthenticated attacker holding a valid OIDC token from an insecure or untrusted IdP to authenticate as any local MISP user whose account has a NULL stored `sub` value. The vulnerability arises because the plugin unconditionally trusted the OIDC email claim to link identities to existing local accounts without verifying email ownership, bypassing authentication controls entirely (CWE-287). No public exploit has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 6.0 reflects adjacent network vector and high complexity conditions that constrain realistic exposure.
Insufficient input validation in MISP's Collections model allows authenticated low-privileged users to inject malformed UUID values into Collection records, potentially causing data integrity issues or unexpected behavior in downstream code paths that assume RFC 4122-compliant UUIDs. Affected deployments are all MISP instances prior to version 2.5.37. No public exploit code exists and CISA's SSVC framework rates exploitation as none, making this a low-urgency integrity issue rather than an active threat, though integrity of Collection relationships and UUID-dependent logic is at risk until patched.
Stored cross-site scripting in MISP before 2.5.37 allows authenticated users with template modification permissions to inject arbitrary JavaScript via unvalidated type and category fields in template element attributes. The vulnerability exploits insufficient input validation in the template element attribute handling logic, enabling attackers to store malicious payloads that execute in the browsers of other users viewing the affected templates. No public exploit code identified at time of analysis.
Stored cross-site scripting in MISP (Malware Information Sharing Platform) versions before 2.5.28 allows authenticated users with workflow privileges to inject arbitrary JavaScript via the workflow execution path view (executionPath.ctp), where doT.js template expressions used unescaped interpolation. Successful exploitation against a user who views the affected page (UI:R) results in scope-changed compromise of the victim's MISP session, including high-confidentiality/integrity/availability impact (CVSS 9.0). Publicly available exploit code exists in researcher-published repositories; no CISA KEV listing at time of analysis.
In app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have a lack of sanitization for non-JSON responses. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In MISP before 2.4.193, menu_custom_right_link_html parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can conduct XSS attacks against every page. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In MISP before 2.4.193, menu_custom_right_link parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can conduct XSS attacks via a global menu link. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in the same org. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in MISP before 2.4.184. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in MISP before 2.4.184. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
app/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 allows XSS in the event timeline widget. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
An issue was discovered in MISP before 2.4.176. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in MISP before 2.4.176. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in MISP before 2.4.176. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in MISP before 2.4.176. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in MISP before 2.4.176. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in MISP 2.4.174. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
MISP 2.4.174 allows XSS in app/View/Events/index.ctp. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
MISP 2.4.172 mishandles different certificate file extensions in server sync. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In MISP 2.4.169, app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-site request forgery in MISP (Malware Information Sharing Platform) before v2.5.47 lets an unauthenticated attacker cause an authenticated administrator's browser to execute arbitrary workflow modules on the victim instance. Because the WorkflowsController's moduleStatelessExecution action was listed in CakePHP's unlockedActions, both the CSRF token check and the form field-hash validation were disabled, so an attacker-crafted cross-site form post submitted by a logged-in admin runs a module's exec() method with attacker-chosen input and parameters - including action modules that write blocklist and warninglist entries. The result is a high-integrity, low-complexity compromise of security-relevant data with no confidentiality or availability impact, and no public exploit code identified at time of analysis; this is a genuine but moderate-priority integrity flaw rather than an inflated high-CVSS finding, requiring the victim admin to be authenticated and induced to submit the crafted request.
Missing authorization in MISP allows an authenticated user who is not a site administrator - but who already holds legitimate view access to an event - to enumerate attributes, object details and related object data inside that event that are restricted to other sharing groups or higher distribution levels, by abusing the object-reference 'add' workflow that validated only event-level access. The assessed impact is confidentiality-only (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N; the vendor-published CVSS 4.0 vector scores 6.3), with no integrity or availability effect, and it is bounded by preconditions: valid credentials are required, the target event must actually mix data at different distribution levels, and deployments that do not use sharing groups or distribution segregation have nothing additional to expose. No public exploit identified at time of analysis, no confirmed active exploitation, and a fix is available per the vendor advisory via upstream commit f36634e57.
Authenticated users with editor (write) rights on at least one event in MISP can reparent an event report belonging to a different event by supplying that report's UUID during report creation or editing, because EventReport::editReport() matched existing rows by UUID without verifying the report's event_id matched the target event. Successful exploitation lets the attacker read and modify private reports they were never authorized to access, though impact is confined to report objects rather than the full instance dataset and the attacker must already know or guess the high-entropy UUID - a barrier that prevents enumeration or automated abuse. Affected versions are MISP before 2.5.47; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated attackers can defeat three login protections in MISP (Malware Information Sharing Platform) versions below 2.5.47 by sending authentication requests over HTTP methods other than POST or PUT: the brute-force blocklist and attempt counter are skipped, the email one-time-password (OTP) second factor is not enforced, and login failures are neither logged nor counted. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N), successful exploitation yields limited confidentiality and integrity impact rather than direct system access - an attacker gains unlimited, unlogged credential-guessing attempts against the login endpoint with MFA effectively disabled, so the practical outcome is credential compromise and subsequent unauthorized access to the MISP instance. This is a genuine but moderate-severity control-bypass rather than a direct-access vulnerability; no confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, and a vendor fix is available.
