CVE-2026-56423

Summary: CVE-2026-56423 affects MISP Core where bulk deletion (Event Reports and Sharing Groups) used broad role permissions instead of per-object authorization checks, enabling instance-wide deletions by eligible users. What was vulnerable: EventReportsController::deleteSelection relied on the g...

CVE-2026-9137

CVE-2026-9137 affects the CSP report endpoint in MISP. The endpoint intended to cap CSP report payloads at 1 KB was incorrectly allowing reports up to 1 MB before truncation, enabling potential log flooding and resource exhaustion on deployments where the endpoint is reachable by untrusted client...

CVE-2020-29006

The CVE-2020-29006 issue affects MISP before 2.4.135, due to missing ACL checks in GalaxyElementsController.php and GalaxyElement.php. The vulnerability enables improper access control, with CVSS v3.1: Network, Privileges NONE, UI NONE, Scope UNCHANGED, Impact HIGH on Confidentiality, Integrity, ...

CVE-2020-15711

Affected software: MISP (Malware Information Sharing Platform) prior to version 2.4.129. Vulnerability: Cross‑Site Request Forgery (CSRF) in the web application that fails to verify requests originate from trusted users when setting a favourite homepage. Root cause: Inadequate CSRF protection in ...

CVE-2026-56425

CVE-2026-56425 affects the AAD authentication plugin for MISP (OAuth 2.0). The vulnerability stems from using session_id() as the OAuth state parameter, lack of session rotation after login, no dedicated nonce for the state, and not enforcing HTTPS for the redirect URI. Additional issue: OAuth er...

CVE-2023-48658

The CVE-2023-48658 entry affects MISP prior to 2.4.176. The vulnerability lies in app/Model/AppModel.php, which lacks a checkParam function for allowed characters (alphanumerics, underscore, dash, period, space). This could allow improper input handling leading to a CRITICAL impact (per CVSS 3.1:...

CVE-2026-8080

CVE-2026-8080 affects MISP core, specifically the old templating engine, where template element attribute type and category values were not validated. This stored XSS vulnerability impacts versions before 2.5.37 and is tied to the old engine later removed in 2.5.38. The CVSS-derived metrics indic...

CVE-2026-44381

MISP (open source threat intelligence platform) prior to version 2.5.37 contains a SQL injection vulnerability in handling of user-controlled ordering parameters on the event and shadow attribute listing endpoints. The affected code accepts order/sort values from request parameters and injects th...

CVE-2023-49926

Summary : CVE-2023-49926 affects MISP prior to 2.4.179, where the event timeline widget is vulnerable to XSS via the file app/Lib/Tools/EventTimelineTool.php. The root cause is insufficient filtering/escaping of user-supplied data in the event timeline tool. Impact (per sources) : Unauthorized ex...

CVE-2026-56424

CVE-2026-56424 affects MISP core and describes multiple broken access-control flaws where authorization checks target the wrong entity or where ownership checks are missing on write paths. In affected subsystems, a lower-privileged authenticated user with relevant feature permissions could cause ...

CVE-2026-10856

CVE-2026-10856 concerns an open redirect in the MISP dashboard button widget due to a URL validation flaw. A crafted relative-looking URL could be accepted as a local path while browsers treat it as an external URL, especially when paths begin with /\ and browsers normalize backslashes to slashes...

CVE-2026-10854

CVE-2026-10854 affects MISP: a visibility control issue in the event template creation workflow allowed non-site-admin users to access private galaxies belonging to other organisations. The event template builder loaded all enabled galaxies without applying organisation or distribution-based acce...

CVE-2026-10864

The vulnerability CVE-2026-10864 affects MISP dashboard widgets (New Users and New Organisations). The issue stems from how field filtering and redaction are applied to the user-selected field list, which could leave the field set empty and cause the underlying query to fall back to returning uni...

CVE-2026-10861

An open redirect vulnerability affects MISP in UsersController::routeafterlogin(), where the pre_login_requested_url session key is used as the post-login redirect destination without enforcing that it is a local path. An unauthenticated attacker can lure a user to a trusted MISP instance and, af...

CVE-2026-10863

CVE-2026-10863 affects the correlations over-correlation endpoint in the application, specifically the overCorrelations() function in app/Controller/CorrelationsController.php. The vulnerability arises from accepting an order parameter from user-controlled named request parameters, which could al...

CVE-2026-10855

CVE-2026-10855 concerns an authorization flaw in the MISP Event Template Importer overwrite workflow. During overwrite, the system checked for a matching template but did not verify that the importing user belonged to the organization that owned the template. This could allow an authenticated use...

CVE-2026-9136

CVE-2026-9136 affects the ShadowAttribute proposal creation workflow in MISP. An add action accepted client-supplied ShadowAttribute data without stripping the id field, allowing an authenticated user to supply the identifier of an existing ShadowAttribute and cause an update instead of creating ...

CVE-2025-67906

CVE-2025-67906 affects MISP prior to 2.5.28, where the app/View/Elements/Workflows/executionPath.ctp component is vulnerable to XSS due to improper handling of user-supplied data in the workflow execution path. This could allow injected scripts to run in a user’s browser. Remediation: upgrade to ...

