EUVD-2026-78324

Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path. The vulnerable logic checked whether the acting user could use a sharinggroupid only when the request explicitly supplied distribution = 4. If the attacker instead omitted distribution but supplie...

CVE-2026-91825 MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit

Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path. The vulnerable logic checked whether the acting user could use a sharinggroupid only when the request explicitly supplied distribution = 4. If the attacker instead omitted distribution but supplie...

CVE-2026-91825

MISP versions ≤2.5.45 contain an authorization bypass in the event-edit path. When a request supplied a non-empty sharing_group_id but omitted the distribution field , the authorization check (which only fired for distribution = 4) was skipped. MISP's field-recovery logic then restored the existi...

CVE-2026-91819 MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs...

EUVD-2026-78317

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs...

CVE-2026-91819

MISP (versions ≤2.5.45) is vulnerable in its BetterSecurityComponent due to how it interacts with CakePHP's request-method override processing. When an override value outside the normal write verbs (POST, PUT, PATCH, DELETE) is supplied — for example _method=GET — CakePHP clears the parsed reques...

CVE-2026-91819 MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs...

CVE-2026-91819 MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs...

PT-2026-91893

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs...

CVE-2026-91819: Cross-Site Request Forgery (CSRF)

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs...

CVE-2026-91857: Cross-Site Request Forgery (CSRF)

Affected versions of MISP expose several state-changing controller actions without restricting them to POST. The affected actions are: - EventReportsController::purgeUnusedPictures - NoticelistsController::enableNoticelist - ServersController::removeOrphanedCorrelations -...

CVE-2026-91851: Incorrect Authorization

Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag. DashboardsController::listTemplates allowed a template when either: - its restricttopermissionflag matched one of the current user’s permission flags, or - restricttopermissionflag...

CVE-2026-91859: Insufficient Logging

Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception. Because CakeErrorController extends AppController, exception rendering runs the application startup path a second time. As a result, accessMonitor calls AccessLog::logRequest twice for one...

CVE-2026-92002: Insufficient Logging

Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity. However, User-setupRedis returns false when Redis cannot be reached. The vulnerable shouldLog logic on...

PT-2026-91939

Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity. However, User-setupRedis returns false when Redis cannot be reached. The vulnerable shouldLog logic on...

CVE-2026-91825: Missing Authorization

Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path. The vulnerable logic checked whether the acting user could use a sharinggroupid only when the request explicitly supplied distribution = 4. If the attacker instead omitted distribution but supplie...

CVE-2026-92003: Allocation of Resources Without Limits or Throttling

Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model: - API requests with no authentication key; - requests supplying an API key with an incorrect length Unlike other...

CVE-2026-91846: Missing Authorization

Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object. The commit explains that collection elements themselves only store UUIDs, while the collection view later resolves...

PT-2026-91907

Affected versions of MISP expose several state-changing controller actions without restricting them to POST. The affected actions are: - EventReportsController::purgeUnusedPictures - NoticelistsController::enableNoticelist - ServersController::removeOrphanedCorrelations -...

PT-2026-91908

Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception. Because CakeErrorController extends AppController, exception rendering runs the application startup path a second time. As a result, accessMonitor calls AccessLog::logRequest twice for one...