DOM-based cross-site scripting in the ContextualMenu JavaScript component of MISP (Malware Information Sharing Platform) allows an attacker who can influence the data rendered in the contextual menu - an authenticated low-privilege MISP user or a data-sharing peer feeding values into the UI - to execute script in a victim user's browser within the MISP application origin. The vulnerable code assigns untrusted option text to innerHTML in app/webroot/js/contextual_menu.js, so any string echoed into the menu is parsed as live markup; exploitation requires a victim to actively open the affected contextual menu (PR:L, UI:P) and the resulting impact is bounded to the victim's browser session, enabling session hijacking, data exfiltration, or actions on behalf of the authenticated user. The issue affects MISP versions below 2.5.47 and is fixed by the vendor in 2.5.47 (commit b062698f2); no public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV, with EPSS-style risk driven primarily by the broad MISP deployment base rather than demonstrated active exploitation.
Stored cross-site scripting in the MISP threat-intelligence platform (versions before 2.5.47) lets an authenticated user holding tag-editor privileges plant a crafted misp-galaxy tag whose content is rendered unescaped in the Galaxies index page of the default theme, so it executes in a site administrator's browser session when that page is viewed. Successful exploitation is confined to the administrator's browser context - reading session data and performing actions as the administrator - and does not directly compromise the MISP server process. Exploitation requires authenticated tag-editor access, the default theme (Overmind already HTML-escapes these values and is unaffected), and administrator page-view interaction; no public exploit code has been identified at time of analysis, and EPSS/KEV data are not provided.
Stored cross-site scripting in MISP before 2.5.47 allows an authenticated user holding the perm_galaxy_editor permission to create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup; because the galaxy name is interpolated verbatim via sprintf() into app/View/Users/statistics_galaxymatrix.ctp, the payload executes in the browser of any other user who later opens the galaxy matrix statistics page. Successful exploitation enables session hijacking, credential theft, data exfiltration, or attacker-controlled actions performed within the victim's MISP session, and requires victim interaction (UI:P) since the malicious page must be visited; no public exploit code or confirmed active exploitation was identified at time of analysis, and the flaw is rated medium (CVSS 4.0 6.3). Realistic exposure is limited to multi-user MISP instances where at least one account has galaxy-editing rights and other users consult the statistics view.
Server-side request forgery in the MISP sachertortephp library (a fork of CakePHP) lets any code that calls Xml::build() with the readFile option set to false still trigger an outbound HTTPS fetch whenever the supplied input string starts with 'https://', because a missing pair of parentheses in the gating condition makes the https:// branch independent of the readFile flag. The application then parses the remote response as XML and may hand it back to the caller, exposing internal-only services or attacker-chosen external endpoints to data disclosure, with the bundled HttpSocket configuration following up to 10 redirects to widen reachable targets. Exploitation is authenticated in practice (CVSS:4.0 PR:L / assessed CVSS:3.1 PR:L) and requires a reachable host-application code path that passes attacker-influenceable data to Xml::build(); no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). The http:// branch is correctly gated and is not exploitable - only the https:// scheme bypasses the intended suppression of remote reads.
MISP 2.5.45 and earlier fails to apply its authentication-failure logging throttle on two API auth paths — requests presenting no API key and requests presenting a key of incorrect length — allowing an unauthenticated remote caller to write an unbounded number of durable auth_fail entries into the database. Repeated requests can exhaust storage and degrade or deny availability of the platform (CWE-770). No public exploit code and no CISA KEV entry were present in the supplied intelligence; an upstream fix commit (2bf887433) is available from the vendor.
Failed authentication attempts against MISP 2.5.45 and earlier stop being written to the audit log whenever the Redis instance used for log throttling is unreachable, and they remain unwritten for the entire duration of the outage. The flaw is in AppController::_shouldLog(), which treats 'Redis returned false' as 'nothing to log' rather than degrading to verbose logging, so brute-force or credential-stuffing activity against the login endpoint silently disappears from the record. No public exploit code and no CISA KEV entry exist for this issue, and the vendor shipped a fix in MISP 2.5.46 via commit a39b25d2f.
MISP 2.5.45 and earlier can write corrupted access-log records for any HTTP request that ends in an unhandled exception, because CakePHP's CakeErrorController extends AppController and re-runs the application startup path, causing AccessLog::logRequest() to register a second deferred writer that overwrites the row written by the first pass. The overwritten fields include request duration, SQL query count, memory usage and potentially the query log, silently degrading the fidelity of MISP's own audit trail. Exploitation requires an authenticated session (CVSS 4.0 PR:L, VI:L only); no public exploit code or CISA KEV listing was identified at time of analysis, and an upstream fix commit (0dae5c072) is available.