CVE-2026-10860

In CVE-2026-10860, a logic error in the MISP CRUD component delete handler bypasses validation due to missing parentheses in the delete condition, allowing a DELETE request to proceed even when the delete validation callback rejects the operation. An authenticated attacker with access to an affec...

CVE-2026-44379

Affected software: MISP (Threat Intelligence and Sharing Platform). Prior to version 2.5.37, MISP Collections did not enforce RFC 4122 UUID validation on the uuid field, allowing submission of malformed UUID values. This could lead to integrity issues or unexpected behavior in code paths assuming...

CVE-2026-44380

CVE-2026-44380 (MISP) is an improper access-control flaw in the authentication key reset feature present before version 2.5.37. An authenticated organization administrator could reset auth keys for site administrator accounts within the same organization, since non-site administrators were not ex...

CVE-2026-85216

MISP contains an authentication bypass in its LDAP and LinOTP components. The custom LdapAuthenticate and LinOTPAuthenticate components replaced CakePHP's FormAuthenticate but failed to replicate its credential validation, allowing empty or non-string values to reach underlying mechanisms. In the...

CVE-2026-85221

MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null. When passed to cURL, this value effectively disabled TLS peer verification unless the calling code explicitly enab...

CVE-2026-85226

CVE-2026-85226 affects the OnDemand correlation engine in MISP , a threat intelligence platform. Correlations were computed solely from matching attribute values without applying distribution, sharing-group, or organization-level access controls , allowing an authenticated low-privileged user to ...

CVE-2026-85227

MISP (threat intelligence platform) contains a reflected XSS in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into query-builder rules without HTML escaping before being serialized as JSON and embedded inside a sequenc...

CVE-2026-85230

CVE-2026-85230 is a persistent unsafe URL injection vulnerability in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only at render time, not when saved, allowing an authenticated user to persist arbitrary URLs—including javascript: scheme values—through either...

CVE-2026-86452

MISP versions ≤2.5.45 are affected by a vulnerability in unauthenticated mail endpoints, specifically the forgot password-reset and API-access request paths. The root cause is the absence of input length bounds, format validation, and rate limiting on these anonymous request paths, allowing an at...

CVE-2026-86342

MISP versions ≤ 2.5.45 contain improper authorization checks in the freetext feed preview functionality. Correlation lookups queried attributes from events without applying the requesting user's ACL, exposing restricted event correlations and associated information to users lacking access. The sa...

CVE-2026-86451

MISP versions ≤2.5.45 contain an insecure direct object reference (IDOR) in EventGraphTool::get_reference_data(). Authenticated users could retrieve object-reference records by UUID without the system verifying that the requester had access to the parent object , allowing retrieval of reference d...

CVE-2026-86347

MISP is affected by a missing authorization flaw in the TemplatesController::uploadFile() action. The ACL entry for templates/uploadFile used the wildcard * instead of the intended perm_add role restriction, allowing any authenticated user—including low-privileged or read-only users—to repeatedly...

CVE-2026-86419

MISP versions ≤2.5.45 contain insufficient validation of outbound HTTP destinations in feed retrieval and TAXII discovery . In feed processing, redirects were followed without validating the scheme or destination, causing configured authentication headers and API credentials to be forwarded to di...

CVE-2026-86417

MISP (the open-source threat-intelligence sharing platform) contained an inconsistent email-visibility enforcement in DashboardsController::listTemplates() . The query always fetched User.email , but redaction was applied only in the non-REST (HTML) rendering branch. An authenticated user who saw...

CVE-2026-86418

MISP (≤2.5.45) exposes organisation metadata (ID, UUID, name) through the dashboard organisation picker endpoint without applying the same visibility restrictions enforced by the normal organisation index. When Security.hide_organisation_index_from_users was enabled, normal enumeration was restri...

CVE-2026-86440

MISP 's dashboard Button widget is affected by a stored XSS caused by insufficient URL validation. The prior renderer treated a URL as safe if it appeared relative or matched the configured MISP hostname, but failed to reject dangerous schemes such as javascript: or backslash-based authority form...

CVE-2026-86441

MISP (≤2.5.45) contains inconsistent authorization checks in organisation-related dashboard widgets. Several widgets failed to honor the Security.hide_organisation_index_from_users setting, allowing authenticated users lacking the perm_sharing_group permission to enumerate organisations despite t...

CVE-2026-86351

MISP (versions ≤2.5.45 ) is affected by an authenticated open redirect in the user-configurable homepage feature. The validation only checked whether the supplied value begins with /, which is insufficient because protocol-relative URLs such as //attacker.example also start with / but resolve to ...

CVE-2026-86408

MISP versions ≤2.5.45 are affected by a missing authorization flaw in CryptographicKeysController::view(). The handler queried the CryptographicKey model directly by key ID and exposed sensitive fields (type, key_data, fingerprint) without first verifying the caller's access to the associated par...