Skip to content
OpenAdvisories
High WID-SEC-2026-3370 8 CVEs

MISP: Mehrere Schwachstellen

Published Sep 14, 2026 · Updated Sep 14, 2026 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen, beliebigen Code auszuführen und Benutzer auf bösartige URLs umzuleiten.

Product

MISP ist eine Open-Source-Plattform für den Informationsaustausch über Bedrohungen.

Vulnerabilities 8

  • Critical 9.3
    CVE-2026-90961

    MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials

    The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass vulnerability. Both LdapAuthenticate and LinOTPAuthenticate replace CakePHP's FormAuthenticate class but fail to replicate its _checkFields() input validation guard. A…

    MISP MISP
  • High 8.4
    CVE-2026-90895

    MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection

    Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. The patch shows that CLI access could differ from the web application in multiple security…

    MISP MISP
  • High 7.1
    CVE-2026-91825

    MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit

    Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path. The vulnerable logic checked whether the acting user could use a sharing_group_id only when the request explicitly supplied distribution = 4. If the attacker …

    MISP MISP
  • High 7.1
    CVE-2026-91846

    MISP Collection Element Add Missing Authorization on Referenced Object UUID

    Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object. The commit explains that collection elements themselves only store UUIDs, whi…

    MISP MISP
  • Medium 5.3
    CVE-2026-91851

    MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison

    Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag. DashboardsController::listTemplates() allowed a template when either:  - its restrict_to_permission_flag matched one of the current user’s perm…

    MISP MISP
  • Medium 5.1
    CVE-2026-90893

    MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints

    MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF valida…

    MISP MISP
  • Medium 5.1
    CVE-2026-90957

    MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures

    Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through …

    MISP MISP
  • Medium 4.6
    CVE-2026-90955

    MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load

    Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that…

    MISP MISP

Revision history

  1. #1

    Initiale Fassung

References