Let me synthesize the analysis. Key facts: - CVE-2026-91857, CSRF (CWE-352) in MISP ≤2.5.45, fixed in 2.5.46. - State-changing controller actions accept GET: EventReportsController::purgeUnusedPictures(), NoticelistsController::enableNoticelist() (actually toggleEnable?), ServersController::removeOrphanedCorrelations(), WorkflowsController::rebuildRedis(). - Patch adds allowMethod(['post']). - CVSS 4.0 vector given: AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N → 5.3 - EPSS: not provided. KEV: not provided. POC: not provided. - Patch available from vendor; commit hash b4a5486b5. - Reporter: CIRCL (MISP's developer). - Tags: CSRF, Misp - CPE: cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* - Prevalence: MISP is a widely used threat intelligence sharing platform — high (widely-deployed enterprise software, but niche in that it's a specific security tool). I'd say "medium" or "high". MISP is deployed in many SOCs, CERTs, ISACs. I'd say high — it's a well-known platform in security community. Hmm. Given anchors: high = widely-deployed enterprise software. MISP is pretty common in threat intel sharing. I'll say "high". Actually could argue medium (common but not everywhere). MISP is used by most CERTs/ISACs and many enterprises. I'll go with "high". UI:P in the CVSS 4.0 vector — user must be tricked into visiting a page / clicking a link. Actually the description says GET can be induced cross-origin through links, images, redirects, or navigation. CVSS 4.0 UI:P (Passive) means the user doesn't have to actively interact beyond normal — e.g., just visiting a malicious page. So UI:P. PR:N in the CVSS 4.0 vector — no privileges required, but requires the victim's authenticated session. That's typical CSRF: PR:N in the CVSS sense (attacker doesn't need credentials), but exploitation requires the victim to be authenticated. My assessed CVSS 3.1 vector: CSRF requiring victim interaction. AV:N, AC:L, PR:N, UI:R (in 3.1, UI:R because victim must be tricked — in 3.1 there's no pa
Authenticated users of MISP 2.5.45 and earlier can list dashboard templates that are supposed to be restricted to other permission flags, such as perm_site_admin, because a MySQL type-juggling flaw makes the 'unrestricted' branch of the template query match every permission-restricted template. The bug is an incorrect-authorization error (CWE-863) in DashboardsController::listTemplates(), patched upstream in MISP 2.5.46; no public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 4.0 base score of 5.3 reflects only low confidentiality impact with no integrity or availability effect.
CSRF protection bypass in MISP ≤2.5.45 allows a network-adjacent attacker to forge authenticated state-changing requests against any MISP action that reads parameters from the URL. The bypass exploits CakePHP's method-override processing: submitting `_method=GET` (or an equivalent non-write verb via `X-HTTP-Method-Override`) causes CakePHP to empty the parsed request body before MISP's `BetterSecurityComponent` evaluates whether to run `_validatePost()` and `_validateCsrf()`. Because `hasData` is false after body-clearing, both protections are silently skipped entirely. No public exploit has been identified at time of analysis, but the mechanism is straightforward to weaponize by anyone who can lure an authenticated MISP user to a crafted page.
MISP's interactive CLI shell (versions ≤2.5.45) silently misattributes audit log entries when the CakePHP SysLogLogable singleton has its user context overwritten by a lazy-loaded model, causing privileged CLI writes to appear in the audit trail under the wrong user identity. Additionally, CLI-originated records lacked any distinguishing marker, making them indistinguishable from ordinary web-session actions in audit logs - a forensic and compliance problem for organizations relying on MISP's audit trail to attribute administrative activity. No public exploit exists and no active exploitation has been identified.
Cross-Site Request Forgery in MISP versions ≤2.5.45 allows a remote unauthenticated attacker to silently modify settings of an already-authenticated MISP user by inducing them to load a malicious page. Three UserSettingsController endpoints - setTheme, setHomePage, and eventIndexColumnToggle - were placed on the Security component's unlockedActions list, completely disabling CSRF token and field-hash validation for those POST endpoints. The highest-impact vector is setHomePage, which enables an attacker to redirect a threat analyst's MISP landing page to an attacker-controlled URL, creating a plausible pivot for credential phishing or social engineering; no active exploitation or public proof-of-concept has been identified at time of analysis.
HTML injection in MISP versions ≤2.5.45 allows any authenticated user with write access to embed arbitrary HTML markup in attribute types/values, object names/relations, or tag colour and name fields, which renders as live HTML when a report referencing those elements is exported to PDF via the convert_markdown_to_pdf module. The same component shipped a hardcoded sample-value defect - literal strings 'domain-ip' and 'google.com' used as format arguments rather than placeholders - meaning every plain attribute reference in a PDF displayed sample text instead of the real indicator, constituting a separate data-integrity failure. CIRCL, the MISP maintainer, patched both issues in commit 949744a4b (released as v2.5.46) by wrapping all user-controlled interpolations with CakePHP's h() HTML-encoding function. No public exploit has been identified and the CVE is not listed in CISA KEV.
