Skip to content
OpenAdvisories
Medium WID-SEC-2026-3806 4 CVEs

MISP: Mehrere Schwachstellen

Published Oct 7, 2026 · Updated Oct 7, 2026 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um Informationen offenzulegen, um Sicherheitsvorkehrungen zu umgehen, und um Daten zu manipulieren.

Product

MISP ist eine Open-Source-Plattform für den Informationsaustausch über Bedrohungen.

Vulnerabilities 4

  • High 7.1
    CVE-2026-107180

    MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances

    On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the…

    MISP MISP
  • Medium 6.3
    CVE-2026-107276

    MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests

    MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP val…

    MISP MISP
  • Medium 5.3
    CVE-2026-107175

    MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes

    MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified. When a user edits an existing event and changes its distribution or sharing…

    MISP MISP
  • Medium 5.3
    CVE-2026-107278

    MISP Object Sync Drops Objects and Attributes When Description Is Empty

    MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechani…

    MISP MISP

Revision history

  1. #1

    Initiale Fassung

References