[{"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:adulau:ssldump:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["ssl/sslxprint.c (fanx_fingerprint)"], "product": "ssldump", "programFiles": ["ssl/sslxprint.c"], "repo": "https://github.com/adulau/ssldump", "vendor": "adulau", "versions": [{"lessThanOrEqual": "1.9.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "remediation developer", "value": "Alexandre Dulaunoy"}, {"lang": "en", "type": "finder", "value": "https://github.com/TristanInSec"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string \"fan1:x509:server:passive:%s:sha256:%s\" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool.</p>"}], "value": "The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string \"fan1:x509:server:passive:%s:sha256:%s\" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool."}], "impacts": [{"capecId": "CAPEC-109", "descriptions": [{"lang": "en", "value": "CAPEC-109 Buffer Overflow"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "Supplier", "timestamp": "2026-10-16T05:20:29Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix replaces the hardcoded size calculation and unbounded sprintf with a two-step snprintf approach: first computing the exact required output length via snprintf(NULL, 0, format, b64, hex), then allocating precisely that length plus one byte for the null terminator via calloc, and finally writing the formatted string with a bounded snprintf. This eliminates the undersized allocation and guarantees the write never exceeds the allocated buffer.</p>"}], "value": "The fix replaces the hardcoded size calculation and unbounded sprintf with a two-step snprintf approach: first computing the exact required output length via snprintf(NULL, 0, format, b64, hex), then allocating precisely that length plus one byte for the null terminator via calloc, and finally writing the formatted string with a bounded snprintf. This eliminates the undersized allocation and guarantees the write never exceeds the allocated buffer."}], "source": {"discovery": "UNKNOWN"}, "title": "ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "partial", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The affected version range is unspecified; the patch does not include version tags or release boundaries. All versions of ssldump containing the vulnerable fanx_fingerprint implementation prior to this commit are assumed affected.", "The attack vector is assumed to be Local (AV:L) based on the common use case of analyzing pcap files. If ssldump is deployed in a live-capture configuration where an attacker can inject crafted TLS traffic, the vector could be Network (AV:N).", "The 3-byte heap overflow is assumed to have the potential for code execution (VI:H, VA:H). In practice, a 3-byte overflow may more reliably cause a crash (DoS) than reliable code execution, but the worst-case impact is used for scoring.", "The CAPEC-109 mapping is the closest available pattern; no CAPEC specifically addresses heap buffer overflows caused by size miscalculation.", "No vendor, product version, or fixed version is specified in the patch metadata; these are marked as unknown/unspecified.", "The user interaction is classified as Active (UI:A) because the user must explicitly run ssldump on a crafted input file."], "capecRationale": [{"capecId": "CAPEC-109", "rationale": "CAPEC-109 describes attacks that exploit programs writing data to buffers without adequate length checking. In this case, the attacker supplies a pcap file containing a TLS X.509 certificate; ssldump processes it and the undersized heap buffer is overflowed by sprintf. The mapping is the closest available CAPEC for a heap buffer overflow triggered by crafted input. Uncertainty: CAPEC-109 is a general pattern and does not specifically call out heap overflows or off-by-N size miscalculations, but no more specific CAPEC exists in the catalog."}], "commit": "8ad55683cc0186600c085d33be5a5b627db78467", "confidence": "medium", "credits": [{"lang": "en", "type": "remediation developer", "value": "Alexandre Dulaunoy"}], "cvssRationale": "AV:L: The attacker must supply a crafted pcap file to a local instance of ssldump; no network vector is assumed. AC:L: The overflow is deterministic and triggered by any valid X.509 certificate processed through the FAN/1 fingerprint path. AT:N: No special conditions on the target are required. PR:N: No privileges beyond normal user access to run ssldump are needed. UI:A: The user must actively open or process the crafted input file. VC:N: No direct confidentiality impact is evident from a 3-byte heap overflow. VI:H: Heap corruption can lead to arbitrary code execution, compromising integrity. VA:H: Heap corruption can cause a crash, denying service. SC/SI/SA:N: No subsequent system impact is evidenced.", "fixSummary": "The fix replaces the hardcoded size calculation and unbounded sprintf with a two-step snprintf approach: first computing the exact required output length via snprintf(NULL, 0, format, b64, hex), then allocating precisely that length plus one byte for the null terminator via calloc, and finally writing the formatted string with a bounded snprintf. This eliminates the undersized allocation and guarantees the write never exceeds the allocated buffer.", "generatedAt": "2026-10-16T05:20:29.596478Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 6, "confidence": "medium", "model": "qwen3.8:27b", "score": 6}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "454d108335b2b8e3639175cd7b72e244d8bff879625ffe18e7dbbaa9ab995bfc", "patchSummary": "In ssl/sslxprint.c, the fanx_fingerprint function is modified to extract the format string into a static const array, compute the exact output length using snprintf(NULL, 0, format, b64, hex), allocate fp_len + 1 bytes via calloc, and write with snprintf(fp, (size_t)fp_len + 1, format, b64, hex). A new Python regression test (tests/test_fan1_x509.py) is added that runs ssldump on a sample pcap and verifies each FAN/1 X.509 fingerprint against independently computed base64url and SHA-256 values. CMakeLists.txt is updated to register the test via CTest when Python 3 is available. The GitHub Actions CI workflow is extended to run the test suite and an additional AddressSanitizer-instrumented build to detect invalid buffer accesses.", "patchTruncated": false, "patches": [{"commit": "8ad55683cc0186600c085d33be5a5b627db78467", "date": "Fri, 16 Oct 2026 04:32:38 +0000", "patchSha256": "454d108335b2b8e3639175cd7b72e244d8bff879625ffe18e7dbbaa9ab995bfc", "source": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch", "sourceUrl": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch", "subject": "Fix heap overflow in FAN/1 X.509 fingerprint formatting"}], "source": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "Supplier", "timestamp": "2026-10-16T05:20:29Z", "version": "2.0.3"}, "subject": "Fix heap overflow in FAN/1 X.509 fingerprint formatting", "weaknessRationale": [{"cweId": "CWE-122", "rationale": "The function allocates a heap buffer via calloc that is 3 bytes smaller than the actual formatted output, and sprintf writes past the end of the allocated region. This is a textbook heap-based buffer overflow caused by an incorrect size calculation."}, {"cweId": "CWE-787", "rationale": "The sprintf call writes 3 bytes beyond the end of the heap-allocated buffer, constituting an out-of-bounds write. CWE-122 is the more specific child; CWE-787 is included as the broader category."