Authenticated users in MISP ≤2.5.45 can retrieve object-reference records outside their authorized scope via an Insecure Direct Object Reference (IDOR) flaw in EventGraphTool::get_reference_data(). The vulnerable code queried ObjectReference by UUID and returned the matching row without verifying the requesting user has access to the parent object the reference belongs to. An authenticated attacker who knows or enumerates a reference UUID can access reference metadata - including relationship types, comments, and referenced UUIDs - from objects in events they are not permitted to view. No public exploit or CISA KEV entry exists at time of analysis.
Authenticated MISP users can enumerate the hidden organisation directory in deployments running version ≤2.5.45 where Security.hide_organisation_index_from_users is enabled, because multiple dashboard widgets failed to enforce the same authorization check that guards the standard /organisations/index endpoint. Three compounding weaknesses escalate the exposure beyond simple enumeration: missing checkPermissions() in NewOrgsWidget and OrgsContributorsGeneric allows any authenticated user to bypass the intended restriction; unrestricted find('all') database queries returned full organisation table rows including contacts and metadata through the JSON export code path; and a limit parameter flaw (limit=0 or negative values exploiting CakePHP DboSource behavior) effectively removed result pagination, potentially dumping the entire organisation table. CIRCL reported and patched the issue via commits 67892d90e and 5e333a159; no public exploit is identified at time of analysis.
Stored XSS in MISP's dashboard Button widget (≤2.5.45) allows an authenticated low-privilege user to embed javascript: URLs or WHATWG-normalized backslash authority forms into widget configuration, which execute in the browser of any analyst who subsequently interacts with that widget. The root cause is a parser differential between PHP's URL handling and the WHATWG URL Standard implemented by browsers: forms such as \\evil.com or /\evil.com appear relative or host-matching under PHP's parse_url() but resolve to an off-origin authority in modern browsers. The upstream fix, confirmed via commit adf704e94 authored by the MISP maintainers at CIRCL, introduces a shared DashboardURLValidator that explicitly rejects raw backslashes, javascript: and other dangerous schemes, control characters, and unauthorized absolute origins. No public exploit code or active exploitation has been identified at time of analysis.
Organisation metadata enumeration in MISP ≤2.5.45 is possible for authenticated users when the `Security.hide_organisation_index_from_users` configuration option is enabled, because the dashboard organisation picker queries the full organisation table without applying the same ACL conditions enforced by the standard organisation index and per-organisation view endpoints. The picker returns organisation ID, UUID, and name for all organisations, bypassing the visibility restriction. Patch commit 8ca4486af from CIRCL adds the missing `Organisation::createConditions()` call to scope picker results to organisations the requesting user is already authorised to see. No public exploit code has been identified and this CVE is not listed in CISA KEV.
Authenticated information disclosure in MISP ≤2.5.45 allows any logged-in user to bypass email-address redaction by switching from the HTML interface to the REST/JSON representation of DashboardsController::listTemplates(). The query always fetched User.email columns, but the redaction logic only executed inside the non-REST rendering branch - meaning the same session that saw blank email fields in the browser received raw email addresses when requesting JSON. The fix, contributed by CIRCL (MISP's primary maintainer) and released in commit fd554c3bd, centralizes the privilege decision in a new User::canSeeEmails() static helper, conditioning email retrieval on site-admin role or the Security.disclose_user_emails instance setting.
Open redirect in MISP ≤2.5.45 allows authenticated users to store a protocol-relative URL (e.g., //attacker.example) as a custom homepage setting, bypassing a path validation check that only required a leading /. On login, the post-login routing logic in UsersController and NewsController emits the stored value verbatim to the browser's Location header, redirecting victims to attacker-controlled external origins. No public exploit or active exploitation (CISA KEV) is identified; a vendor patch is confirmed in commit bd454f65a.
Unauthorized correlation data exposure in MISP ≤2.5.45 allows authenticated users with restricted access to observe event correlations, event metadata, and feed URLs that their ACL would normally block. The freetext feed preview endpoint invoked two raw database queries against the Attribute model filtered only by attribute value and deletion status, entirely bypassing MISP's multi-layered access controls covering event distribution, organization membership, sharing groups, and attribute- and object-level permissions. A second sub-issue in the same code path leaked cross-feed correlation results and configured feed URLs for feeds not marked as lookup-visible. No public exploit or KEV listing exists at time of analysis.
Cross-site request forgery in MISP allows an unauthenticated remote attacker to trigger unauthorized state changes on behalf of any authenticated user by abusing MISP's REST detection logic. The root flaw is that CSRF and form-security exemptions were granted whenever a request was classified as REST-style - a classification controlled by the HTTP Accept header, which cross-origin pages can freely set to application/json without triggering a CORS preflight. Any authenticated MISP analyst who visits an attacker-controlled page can have events created, modified, published, or deleted against their MISP instance using their own session. No public exploit has been identified at time of analysis, but the technique requires only standard browser APIs and social engineering, placing practical exploitation complexity well below the CVSS surface complexity rating.
