Skip to content
OpenAdvisories
High WID-SEC-2026-3705 6 CVEs

MISP: Mehrere Schwachstellen

Published Oct 1, 2026 · Updated Oct 1, 2026 · de-DE

Platform: Linux Platform: macOS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um erweiterte Berechtigungen zu erlangen, beliebigen Code auszuführen, Daten offenzulegen und zu manipulieren oder Cross-Site-Scripting-Angriffe durchzuführen.

Product

MISP ist eine Open-Source-Plattform für den Informationsaustausch über Bedrohungen.

Vulnerabilities 6

  • Critical 9.3
    CVE-2026-103655

    MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period

    MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is ver…

    MISP MISP
  • High 7.6
    CVE-2026-103651

    MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass

    MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token counter. The HOTP verification logic compared the submitted token against a counter value that was …

    MISP MISP
  • High 7.1
    CVE-2026-103659

    MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes

    MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In…

    MISP MISP
  • Medium 5.3
    CVE-2026-103858

    MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions

    MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization (or…

    MISP MISP
  • Medium 5.1
    CVE-2026-103662

    MISP Reflected XSS in Taxonomy Tag Confirmation Forms

    MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag). The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML o…

    MISP MISP
  • Medium 4.8
    CVE-2026-103664

    MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter

    MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitizatio…

    MISP MISP

Revision history

  1. #1

    Initiale Fassung

References