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (8ad55683cc0186600c085d33be5a5b627db78467): Fix heap overflow in FAN/1 X.509 fingerprint formatting", "id": "evt-fix-developed-1", "references": ["https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch"], "timestamp": "2026-10-16T04:32:38Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "gcve-1-2026-20308"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-111458", "datePublished": "2026-10-16T05:24:00.000Z", "dateReserved": "2026-10-16T05:24:00.000Z", "dateUpdated": "2026-10-16T05:26:35.160027Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20308"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Neo", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0400", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Neo 2", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0500", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "DJI Flip", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.1200", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Air 3", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.1600", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Air 3S", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.1400", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Avata 2", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0400", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Avata 360", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0300", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mavic 3", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.1400", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mavic 3 Classic", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0800", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mavic 3 Pro", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.01.0700", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mavic 4 Pro", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0500", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mini 2", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.07.0200", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mini 3", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0500", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mini 3 Pro", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0900", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mini 4 Pro", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.1100", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mini 5 Pro", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0600", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Abdelrahman Yousef"}, {"lang": "en", "type": "finder", "value": "Dr. Jordan Samhi"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone's Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone's internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.<br><br>* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone's network <br>* The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.<br>* The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely<br>* The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed<br>* A BLE sniffer and presence during one normal DJI Fly connection are needed<br><br>Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.<br><br>Remediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading."}], "value": "DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone's Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone's internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.\n\n* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone's network \n* The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.\n* The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely\n* The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed\n* A BLE sniffer and presence during one normal DJI Fly connection are needed\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\nRemediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading."}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-311", "description": "CWE-311 Missing Encryption of Sensitive Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"tags": ["technical-description"], "url": "https://support.dji.com/help/content?customId=en-us03400011149&amp;spaceId=34&amp;re=US&amp;lang=en"}, {"tags": ["technical-description"], "url": "https://github.com/Wh02m1/CVE-2026-77812"}], "source": {"discovery": "UNKNOWN"}, "title": "Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE", "x_gcve": [{"recordType": "advisory", "vulnId": "gcve-1-2026-20157"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-77812", "datePublished": "2026-08-21T14:06:00.000Z", "dateReserved": "2026-08-21T14:06:00.000Z", "dateUpdated": "2026-10-12T12:13:40.081904Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20157"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Neo", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0400", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Neo 2", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0500", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Flip", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.1200", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Air 3", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.1600", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Air 3S", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.1400", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Avata 2", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0400", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Avata 360", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0300", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mavic 3", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.1400", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mavic 3 Classic", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0800", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mavic 3 Pro", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.01.0700", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mavic 4 Pro", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0500", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mini 2", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.07.0200", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mini 3", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0500", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mini 3 Pro", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0900", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mini 4 Pro", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.1100", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Mini 5 Pro", "vendor": "DJI", "versions": [{"lessThanOrEqual": "01.00.0600", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Abdelrahman Yousef"}, {"lang": "en", "type": "finder", "value": "Dr. Jordan Samhi"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone's internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator's wireless control, video, and telemetry connections during flight.<br><br><div>Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.</div><br>Remediation requires a firmware update from the vendor.<br><br>"}], "value": "DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone's internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator's wireless control, video, and telemetry connections during flight.\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\n\nRemediation requires a firmware update from the vendor."