Stored XSS in MISP's dashboard ButtonWidget allowed an authenticated user to persist arbitrary URLs - including `javascript:` scheme values - through the `updateSettings()` whole-layout save endpoint, which lacked the widget-config validation that `updateWidgetSettings()` already enforced. A malicious URL stored via this unguarded path could reach client-side rendering or navigation, potentially executing script in the victim's MISP browser session and enabling actions or data access at that user's privilege level. Practical exploitability was substantially reduced by MISP's existing render-time URL validation, making this a defense-in-depth persistence-layer gap rather than a confirmed end-to-end XSS bypass; no public exploit or active exploitation has been identified.
Reflected XSS in MISP's event attribute filtering query builder allows an unauthenticated attacker to execute arbitrary JavaScript in the security context of any authenticated MISP user who follows a crafted viewEventAttributes URL. The taggedAttributes and galaxyAttachedAttributes URL parameters are serialized via PHP's JsonTool::encode() with JSON_UNESCAPED_SLASHES and embedded raw into a <script> element; an attacker-controlled </script> sequence in either parameter breaks out of the script block and injects arbitrary HTML or JavaScript. Successful exploitation could yield session credential theft, unauthorized data modification, or any other action permitted by the victim's MISP role. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authenticated low-privileged users in MISP can receive OnDemand correlation results that reference attributes and events they are not authorized to access, bypassing the platform's distribution, sharing-group, organization, and event-level access controls. The flaw resided in `OnDemandCorrelationBehavior.php`, where `__collectCorrelations()` matched attributes by value alone and never filtered results against the requesting user's ACL - meaning any authenticated user could learn that a specific indicator value (IP address, hash, domain) appears in a restricted event belonging to another organization or sharing group. No public exploit has been identified at time of analysis; a vendor patch is confirmed as commit f51342f30 in the MISP GitHub repository.
Parser state isolation failure in misp-stix corrupts MISP event generation when the same parser instance is reused across independent STIX 1 and STIX 2 document conversions, causing retained artifacts - including galaxy clusters, passive DNS records, package titles, dates, and timestamps - from a prior document to contaminate subsequently generated MISP events. Applications directly consuming the misp-stix API with long-lived parser instances are at risk; the standard entry points that instantiate a fresh parser per file are not affected. No public exploit has been identified at time of analysis, and the CVSS 4.0 AT:P precondition metric confirms exploitation depends on a non-default deployment pattern compounded by attacker influence over document processing order.
STIX document import in misp-stix through version 2026.7.8 allows an unauthenticated attacker who can supply a crafted STIX bundle to inject arbitrary MISP attribute metadata - including distribution level, sharing_group_id, and classification tags - into the importing MISP instance. The import pipeline trusted attacker-controlled STIX fields (tool labels for STIX2, document title for STIX1) to decide whether content originated from MISP itself, and then passed the complete x_misp_attributes dictionary without field filtering directly into attribute creation. No public exploit has been identified at time of analysis; patch commits are available upstream from the MISP project.
Cross-site request forgery in MISP cti-transmute exposes four authenticated account endpoints - /account/follow, /account/delete_notification, /account/mark_notification_read, and /account/mark_all_read - to silent browser-driven invocation via malicious third-party pages. Because these state-changing operations were implemented as HTTP GET routes, any authenticated user visiting an attacker-controlled page could have follows added, notifications deleted, or notification state altered without consent. The fix (commit c352c2329e48ccc33a2b96d5353450cfbf7e89ec, reported by CIRCL) converts the routes to POST/DELETE and enforces X-CSRFToken header validation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV.
Stored cross-site scripting in MISP cti-transmute allows authenticated users to inject arbitrary script into shared graph configurations that are later executed in other users' browsers, including administrators. The flaw exists because the Pivotick graph rendering component interprets the svgIcon style property as raw HTML, and saved configurations were persisted without schema validation and shared across all users on the instance. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the admin-targeting path gives low-privileged attackers a meaningful privilege escalation surface in multi-user deployments.
Cross-site scripting in cti-transmute's MISP event-browser allows a malicious or compromised remote MISP instance to inject arbitrary HTML and JavaScript into the operator's browser by returning crafted values in event data fields. Affected fields include event IDs, event information text, organization names, tags, tag colors, TLP labels, distribution labels, and flash/error messages - all previously interpolated via innerHTML without sanitization. No public exploit code has been identified at time of analysis and the vulnerability is absent from CISA KEV; the low CVSS 4.0 score of 2.3 reflects the hard prerequisite that an attacker must control or compromise the specific MISP instance being queried.
Missing authorization in MISP cti-transmute (versions ≤ 1.4.0) allows any authenticated user to add or remove emoji reactions on comments they are not permitted to view by supplying an arbitrary comment_id to the react() handler. The handler validated syntactic ID format and emoji permissibility but never invoked the application's own access.can_see_comment() guard before calling comments_repo.toggle_reaction(), enabling unauthorized integrity modification of private comment metadata. No active exploitation (CISA KEV) or public exploit code is identified at time of analysis; the fix is confirmed in upstream commit a18c07c3dd4a74b91ad8dd23d6e84fee4bcbd457 and an authenticated account is a meaningful prerequisite.
