CVE-2026-85533 MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter

An authorization flaw in MISP allowed an authenticated user to submit a sharinggroupid without verifying that the user was authorized to use the referenced Sharing Group. In several attribute and Galaxy Cluster creation and editing workflows, validation of the submitted Sharing Group was performe...

EUVD-2026-70976

An authorization flaw in MISP allowed an authenticated user to submit a sharinggroupid without verifying that the user was authorized to use the referenced Sharing Group. In several attribute and Galaxy Cluster creation and editing workflows, validation of the submitted Sharing Group was performe...

CVE-2026-85239

A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. The EventTemplate::beforeValidate method only performed semantic validation when the supplied definition was...

CVE-2026-85238

MISP contains a session fixation vulnerability in the CustomAuth authentication a custom configuration flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier. As a resul...

CVE-2026-85237

A vulnerability in MISP's email-based one-time password OTP authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The emailotp endpoint did not apply brute-force protection when validating submitted OTP values. An attacker who had reached the OTP...

CVE-2026-85236

A cross-site request forgery CSRF vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. Because bodyless GET requests are not subject to CakePHP's CSRF validation, an attacker could cause ...

EUVD-2026-70533

A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. The EventTemplate::beforeValidate method only performed semantic validation when the supplied definition was...

CVE-2026-85239

MISP is vulnerable to a validation bypass in its event template handling. The EventTemplate::beforeValidate() method only applied semantic validation when the definition was already an array; a caller supplying a pre-encoded string (including malformed JSON ) bypassed validateDefinition() and onl...

CVE-2026-85239 MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service

A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. The EventTemplate::beforeValidate method only performed semantic validation when the supplied definition was...

CVE-2026-85238

MISP contains a session fixation vulnerability in its CustomAuth authentication flow (a custom configuration). The root cause is that __customAuthentication() wrote the authenticated user into the existing CakePHP session without first calling Session->renew(), which had been disabled. An atta...

EUVD-2026-70532

MISP contains a session fixation vulnerability in the CustomAuth authentication a custom configuration flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier. As a resul...

CVE-2026-85238 Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking

MISP contains a session fixation vulnerability in the CustomAuth authentication a custom configuration flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier. As a resul...

CVE-2026-85237

MISP 's email_otp() endpoint lacked brute-force protection when validating OTP values, allowing an attacker who had passed the primary credential check to submit unlimited OTP guesses while the same OTP remained valid. The risk was compounded because OTPs are bound to the user rather than a singl...

EUVD-2026-70528

A vulnerability in MISP's email-based one-time password OTP authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The emailotp endpoint did not apply brute-force protection when validating submitted OTP values. An attacker who had reached the OTP...

CVE-2026-85237 Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass

A vulnerability in MISP's email-based one-time password OTP authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The emailotp endpoint did not apply brute-force protection when validating submitted OTP values. An attacker who had reached the OTP...

CVE-2026-85221

MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null. When passed to cURL, this value effectively disabled TLS peer verification unless the calling code explicitly...

CVE-2026-85226

MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events...

CVE-2026-85227

MISP contains a reflected Cross-Site Scripting XSS vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a...

CVE-2026-85230

A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widg...

CVE-2026-85216

MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. The custom LdapAuthenticate and LinOTPAuthenticate components replace CakePHP's FormAuthenticate implementation but did not replicate...