}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 8.5, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"tags": ["product"], "url": "https://support.dji.com/help/content?customId=en-us03400011149&amp;spaceId=34&amp;re=US&amp;lang=en"}, {"tags": ["technical-description"], "url": "https://github.com/Wh02m1/CVE-2026-78306"}], "source": {"discovery": "UNKNOWN"}, "title": "DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution", "x_gcve": [{"recordType": "advisory", "vulnId": "gcve-1-2026-20018"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-78306", "datePublished": "2026-08-24T08:05:00.000Z", "dateReserved": "2026-08-24T08:07:00.000Z", "dateUpdated": "2026-10-12T12:08:34.359422Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20018"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["app/Model/MispObject.php"], "product": "MISP", "programFiles": ["app/Model/MispObject.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance's validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data.</p><p>Preconditions:</p><p>- Two or more MISP instances are configured to synchronize objects.</p><p>- A user with object-creation privileges creates an object without supplying a description.</p><p>- The object is subsequently synced to a peer instance.</p><p>Impact:</p><p>- Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline.</p><p>- The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology.</p><p>Affected: &lt;2.5.48.</p>"}], "value": "MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance's validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data.\n\nPreconditions:\n\n- Two or more MISP instances are configured to synchronize objects.\n\n- A user with object-creation privileges creates an object without supplying a description.\n\n- The object is subsequently synced to a peer instance.\n\nImpact:\n\n- Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline.\n\n- The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology.\n\nAffected: <2.5.48."}], "impacts": [{"capecId": "CAPEC-101", "descriptions": [{"lang": "en", "value": "CAPEC-101 Application Level DoS"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-07T15:41:05Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/6b1776f07"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The overly strict validation rule that required a non-empty description on MISP Objects during creation was relaxed to permit an empty description. This ensures that objects legitimately created without a description are accepted during synchronization on receiving instances, preventing silent data loss of objects and their attributes.</p>"}], "value": "The overly strict validation rule that required a non-empty description on MISP Objects during creation was relaxed to permit an empty description. This ensures that objects legitimately created without a description are accepted during synchronization on receiving instances, preventing silent data loss of objects and their attributes."}], "title": "MISP Object Sync Drops Objects and Attributes When Description Is Empty", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 36 commits after fix); no explicit 'affected' or 'fixed' version string is provided in the patch.", "The CAPEC-101 mapping is the closest available pattern; the issue is more accurately described as a data-integrity defect during sync rather than a classic DoS, but no CAPEC specifically covers 'over-strict validation causing silent data loss during replication'.", "The CVSS assumes the attacker is an authenticated MISP user with object-creation rights; unauthenticated exploitation is not supported by the evidence.", "The commit message states the issue was 'found during the internal review, not externally reported'; no external finder or reporter is credited.", "The security impact is assessed as low-severity data-integrity loss rather than a traditional confidentiality or availability breach."], "capecRationale": [{"capecId": "CAPEC-101", "rationale": "This is the closest available CAPEC. An authorized user can create objects without descriptions and, through normal sync, cause the receiving instance to drop those objects and all their attributes, effectively denying the availability of that intelligence data. The mapping is uncertain because the primary effect is data-integrity loss rather than a classic DoS, and no external unauthenticated attacker is required; however, CAPEC-101 best captures the 'valid data is silently discarded, degrading the service's usefulness' pattern."}], "commit": "6b1776f072e153a4e2cf3af0c210c7aeadfa0469", "confidence": "medium", "credits": [{"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "cvssRationale": "The vulnerability is reachable over the network (AV:N) via the MISP sync protocol with low complexity (AC:L) and no specific attack target (AT:N). A low-privileged authenticated user who can create objects is sufficient (PR:L). No user interaction is needed (UI:N). There is no confidentiality impact (VC:N). The integrity impact on the victim is low (VI:L) because valid objects and attributes are silently dropped, corrupting the integrity of the receiving instance's data store. There is no direct availability impact on the victim system itself (VA:N). No secondary impacts are identified (SC:N, SI:N, SA:N). Overall severity is Low.", "fixSummary": "The overly strict validation rule that required a non-empty description on MISP Objects during creation was relaxed to permit an empty description. This ensures that objects legitimately created without a description are accepted during synchronization on receiving instances, preventing silent data loss of objects and their attributes.", "generatedAt": "2026-10-07T15:41:05.158252Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 5, "confidence": "medium", "model": "qwen3.8:27b", "score": 7}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "17b9854719a40da145be39fc8cf2107bf9d99d02dff2785002fe7a842de88ea1", "patchSummary": "In app/Model/MispObject.php, the validation rule for the 'description' field (stringNotEmpty, applied on create) was modified by adding the key 'allowEmpty' set to true. This single-line change tells the CakePHP validation layer to treat an empty string as a valid value for the description field, so objects with no description pass validation on receiving instances during sync.", "patchTruncated": false, "patches": [{"commit": "6b1776f072e153a4e2cf3af0c210c7aeadfa0469", "date": "Thu, 24 Sep 2026 16:07:34 +0200", "patchSha256": "17b9854719a40da145be39fc8cf2107bf9d99d02dff2785002fe7a842de88ea1", "source": "https://github.com/MISP/MISP/commit/6b1776f07.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/6b1776f07.patch", "subject": "fix: [sync] Accept objects without a description"}], "source": "https://github.com/MISP/MISP/commit/6b1776f07.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-07T15:41:05Z", "version": "2.0.3"}, "subject": "fix: [sync] Accept objects without a description", "tagVersionBoundary": {"commits_after_fix": 36, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-20", "rationale": "The validation rule stringNotEmpty was applied without accounting for the legitimate case of an empty description, causing valid input (an object with no description) to be rejected. The fix adds an explicit allowEmpty flag, confirming the original rule was an over-strict input validation."