Private evaluation comment disclosure in MISP's cti-transmute (all versions ≤ 1.4.0) allows any authenticated user with viewer-level access to a conversion to export its evaluation report as Markdown or PDF and obtain private comments that should have been restricted to the conversion owner, comment author, or an administrator. The root cause is a missing authorization check in build_evaluation_report(), which bypassed the same access-control logic enforced by normal comment retrieval. Leaked data includes comment content and author names. No public exploit code or CISA KEV listing exists at time of analysis; the fix is available as an upstream commit.
Email address disclosure in MISP cti-transmute versions up to and including 1.4.0 exposes private user email addresses to any authenticated platform user via the account following-list API endpoint. The get_following() function incorrectly serializes the followed user's email field alongside non-sensitive metadata such as name, user ID, and follow date, despite email being absent from comparable user-list endpoints in the same codebase. An authenticated attacker can systematically follow accounts to harvest the full platform user directory's email addresses; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized disclosure of deleted-conversion history data in MISP cti-transmute (≤ 1.4.0) stems from a logic inversion in the conversion-history details endpoint that allows the authorization check to be silently bypassed. When a history record references a deleted conversion, the lookup returns None, and the prior condition only enforced visibility when the conversion object existed - meaning None short-circuited the check and granted access. Any user able to submit a request for the affected history entry could retrieve retained input/output payloads associated with deleted conversions. No public exploit exists and the vulnerability is not listed in CISA KEV; a patch commit was issued on July 22, 2026.
Stored cross-site scripting in CTI-Transmute's conversion graph allows attacker-controlled CTI content (MISP or STIX objects) to execute arbitrary JavaScript in any analyst's browser who views the graph. The Pivotick graph library rendered node labels, sublabels, edge labels, node types, property names, property values, and hash algorithm identifiers through HTML-parsing operations (innerHTML, template.innerHTML) without sanitization, and a separate sink used an interpolated document.write() for the raw-JSON popup. The CVSS 4.0 score is 5.1 (Medium) with no authentication required of the attacker but user interaction required of the victim; no public exploit or KEV listing has been identified at time of analysis.
Stored Vue template injection in CTI-Transmute ≤ 1.5.0 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser of any user who views a compromised public conversion detail page. The attack bypasses Jinja2 HTML escaping because server-rendered values are injected into DOM regions subsequently compiled by Vue's runtime engine, which interprets the attacker-controlled `[[ ... ]]` expressions as live template code. The application's nonce-based CSP provides no protection because Vue's runtime compiler requires the `unsafe-eval` exception, permitting Function constructor escalation; no public exploit code beyond the proof-of-concept payload technique described in the advisory has been identified at time of analysis, and this CVE is not listed in CISA KEV.
MISP's attribute creation endpoint contains an authorization bypass allowing authenticated users with attribute-creation permissions to associate attributes with sharing groups they are not authorized to access. The flaw arises because the sharing group permission check was gated exclusively on the distribution field being set to 4 (sharing group mode), meaning a user could submit any non-empty sharing_group_id with a different distribution value and bypass the check entirely. No public exploit has been identified at time of analysis; a vendor patch is available via a confirmed GitHub commit.
Sharing group authorization bypass in MISP's object add/edit workflow allows an authenticated user with object-editing permissions to assign objects and their contained attributes to sharing groups they are not authorized to access or view. The flaw stems from a structural data merging step in ObjectsController.php that silently relocates field keys, causing the sharing group validation check to evaluate a stale, already-removed data path and thus never fire. An attacker exploiting this can probe the existence and names of non-visible sharing groups and improperly alter the distribution metadata of objects and embedded attributes. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Unauthorized sharing group assignment in MISP's non-REST event edit path allows any authenticated event editor to assign an event to a restricted sharing group they are not a member of by tampering with submitted form data. The REST API path enforced sharing group authorization via Event::_edit(), but the web form save path wrote sharing_group_id directly from POST data without equivalent validation - a classic split-path authorization gap (CWE-863). Successful exploitation leaks the restricted sharing group's name in event listings and corrupts the event's distribution metadata. No public exploit has been identified at time of analysis, and the fix is available as commit 609ff6c from the MISP maintainers (CIRCL).
User email enumeration in MISP's AuthKey edit endpoint allows any authenticated user holding AuthKey-edit permission to discover the email addresses of arbitrary platform users by manipulating a single POST parameter. The flaw exists in the validation-error rendering path of AuthKeysController.php, where the user dropdown was populated from attacker-controlled request body data rather than the persisted AuthKey owner, enabling systematic iteration over numeric user IDs. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the attack is trivially reproducible from the description and patch diff alone.
Reflected XSS in MISP's UiBeta event index view allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL with a specially encoded searcheventinfo parameter. The vulnerability exploits a double-encoding flaw: the PHP template applies only HTML escaping (h()) to the urlparams value placed inside a single-quoted JavaScript string in an onclick attribute, but browsers HTML-decode attribute values before JavaScript parsing - restoring encoded quote characters (' → ') and enabling string breakout. No public exploit code has been identified at time of analysis, and the fix has been committed upstream by the MISP maintainers at CIRCL.
