Skip to content
OpenAdvisories
High WID-SEC-2026-2035 6 CVEs

MISP: Mehrere Schwachstellen

Published Jun 22, 2026 · Updated Jun 22, 2026 · de-DE

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um beliebigen Code auszuführen, Zugriffskontrollen zu umgehen, Daten zu verändern, vertrauliche Informationen offenzulegen, Benutzersitzungen zu kapern oder einen Denial-of-Service-Zustand zu verursachen.

Product

MISP ist eine Open-Source-Plattform für den Informationsaustausch über Bedrohungen.

Vulnerabilities 6

  • Critical 9.4
    CVE-2026-56422

    MISP Core: Mass Assignment and Object Re-ownership via Unvalidated Request Fields

    Multiple MISP core controllers and model capture paths accepted client-controlled request fields such as primary keys (id) and ownership/scope foreign keys (event_id, org_id, user_id, sharing_group_id, galaxy_cluster_uuid, organisation_uuid, and related neste…

    MISP MISP
  • Critical 9.4
    CVE-2026-56423 Public exploit

    MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints

    MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authorized deletion using broad role-level permissions instead of validating authorization for each selecte…

    MISP MISP
  • Critical 9.3
    CVE-2026-56425

    MISP AAD authentication plugin - Improper OAuth State Handling, Missing Session Rotation, Insecure Redirect URI Validation, and Log Injection

    The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow attackers to bypass important security guarantees provided by the protocol. The application used the PHP session …

    MISP MISP
  • Critical 9.3
    CVE-2026-56447

    MISP remote code execution via arbitrary rdkafka configuration path

    MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path. MISP subsequently parsed the referenced INI file and passed its options to rdkafka. A crafted attacker-controlled configuration file coul…

    MISP MISP
  • High 8.7
    CVE-2026-56446

    Authenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISP

    MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Because log entries can include attacker-controlled content, an authenticated attacker with site administrator privileges could direct lo…

    MISP MISP
  • High 7.1
    CVE-2026-56424

    Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models

    MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where ownership/editability checks were missing on write paths. In affected subsystems, a lower-privileged authenticated user with …

    MISP MISP

Revision history

  1. #1

    Initiale Fassung

References