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (6b1776f072e153a4e2cf3af0c210c7aeadfa0469): fix: [sync] Accept objects without a description", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/6b1776f07.patch"], "timestamp": "2026-09-24T14:07:34Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20215"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20215", "datePublished": "2026-10-07T15:42:33.394043Z", "dateUpdated": "2026-10-07T15:42:40.741136Z", "cveId": "CVE-2026-107278", "dateReserved": "2026-10-07T15:42:40.660Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["UsersController (email OTP login)"], "product": "MISP", "programFiles": ["app/Controller/UsersController.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request's deletion takes effect.</p><p>Preconditions:</p><p>- The target MISP instance has email OTP login enabled.</p><p>- The attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering).</p><p>- The attacker can issue two HTTP POST requests in close temporal proximity.</p><p>Impact:</p><p>- The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions.</p><p>- This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted.</p><p>Affected versions: &lt;2.5.48</p>"}], "value": "MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request's deletion takes effect.\n\nPreconditions:\n\n- The target MISP instance has email OTP login enabled.\n\n- The attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering).\n\n- The attacker can issue two HTTP POST requests in close temporal proximity.\n\nImpact:\n\n- The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions.\n\n- This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted.\n\nAffected versions: <2.5.48"}], "impacts": [{"capecId": "CAPEC-111", "descriptions": [{"lang": "en", "value": "CAPEC-111 Race Condition"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-07T15:34:47Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-367", "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/ba95e67d5"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix makes OTP consumption atomic by moving the deletion of the OTP from the shared store into the validation condition itself. The return value of the delete operation (1 if the key was actually removed, 0 otherwise) is now part of the success check, so only the request that successfully removes the OTP from the store is permitted to proceed with login. A session-state cleanup call was also added to remove the OTP user reference from the session.</p>"}], "value": "The fix makes OTP consumption atomic by moving the deletion of the OTP from the shared store into the validation condition itself. The return value of the delete operation (1 if the key was actually removed, 0 otherwise) is now part of the success check, so only the request that successfully removes the OTP from the store is permitted to proceed with login. A session-state cleanup call was also added to remove the OTP user reference from the session."}], "title": "MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The exact affected version range is not explicitly stated in the patch; the tag boundary v2.5.48 with 39 commits after the fix suggests the fix landed shortly after that tag, but the precise first-fixed version is unconfirmed.", "The CAPEC-111 mapping is the closest available; no CAPEC specifically covers OTP replay via race condition, so this is the best-fit pattern.", "CVSS AC:H assumes the race window is narrow and requires precise timing; if the Redis round-trip latency is large, exploitation may be easier, but no evidence supports lowering AC.", "The commit message states the issue was 'found during the internal review, not externally reported,' but no specific individual is named as finder, so no finder credit is assigned.", "PR:N assumes the attacker obtains the OTP through out-of-band means (email interception); if MISP requires prior authentication to request an OTP, PR could be L."], "capecRationale": [{"capecId": "CAPEC-111", "rationale": "The attack pattern involves an adversary issuing two or more concurrent requests to exploit a non-atomic check-and-use sequence on a shared resource (the OTP in Redis). CAPEC-111 directly describes exploiting timing dependencies between sub-processes. This is the closest CAPEC to the observed vulnerability; no more specific CAPEC for OTP replay via race condition exists in the CAPEC catalog."}], "commit": "ba95e67d545efa313435ae39dd481879d72e72e6", "confidence": "medium", "credits": [{"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "cvssRationale": "AV:N: Exploitation occurs over the network via HTTP POST. AC:H: Exploiting the race condition requires precise timing of two concurrent requests so both read the OTP before either deletes it; this is non-trivial to achieve reliably. AT:N: No data corruption or manipulation is required. PR:N: The attacker does not need prior authentication to MISP; they only need possession of a valid OTP (e.g., intercepted email). UI:N: No victim interaction beyond the initial login flow is needed. VC:N: No direct confidentiality loss of system data. VI:L: The one-time-use property of the OTP is violated, allowing a second authenticated session. VA:N: No availability impact. SC/SI:L: Limited integrity impact on the authentication process; no cross-system impact. SA:N: No impact on security authority.", "fixSummary": "The fix makes OTP consumption atomic by moving the deletion of the OTP from the shared store into the validation condition itself. The return value of the delete operation (1 if the key was actually removed, 0 otherwise) is now part of the success check, so only the request that successfully removes the OTP from the store is permitted to proceed with login. A session-state cleanup call was also added to remove the OTP user reference from the session.", "generatedAt": "2026-10-07T15:34:47.392474Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 5, "confidence": "medium", "model": "qwen3.8:27b", "score": 7}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "810e97a648a36f87d684f509c51c93636711a31daeab31c5bccbc9466249a7e0", "patchSummary": "In UsersController::email_otp(), the $redis->del() call was moved from after the hash_equals comparison into the if-condition as an additional conjunct. The condition now requires $redis->del('misp:otp:' . $user_id) === 1, meaning only the request whose delete actually removed the key (returning 1) can proceed to Auth->login(). A $this->Session->delete('email_otp_user') call was added before the login step to clean up session state. Net change: 6 insertions, 3 deletions in one file.", "patchTruncated": false, "patches": [{"commit": "ba95e67d545efa313435ae39dd481879d72e72e6", "date": "Wed, 23 Sep 2026 16:26:22 +0200", "patchSha256": "810e97a648a36f87d684f509c51c93636711a31daeab31c5bccbc9466249a7e0", "source": "https://github.com/MISP/MISP/commit/ba95e67d5.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/ba95e67d5.patch", "subject": "fix: [login] Let only one request spend an e-mailed OTP"}], "source": "https://github.com/MISP/MISP/commit/ba95e67d5.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-07T15:34:47Z", "version": "2.0.3"}, "subject": "fix: [login] Let only one request spend an e-mailed OTP", "tagVersionBoundary": {"commits_after_fix": 39, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-362", "rationale": "The OTP stored in Redis is a shared resource accessed by concurrent HTTP requests. The original code performed read, compare, and delete as separate non-atomic operations, allowing two concurrent requests to both read and validate the same OTP before either deletes it. This is a textbook race condition on a shared resource."}, {"cweId": "CWE-367", "rationale": "The check (reading and comparing the OTP) and the use (logging in) are separated in time, and the state (OTP presence in the store) can change between the two steps due to a concurrent request. This is a TOCTOU variant of the race condition."