Path traversal in MISP's OrganisationsController::getOrgLogo allows a low-privileged authenticated user to read arbitrary .png or .svg files from outside the intended organisation logo directory by injecting traversal sequences into organisation-controlled fields such as the organisation name, id, or uuid. All MISP versions prior to the patch commit b865deb are affected across any deployment where untrusted accounts hold write access to organisation fields. No public exploit code or CISA KEV listing exists at time of analysis; however, the attack requires only low-privilege access and no user interaction, making it practically exploitable in typical multi-tenant MISP deployments.
Stored cross-site scripting in MISP's setHomePage endpoint allows an authenticated user to persist an arbitrary JavaScript payload as their homepage setting when the Overmind theme is active, which later executes in any victim's browser upon viewing the News page and clicking the "Continue to homepage" link. The root cause is a theme-conditional code path in UserSettingsController that called setSettingInternal() directly, bypassing the validate_homepage validator that enforces a leading slash on path values, combined with an unescaped output sink in app/View/News/index.ctp. No public exploit has been identified at time of analysis; exploitation is bounded by the Overmind-theme-only precondition and mandatory victim interaction.
Incorrect authorization in MISP's event template builder exposes organisation-private galaxy definitions to any authenticated user due to a PHP operator-precedence bug that silently voids the intended access-control filter. In multi-tenant MISP deployments, authenticated non-site-admin users can enumerate all enabled galaxies - including organisation-only custom galaxies belonging to other organisations - through the template builder galaxy list. No active exploitation is confirmed (not listed in CISA KEV), but the low exploitation barrier (any valid account, no special privileges) makes this a meaningful metadata-disclosure risk wherever multiple organisations share a MISP instance.
Improper authorization in MISP permits an authenticated organization administrator to read or overwrite user settings and login profile data belonging to site administrator accounts that share the same organization. The ACL checks in UserLoginProfilesController, UserSettingsController, and the UserSetting model correctly scoped operations by org_id membership but failed to exclude users holding site-admin roles, allowing a lower-privileged admin to cross the intended privilege boundary. No public exploit has been identified at time of analysis; a patch is available via a CIRCL-reported upstream commit.
Stored cross-site scripting in MISP BSimVis through v0.2.0 allows network-accessible attackers who can create or influence tag names, collection names, entity identifiers, cluster names, or tag metadata to inject malicious payloads that execute in victims' browsers. The vulnerability spans multiple client-side rendering paths in tags.js, where user-controlled values were interpolated raw into innerHTML, HTML attributes, inline JavaScript event handlers, and CSS style values - covering tag badges, tooltips, context menus, cluster cards, autocomplete suggestions, and dynamically inserted tag cards. No public exploit has been identified at time of analysis; the issue was reported and patched by CIRCL, the primary MISP development organization.
Authenticated low-privileged users in MISP versions up to and including 2.5.38 can manipulate the fields parameter of the New Users and New Organisations dashboard widgets to bypass server-side field redaction and retrieve restricted metadata - including user email addresses even when email disclosure is explicitly disabled via Security.disclose_user_emails configuration. The root cause is an order-of-operations flaw: in the original code, the email redaction check was applied after the fallback logic that repopulated the field list, meaning a crafted empty field selection after validation could trigger a return of unredacted model fields. No public exploit has been identified at time of analysis, and SSVC rates exploitation status as none; however, the low attack complexity and absence of user interaction requirements mean any authenticated user can reliably reproduce the condition.
Improper input validation in MISP's over-correlations endpoint allows an authenticated high-privileged attacker to inject arbitrary ordering clauses into database queries via the user-controlled `order` request parameter. All MISP instances running version 2.5.38 and earlier are affected. While direct impact is bounded by query-ordering manipulation, the vulnerability carries SQLi tags and high subsequent system impact scores (SC:H/SI:H/SA:H in CVSS 4.0), suggesting that a successfully crafted ordering expression could escalate to unsafe query construction or unintended data exposure. No public exploit has been identified at time of analysis.
Open redirect in MISP versions up to and including 2.5.38 allows unauthenticated remote attackers to craft links that silently redirect victims to attacker-controlled external URLs immediately after successful authentication. The vulnerability resides in UsersController::routeafterlogin(), where the pre_login_requested_url session value was reflected into a Location header without enforcing local-path constraints. SSVC signals exploitation as 'none' and no CISA KEV listing exists, but the automatable designation and the high-trust context of a threat intelligence platform make this a meaningful phishing amplifier against security teams who would not expect a trusted MISP login to forward them off-site.
Open redirect in MISP's dashboard button widget (versions up to and including 2.5.38) enables an authenticated, high-privileged user who controls dashboard configuration to plant a crafted button URL that appears to point internally but redirects clicking users to an attacker-controlled external site. The root cause is an incomplete URL allowlist in Button.ctp that blocked explicit schemes, hosts, and user components but did not reject paths beginning with /\ - a pattern several browsers normalize into a scheme-relative URL (i.e., //attacker.com). No public exploit exists and CISA SSVC rates exploitation as none; risk is substantially constrained by the PR:H requirement and the need for a victim to interact with the planted button.
