Skip to content
OpenAdvisories
High WID-SEC-2026-3689 6 CVEs

MISP: Mehrere Schwachstellen

Published Sep 30, 2026 · Updated Sep 30, 2026 · de-DE

Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um seine Berechtigungen bis auf „Site-Administrator”-Ebene zu erweitern, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen sowie Cross-Site-Scripting-Angriffe durchzuführen.

Product

MISP ist eine Open-Source-Plattform für den Informationsaustausch über Bedrohungen.

Vulnerabilities 6

  • High 8.7
    CVE-2026-103235

    MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events

    MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submi…

    MISP MISP
  • High 8.6
    CVE-2026-103239

    MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection

    MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag…

    MISP MISP
  • High 8.3
    CVE-2026-103237

    MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows

    MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints (attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object ref…

    MISP MISP
  • High 8.3
    CVE-2026-103321

    MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image

    MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img ele…

    MISP MISP
  • Medium 6.2
    CVE-2026-103388

    MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field

    MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local…

    MISP MISP
  • Medium 6.2
    CVE-2026-103389

    MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph

    MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored va…

    MISP MISP

Revision history

  1. #1

    Initiale Fassung

References