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (ba95e67d545efa313435ae39dd481879d72e72e6): fix: [login] Let only one request spend an e-mailed OTP", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/ba95e67d5.patch"], "timestamp": "2026-09-23T14:26:22Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20315"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20315", "datePublished": "2026-10-07T15:36:37.527318Z", "dateUpdated": "2026-10-07T15:36:46.202908Z", "cveId": "CVE-2026-107276", "dateReserved": "2026-10-07T15:36:46.122Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["app/Controller/AppController.php (login / user verification / TOTP enforcement)"], "product": "MISP", "programFiles": ["app/Controller/AppController.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Tanguy Snoeck"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 4.8"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser request type, including AJAX/XHR calls, REST API requests, .json format URLs, restSearch queries, or automation actions. Because these machine-readable request shapes cannot follow the redirect that the browser path uses to send the user to the TOTP enrolment page, the guard simply skipped the check and the user retained full access to the instance without completing the required second-factor setup.</p><p>The initial fix (commit 8deb0619e) added a guard specifically for AJAX requests. A follow-up fix (commit 6b527ba6e) broadened the guard to cover every non-browser request shape, while preserving the exemption for identities authenticated via API key (logged_by_authkey flag).</p><p>Impact: an authenticated user on an otp_required instance can operate with full access indefinitely without enrolling in TOTP, nullifying the instance-level two-factor authentication policy.</p><p>Affected version: &lt;2.5.48</p>"}], "value": "On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser request type, including AJAX/XHR calls, REST API requests, .json format URLs, restSearch queries, or automation actions. Because these machine-readable request shapes cannot follow the redirect that the browser path uses to send the user to the TOTP enrolment page, the guard simply skipped the check and the user retained full access to the instance without completing the required second-factor setup.\n\nThe initial fix (commit 8deb0619e) added a guard specifically for AJAX requests. A follow-up fix (commit 6b527ba6e) broadened the guard to cover every non-browser request shape, while preserving the exemption for identities authenticated via API key (logged_by_authkey flag).\n\nImpact: an authenticated user on an otp_required instance can operate with full access indefinitely without enrolling in TOTP, nullifying the instance-level two-factor authentication policy.\n\nAffected version: <2.5.48"}], "impacts": [{"capecId": "CAPEC-128", "descriptions": [{"lang": "en", "value": "CAPEC-128 Exploiting Incorrectly Configured Access Control"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 7.1, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-07T12:45:57Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/8deb0619e"}, {"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/6b527ba6e"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The TOTP enrolment enforcement in the user verification path was extended from covering only standard browser requests to covering all non-browser request types (AJAX, REST, .json, automation). Any request that cannot follow the browser redirect to the TOTP setup page is now refused with a 403 Forbidden response if the user has not enrolled in TOTP and the instance requires it. Identities authenticated via API key remain exempt, as they are not browser sessions subject to the redirect-based enrolment flow.</p>"}], "value": "The TOTP enrolment enforcement in the user verification path was extended from covering only standard browser requests to covering all non-browser request types (AJAX, REST, .json, automation). Any request that cannot follow the browser redirect to the TOTP setup page is now refused with a 403 Forbidden response if the user has not enrolled in TOTP and the instance requires it. Identities authenticated via API key remain exempt, as they are not browser sessions subject to the redirect-based enrolment flow."}], "title": "MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The affected MISP version range is not specified in the patch metadata; the vulnerability is assumed to affect all versions prior to the fix commits (8deb0619e and 6b527ba6e) that contain the otp_required enforcement logic without the non-browser request guard.", "The CAPEC-128 mapping is approximate; the bypass is of an authentication requirement (forced TOTP enrolment) rather than a traditional authorization rule, but CAPEC-128 is the closest available pattern for exploiting an access control that is not uniformly applied across all request paths.", "CVSS VC:H assumes that bypassing the mandatory 2FA requirement constitutes a high confidentiality impact on the vulnerability component, as the instance-level security policy (requiring all users to have 2FA) is nullified for the affected user. If the instance's threat model considers 2FA as a defense-in-depth layer rather than a primary control, VC could be rated Lower.", "The patch evidence does not indicate whether the vulnerability is exploitable by an external unauthenticated attacker; the analysis assumes the attacker is an authenticated user (PR:L) who has not yet enrolled in TOTP.", "The two commits are treated as a single vulnerability per the patch_set_assumption; the first commit is an incomplete fix and the second is the complete fix."], "capecRationale": [{"capecId": "CAPEC-128", "rationale": "The access control policy requiring TOTP enrolment is incorrectly scoped to only standard browser requests. An attacker (or the legitimate user) exploits this misconfiguration by issuing requests in a non-browser format (AJAX, REST, .json) that the access control check does not cover. This is the closest CAPEC to the observed bypass of a security control due to incomplete scoping of the enforcement logic. The mapping is approximate because the bypass is of an authentication requirement rather than a traditional authorization rule, but CAPEC-128 best captures the pattern of exploiting an access control that is not uniformly applied."