Authorization bypass in MISP's Event Template Importer allows authenticated users with template import privileges to overwrite event templates owned by other organizations on the same shared instance, violating inter-organizational data ownership boundaries. Versions up to and including 2.5.38 are affected; the overwrite workflow confirmed template existence but omitted an organizational ownership check, enabling cross-org template corruption. No public exploit code has been identified at time of analysis and SSVC signals no active exploitation, but the integrity impact is operationally significant in multi-tenant MISP deployments where organizational trust boundaries are critical.
Private galaxy metadata in MISP versions up to and including 2.5.38 was exposed to authenticated non-site-admin users through the event template builder workflow due to missing organisation and distribution-based access controls. The EventTemplatesController.php __setBuilderConfig() method queried all enabled galaxies without filtering by ownership or distribution level, allowing users from one organisation to read galaxy names, types, and descriptions that belong to other organisations and are marked private. No public exploit has been identified and SSVC rates exploitation as none; however, in multi-tenant intelligence-sharing environments this information disclosure carries meaningful operational security risk, as galaxy metadata can reveal the intelligence focus areas or classification schemes of peer organisations.
Stored XSS in MISP CTI Transmute's notification bell dropdown allows an attacker who can control convert names to inject arbitrary JavaScript that executes in authenticated users' browsers upon opening the notification panel. The vulnerability, tracked as EUVD-2026-32728 and reported by CIRCL, stems from innerHTML-based rendering of user-controlled notification content in base.html and affects all versions prior to upstream commit cf42409 - critically, only on the development branch, not production releases. No public exploit has been identified at time of analysis; the CVSS 4.0 score of 6.3 with AT:P reflects that exploitation requires the attacker to first influence a convert name surfaced in a notification.
MISP's CSP report endpoint in versions 2.5.0 through 2.5.37 accepts payloads up to 1 MB per report instead of the developer-intended 1 KB limit, due to a 1,024x magnitude error in the truncation guard (`1024 * 1024` instead of `1024`). On deployments where the endpoint is reachable by untrusted clients, unauthenticated remote parties (per CVSS PR:N) can abuse this discrepancy to flood application logs with oversized reports, contributing to disk exhaustion or log integrity degradation. No public exploit code exists and active exploitation has not been confirmed; the CVSS 4.0 score of 5.1 (Low-Medium) reflects the limited, availability-only impact.
Account takeover in MISP's OidcAuth plugin (versions 2.5.0 through 2.5.37) enables an unauthenticated attacker holding a valid OIDC token from an insecure or untrusted IdP to authenticate as any local MISP user whose account has a NULL stored `sub` value. The vulnerability arises because the plugin unconditionally trusted the OIDC email claim to link identities to existing local accounts without verifying email ownership, bypassing authentication controls entirely (CWE-287). No public exploit has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 6.0 reflects adjacent network vector and high complexity conditions that constrain realistic exposure.
Insufficient input validation in MISP's Collections model allows authenticated low-privileged users to inject malformed UUID values into Collection records, potentially causing data integrity issues or unexpected behavior in downstream code paths that assume RFC 4122-compliant UUIDs. Affected deployments are all MISP instances prior to version 2.5.37. No public exploit code exists and CISA's SSVC framework rates exploitation as none, making this a low-urgency integrity issue rather than an active threat, though integrity of Collection relationships and UUID-dependent logic is at risk until patched.
Stored cross-site scripting in MISP before 2.5.37 allows authenticated users with template modification permissions to inject arbitrary JavaScript via unvalidated type and category fields in template element attributes. The vulnerability exploits insufficient input validation in the template element attribute handling logic, enabling attackers to store malicious payloads that execute in the browsers of other users viewing the affected templates. No public exploit code identified at time of analysis.
Stored cross-site scripting in MISP (Malware Information Sharing Platform) versions before 2.5.28 allows authenticated users with workflow privileges to inject arbitrary JavaScript via the workflow execution path view (executionPath.ctp), where doT.js template expressions used unescaped interpolation. Successful exploitation against a user who views the affected page (UI:R) results in scope-changed compromise of the victim's MISP session, including high-confidentiality/integrity/availability impact (CVSS 9.0). Publicly available exploit code exists in researcher-published repositories; no CISA KEV listing at time of analysis.
In app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have a lack of sanitization for non-JSON responses. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In MISP before 2.4.193, menu_custom_right_link_html parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can conduct XSS attacks against every page. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In MISP before 2.4.193, menu_custom_right_link parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can conduct XSS attacks via a global menu link. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in the same org. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in MISP before 2.4.184. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in MISP before 2.4.184. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
app/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 allows XSS in the event timeline widget. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
An issue was discovered in MISP before 2.4.176. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in MISP before 2.4.176. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in MISP before 2.4.176. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in MISP before 2.4.176. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in MISP before 2.4.176. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in MISP 2.4.174. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
MISP 2.4.174 allows XSS in app/View/Events/index.ctp. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
MISP 2.4.172 mishandles different certificate file extensions in server sync. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In MISP 2.4.169, app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.