Skip to content
OpenAdvisories
Medium WID-SEC-2026-3218 11 CVEs

MISP: Mehrere Schwachstellen

Published Sep 7, 2026 · Updated Sep 7, 2026 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen oder Cross-Site-Scripting-Angriffe durchzuführen.

Product

MISP ist eine Open-Source-Plattform für den Informationsaustausch über Bedrohungen.

Vulnerabilities 11

  • High 8.7
    CVE-2026-86452

    MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding

    Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting. The users/forgot password-reset endpoint accepted an attacker-controlled email value without first …

    MISP MISP
  • High 7.1
    CVE-2026-86347

    MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion

    Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry for templates/uploadFile used the wildcard *. This bypasses the intended role restrictions applied to neighboring template-management oper…

    MISP MISP
  • High 7.1
    CVE-2026-86408

    MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events

    Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view(). The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such…

    MISP MISP
  • High 7.0
    CVE-2026-86419

    MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery

    Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality. In feed processing, redirects were followed without validating the redirect scheme or destination. The ori…

    MISP MISP
  • Medium 5.3
    CVE-2026-86342

    MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information

    Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlation lookups against attributes from events without applying the requesting user's ACL, allowing restricted event correlat…

    MISP MISP
  • Medium 5.3
    CVE-2026-86417

    MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users

    Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates(). The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated u…

    MISP MISP
  • Medium 5.3
    CVE-2026-86451

    MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects

    Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data() without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerabl…

    MISP MISP
  • Medium 5.1
    CVE-2026-86351

    MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL

    Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origi…

    MISP MISP
  • Medium 5.1
    CVE-2026-86440

    MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs

    Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The widget's URL is stored configuration controlled by a user. The previous renderer considered a URL safe if it appeared relative or if its pars…

    MISP MISP
  • Low 2.3
    CVE-2026-86418

    MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users

    Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields inclu…

    MISP MISP
  • Low 2.3
    CVE-2026-86441

    MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data

    Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hide_organisation_index_from_users. As a result, authenticated user…

    MISP MISP

Revision history

  1. #1

    Initiale Fassung

References