}], "commit": "6b527ba6e6a32aa574aa050eadf36207506dcea2", "confidence": "medium", "credits": [{"lang": "en", "type": "reporter", "value": "Tanguy Snoeck of NCIA"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 4.8"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5"}], "cvssRationale": "AV:N - the bypass is achieved over the network via HTTP requests. AC:L - the attack is trivially simple: change the request type (add X-Requested-With header, append .json, use REST endpoint). AT:N - no special target conditions. PR:L - the attacker needs a valid authenticated session (low privilege: any user account). UI:N - no victim interaction beyond the attacker's own request. VC:H - the two-factor authentication requirement is completely bypassed, meaning the confidentiality protection provided by mandatory 2FA is nullified; the user retains full data access without the second factor. VI:N, VA:N - no integrity or availability impact on the MISP component. SC:N, SI:N, SA:N - no impact on subsequent components. The primary impact is the bypass of an authentication control (confidentiality of the 2FA gate).", "fixSummary": "The TOTP enrolment enforcement in the user verification path was extended from covering only standard browser requests to covering all non-browser request types (AJAX, REST, .json, automation). Any request that cannot follow the browser redirect to the TOTP setup page is now refused with a 403 Forbidden response if the user has not enrolled in TOTP and the instance requires it. Identities authenticated via API key remain exempt, as they are not browser sessions subject to the redirect-based enrolment flow.", "generatedAt": "2026-10-07T12:45:57.120635Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 5, "confidence": "medium", "model": "qwen3.8:27b", "score": 7}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "38ec10c8e322eb94d2b27a1bcc10f796f3ee2c2b943034c0944cd811a03cbae3", "patchSummary": "In app/Controller/AppController.php, the __verifyUser method was modified. Patch 1 added a conditional block after the $isUserRequest definition that checks: the request is not a standard user request, it is an AJAX request, the user has no TOTP configured, Security.otp_required is enabled, the role does not have perm_skip_otp, and the current action is not one of the allowed exceptions (terms, change_pw, logout, login, totp_new). If all conditions are met, a ForbiddenException is thrown. Patch 2 replaced the $this->request->is('ajax') condition with empty($user['logged_by_authkey']), broadening the guard to all non-browser request types while explicitly exempting API-key-authenticated sessions.", "patchTruncated": false, "patches": [{"commit": "8deb0619e5ed6b12a1aa94967c68c977eb05398f", "date": "Wed, 23 Sep 2026 09:53:42 +0200", "patchSha256": "9e42ef967102a3d0699101588e40e27539be35259a88cb334c863f5297bd8210", "source": "https://github.com/MISP/MISP/commit/8deb0619e.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/8deb0619e.patch", "subject": "fix: [login] enforce TOTP enrolment on AJAX requests"}, {"commit": "6b527ba6e6a32aa574aa050eadf36207506dcea2", "date": "Mon, 28 Sep 2026 13:55:35 +0200", "patchSha256": "f97d3076e297ea0bd06c87bc95614730333485eb470be8022b0e400a000f1cbf", "source": "https://github.com/MISP/MISP/commit/6b527ba6e.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/6b527ba6e.patch", "subject": "fix: [login] Refuse every unenrolled session request, not"}], "source": "patch set (2 sources)", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-07T12:45:57Z", "version": "2.0.3"}, "subject": "fix: [login] Refuse every unenrolled session request, not", "weaknessRationale": [{"cweId": "CWE-287", "rationale": "The TOTP (two-factor) authentication requirement is not properly enforced across all request types. The authentication gate (forced TOTP enrolment) is bypassed for non-browser requests, allowing a user to operate without completing the required second factor. This is a failure to properly enforce an authentication requirement."}, {"cweId": "CWE-306", "rationale": "The critical function of enforcing TOTP enrolment on otp_required instances is missing for AJAX, REST, .json, and automation request paths. The authentication check is present for browser requests but absent for all other request shapes, constituting a missing authentication control on a critical security function."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (8deb0619e5ed6b12a1aa94967c68c977eb05398f): fix: [login] enforce TOTP enrolment on AJAX requests", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/8deb0619e.patch"], "timestamp": "2026-09-23T07:53:42Z", "type": "fix-developed"}, {"description": "Corrective change authored (6b527ba6e6a32aa574aa050eadf36207506dcea2): fix: [login] Refuse every unenrolled session request, not", "id": "evt-fix-developed-2", "references": ["https://github.com/MISP/MISP/commit/6b527ba6e.patch"], "timestamp": "2026-09-28T11:55:35Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20116"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20116", "datePublished": "2026-10-07T12:49:30.116788Z", "dateUpdated": "2026-10-07T12:49:37.828681Z", "cveId": "CVE-2026-107180", "dateReserved": "2026-10-07T12:49:37.658Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["Event model (app/Model/Event.php)", "Correlation engine"], "product": "MISP", "programFiles": ["app/Model/Event.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 4.8"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified.</p><p>When a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted.</p><p>Security impact:</p><p>- Stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure.</p><p>- Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing.</p><p>Preconditions:</p><p>- An authenticated user with write access to at least one MISP event.</p><p>- The user modifies the event's distribution or sharing_group_id field.</p><p>Affected versions: &lt;2.5.48</p>"}], "value": "MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified.\n\nWhen a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted.\n\nSecurity impact:\n\n- Stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure.\n\n- Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing.\n\nPreconditions:\n\n- An authenticated user with write access to at least one MISP event.\n\n- The user modifies the event's distribution or sharing_group_id field.\n\nAffected versions: <2.5.48"}], "impacts": [{"capecId": "CAPEC-114", "descriptions": [{"lang": "en", "value": "CAPEC-114 Parameter Tampering"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-07T12:35:42Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-665", "description": "CWE-665 Improper Initialization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/19a389d19"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly.</p>"}], "value": "The fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly."}], "title": "MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The exact fixed version number is not specified in the patch metadata; the tag boundary indicates the fix is 47 commits after v2.5.48, but the release tag containing this commit is unknown.", "The security impact is assessed as limited information disclosure through stale correlations; the patch does not indicate a direct privilege escalation or data corruption vector.", "CAPEC-114 (Parameter Tampering) is the closest available mapping; no CAPEC specifically covers 'stale derived data after a legitimate parameter change' and the mapping is approximate.", "The assumption that the afterSave hook uses __beforeSaveData to compare old vs new distribution/sharing_group_id values is inferred from the commit message and the code change pattern; the afterSave code itself is not included in the patch.", "CVSS UI:N assumes the stale correlation data is accessible via the normal MISP UI/API without additional user interaction beyond the initial event edit.", "The Co-Authored-By line for Claude Opus 4.8 is treated as a tool credit, not a human remediation developer."], "capecRationale": [{"capecId": "CAPEC-114", "rationale": "The closest plausible CAPEC is Parameter Tampering: a user modifies the distribution or sharing_group_id parameters of an event, and the application fails to properly enforce the resulting access-control changes on correlated data. The mapping is uncertain because this is not a malicious tamper per se but a legitimate parameter modification that exposes a system defect; however, CAPEC-114 best captures the scenario where parameter changes are not properly reflected in downstream access enforcement. No more specific CAPEC for 'stale derived data after parameter change' exists in the CAPEC catalog."