CVE-2026-56424

🗓️ 22 Jun 2026 12:17:17Reported by CIRCLType

cve🔗 web.nvd.nist.gov👁 54 Views🌐 WEB

MISP core broken access control enables cross-organization unauthorized edits or deletions of analyst data, event reports, collections, templates, and decaying models.

Reporter	Title	Published	Views	Family All 9
attackerkb	CVE-2026-56424	22 Jun 202612:17	–	attackerkb
Cvelist	CVE-2026-56424 Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models	22 Jun 202612:17	–	cvelist
EUVD	EUVD-2026-38227	22 Jun 202612:17	–	euvd
Mend	CVE-2026-56424	22 Jun 202612:17	–	mend
NCSC	Vulnerabilities handled in the MISP platform	29 Jun 202608:08	–	ncsc
NVD	CVE-2026-56424	22 Jun 202614:17	–	nvd
Positive Technologies	PT-2026-51308	22 Jun 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-56424: Authorization Bypass Through User-Controlled Key	22 Jun 202600:00	–	rapid7
Vulnrichment	CVE-2026-56424 Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models	22 Jun 202612:17	–	vulnrichment

NVD

Node

misp-project mispRange<2.5.42

[
  {
    "defaultStatus": "unaffected",
    "product": "misp",
    "repo": "https://github.com/misp/misp",
    "vendor": "misp",
    "versions": [
      {
        "lessThanOrEqual": "2.5.41",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/MISP/MISP/commit/ba2f51fe7440ba2c6043ccde858cac1e25f96931
github	www.github.com/MISP/MISP/commit/744005cefdc3b943bd29669c3b34cc66a5fc2154
github	www.github.com/MISP/MISP/commit/57ad774d21bd1863d060a9e6e73ae54eb96784ce
github	www.github.com/MISP/MISP/commit/3aecc04d5816189412b589cf590c6dbe9a8db5c0
github	www.github.com/MISP/MISP/commit/24d7e91339a3ef043652dd5799c36e5065b2bb4a

Parameter	Position	Path	Description	CWE
report_id	path	/event-reports/tags/detach	Cross-organization tag removal due to authorization check mismatch between the authorized report and the report ID used for tag detachment.	CWE-639, CWE-862, CWE-863
collection_id	query param	/collection-elements/bulk-delete	Bulk deletion of collection elements authorized against a collection ID that matches the element row ID rather than the actual parent collection.	CWE-639, CWE-862, CWE-863
analyst_data	nested	/analyst-data/update	Nested analyst data updates can overwrite records without applying ownership checks, allowing cross-organization overwrites.	CWE-639, CWE-862, CWE-863
template_id	path	/template-elements/edit	Editing template elements authorized against a template ID that matches the element ID rather than the actual parent template.	CWE-639, CWE-862, CWE-863
model_id	path	/decaying-models/edit	Editing and remapping decaying models using view-scope access without verifying edit ownership, allowing modification of models owned by other organizations.	CWE-639, CWE-862, CWE-863

23 Jun 2026 15:16Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.18.8

CVSS 47.1

EPSS0.00523

SSVC

MISP core cross organization unauthorized edits unauthorized deletions analyst data event reports collections templates decaying models