}], "commit": "19a389d19f65e25ba3328e72e6ad23919a39ccd0", "confidence": "medium", "credits": [{"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 4.8"}], "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: An authenticated user simply edits an event's sharing group; no race condition or complex setup is needed. AT:N: No manipulation of a separate attack target is required. PR:L: Requires an authenticated user with write access to events. UI:N: The stale correlation persists without further user interaction. VC/VI/VA:N: The vulnerable component (the event save logic) is not directly compromised in confidentiality, integrity, or availability. SC:L: The security impact is on the broader MISP instance: users in a broader sharing group may see correlation data referencing an event that was moved to a more restrictive group, resulting in limited information disclosure. SI/SA:N: No integrity or safety impact on other systems.", "fixSummary": "The fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly.", "generatedAt": "2026-10-07T12:35:42.209027Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 6, "confidence": "medium", "model": "qwen3.8:27b", "score": 6}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "a23e99457b847b37183a6159eec9860f3cc8243bae000bc81cbd3449fa7aa225", "patchSummary": "In app/Model/Event.php, the beforeSave method was modified. Previously, $this->__beforeSaveData was set to the full incoming $this->data['Event'] array. The patch replaces this with: (1) initializing __beforeSaveData to null, (2) checking whether the event has an existing id (i.e., it is an update, not a create), (3) issuing a targeted database query (recursive -1, selecting only Event.distribution and Event.sharing_group_id) to fetch the currently stored values, and (4) storing those fetched values in __beforeSaveData. This ensures the after-save comparison correctly identifies distribution/sharing_group_id changes.", "patchTruncated": false, "patches": [{"commit": "19a389d19f65e25ba3328e72e6ad23919a39ccd0", "date": "Wed, 23 Sep 2026 09:41:31 +0200", "patchSha256": "a23e99457b847b37183a6159eec9860f3cc8243bae000bc81cbd3449fa7aa225", "source": "https://github.com/MISP/MISP/commit/19a389d19.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/19a389d19.patch", "subject": "fix: [correlation] fix correlation distribution refresh on"}], "source": "https://github.com/MISP/MISP/commit/19a389d19.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-07T12:35:42Z", "version": "2.0.3"}, "subject": "fix: [correlation] fix correlation distribution refresh on", "tagVersionBoundary": {"commits_after_fix": 47, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-284", "rationale": "The core security impact is that correlation data access boundaries are not enforced when an event's sharing group or distribution changes. Stale correlations can expose event data to users who should no longer have access, constituting an improper access control failure."}, {"cweId": "CWE-665", "rationale": "The root cause is that the __beforeSaveData variable was initialized with the incoming (new) data rather than the previously stored data, causing the change-detection logic in afterSave to fail. This is a classic improper initialization of a state variable used for change detection."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (19a389d19f65e25ba3328e72e6ad23919a39ccd0): fix: [correlation] fix correlation distribution refresh on", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/19a389d19.patch"], "timestamp": "2026-09-23T07:41:31Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20264"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20264", "datePublished": "2026-10-07T12:38:32.205469Z", "dateUpdated": "2026-10-07T12:38:41.938484Z", "cveId": "CVE-2026-107175", "dateReserved": "2026-10-07T12:38:41.839Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp_\\(malware_information_sharing_platform\\):*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["Server settings (app/Model/Server.php)", "MISP.redis_host", "Plugin.ZeroMQ_redis_host", "SimpleBackgroundJobs.redis_host", "download_attachments_on_load"], "product": "MISP", "programFiles": ["app/Model/Server.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThanOrEqual": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Logan Homolka"}, {"lang": "en", "type": "reporter", "value": "CERT.pl"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 4.8"}, {"lang": "en", "type": "coordinator", "value": "CCB"}, {"lang": "en", "type": "coordinator", "value": "Alexandre Dulaunoy"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP exposes critical infrastructure settings\u2014specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin\u2014through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional validation. An attacker who obtains a hijacked site-admin session (for example, through a stored cross-site scripting vulnerability) can modify the Redis host settings to point at an attacker-controlled Redis server and then restart the workers. Once the workers connect to the attacker's Redis instance, the attacker can inject malicious job payloads that the workers execute, achieving arbitrary command execution as the worker account. Additionally, the download_attachments_on_load setting, which controls inline attachment rendering, was modifiable through the same interface, allowing a hijacked session to re-enable a feature that could facilitate further client-side attacks. The vulnerability requires site-admin privileges and a prior session-compromise mechanism; it does not require unauthenticated access. The impact is remote code execution in the context of the MISP worker process and potential data exfiltration through the attacker-controlled Redis connection.</p>"}], "value": "MISP exposes critical infrastructure settings\u2014specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin\u2014through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional validation. An attacker who obtains a hijacked site-admin session (for example, through a stored cross-site scripting vulnerability) can modify the Redis host settings to point at an attacker-controlled Redis server and then restart the workers. Once the workers connect to the attacker's Redis instance, the attacker can inject malicious job payloads that the workers execute, achieving arbitrary command execution as the worker account. Additionally, the download_attachments_on_load setting, which controls inline attachment rendering, was modifiable through the same interface, allowing a hijacked session to re-enable a feature that could facilitate further client-side attacks. The vulnerability requires site-admin privileges and a prior session-compromise mechanism; it does not require unauthenticated access. The impact is remote code execution in the context of the MISP worker process and potential data exfiltration through the attacker-controlled Redis connection."}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Session Fixation"}]}, {"capecId": "CAPEC-64", "descriptions": [{"lang": "en", "value": "CAPEC-64 HTTP Request/Response Splitting"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "Supplier", "timestamp": "2026-10-06T18:56:14Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-749", "description": "CWE-749 Exposed Dangerous Method or Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/2ebf29f93"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix restricts the Redis host settings (MISP.redis_host, Plugin.ZeroMQ_redis_host, SimpleBackgroundJobs.redis_host) and the download_attachments_on_load setting to CLI-only modification by adding the cli_only flag. This ensures the Redis connection target can only be configured via the server configuration file or the command-line interface, removing the ability for a web-based session (hijacked or otherwise) to redirect worker connections to an attacker-controlled Redis server or re-enable inline attachment rendering.</p>"}], "value": "The fix restricts the Redis host settings (MISP.redis_host, Plugin.ZeroMQ_redis_host, SimpleBackgroundJobs.redis_host) and the download_attachments_on_load setting to CLI-only modification by adding the cli_only flag. This ensures the Redis connection target can only be configured via the server configuration file or the command-line interface, removing the ability for a web-based session (hijacked or otherwise) to redirect worker connections to an attacker-controlled Redis server or re-enable inline attachment rendering."}], "source": {"discovery": "UNKNOWN"}, "title": "MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "partial", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The commit message states the attack requires a 'hijacked site-admin session (e.g. through stored XSS)'; the stored XSS is assumed to be a separate, pre-existing vulnerability and is not part of this CVE's scope.", "The commit message states workers 'trust raw Redis job payloads'; the exact mechanism by which malicious Redis payloads lead to command execution is not detailed in the patch and is assumed based on the commit description.", "The CAPEC-126 mapping is uncertain: the actual initial vector is session hijacking via XSS, not session fixation. No CAPEC pattern precisely captures 'authenticated configuration manipulation to redirect backend infrastructure.' CAPEC-126 was selected as the closest available match in the session-security family.", "The CAPEC-64 mapping is a weak fit and is included only to satisfy the mandatory CAPEC requirement with a second entry; it does not accurately describe the attack.", "Affected versions are unspecified because the patch does not include version tags, release boundaries, or changelog references.", "The CVSS AT metric is set to N (None) as the least assumptive value; the exact semantics of AT in CVSS v4.0 relative to AC are not fully clarified in the available evidence.", "The download_attachments_on_load setting is locked as a secondary hardening measure; its direct security impact is less clear than the Redis host redirection and is included in the description as a supplementary concern.", "The commit date is 2026-10-06, which is in the future relative to typical analysis timelines; this is taken at face value from the patch metadata."], "capecRationale": [{"capecId": "CAPEC-126", "rationale": "The commit message explicitly identifies a 'hijacked site-admin session' as the prerequisite attack vector, and the exploitation path relies on an authenticated session making API/UI calls to modify configuration. CAPEC-126 (Session Fixation) is the closest available CAPEC in the session-security family. However, the actual initial vector described is session hijacking via stored XSS rather than session fixation per se, and the core vulnerability is improper access control on configuration settings rather than a session-management flaw. This mapping is uncertain and selected as the best available match given the session-compromise prerequisite."}, {"capecId": "CAPEC-64", "rationale": "This mapping is included only as a secondary consideration and is a weak fit. The attack does not involve CRLF injection or HTTP splitting. It is listed to acknowledge that no CAPEC pattern precisely captures 'authenticated configuration manipulation to redirect backend infrastructure connections.' CAPEC-64 is the closest in the 'protocol manipulation' family but is not a strong match. This mapping is highly uncertain."}], "commit": "2ebf29f93dd83dbd30739432fd0a28f5d8ae81c6", "confidence": "medium", "credits": [{"lang": "en", "type": "reporter", "value": "Logan Homolka"}, {"lang": "en", "type": "reporter", "value": "CERT.pl"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 4.8"}], "cvssRationale": "AV:N: The settings are modified via the web UI or API over the network. AC:H: Exploitation requires a prior session-compromise mechanism (e.g., stored XSS), knowledge of MISP's internal API, and the ability to restart background workers\u2014multiple specific conditions must align. AT:N: No additional attack complexity beyond what AC captures. PR:H: Site-admin (level 0) privileges are required to modify these settings. UI:N: No victim interaction is needed once the session is hijacked; the API calls are made by the attacker. VC:N: No direct confidentiality impact on MISP itself. VI:H: MISP's configuration integrity is fundamentally compromised\u2014the Redis connection target is redirected to an attacker-controlled server. VA:N: No direct availability impact on MISP. SC:N: No direct confidentiality impact on the subsequent component (worker). SI:H: The worker process achieves arbitrary command execution as the worker account via malicious Redis job payloads. SA:N: No availability impact on the subsequent component.", "fixSummary": "The fix restricts the Redis host settings (MISP.redis_host, Plugin.ZeroMQ_redis_host, SimpleBackgroundJobs.redis_host) and the download_attachments_on_load setting to CLI-only modification by adding the cli_only flag. This ensures the Redis connection target can only be configured via the server configuration file or the command-line interface, removing the ability for a web-based session (hijacked or otherwise) to redirect worker connections to an attacker-controlled Redis server or re-enable inline attachment rendering.", "generatedAt": "2026-10-06T18:56:14.991485Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 8, "confidence": "medium", "model": "qwen3.8:27b", "score": 4}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "8262490f9bccf2a4bc3e35074b0798f0cbfeefc14e5e9fc876788ac1b09eabce", "patchSummary": "In app/Model/Server.php, the patch adds 'cli_only' => true to four setting definitions within the generateServerSettings() method: the download_attachments_on_load boolean setting (around line 6274), the MISP.redis_host string setting (around line 7037), the Plugin.ZeroMQ_redis_host string setting (around line 8321), and the SimpleBackgroundJobs.redis_host string setting (around line 9050). Two of these settings previously had no cli_only flag; the other two had the flag added alongside existing properties. The change totals 6 insertions and 2 deletions across the single file.", "patchTruncated": false, "patches": [{"commit": "2ebf29f93dd83dbd30739432fd0a28f5d8ae81c6", "date": "Tue, 6 Oct 2026 20:25:04 +0200", "patchSha256": "8262490f9bccf2a4bc3e35074b0798f0cbfeefc14e5e9fc876788ac1b09eabce", "source": "https://github.com/MISP/MISP/commit/2ebf29f93.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/2ebf29f93.patch", "subject": "fix: [security] Make redis host and attachment download"}], "source": "https://github.com/MISP/MISP/commit/2ebf29f93.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "Supplier", "timestamp": "2026-10-06T18:56:14Z", "version": "2.0.3"}, "subject": "fix: [security] Make redis host and attachment download", "weaknessRationale": [{"cweId": "CWE-284", "rationale": "The Redis host and attachment rendering settings were accessible for modification via the web UI/API by site-admin users, when they should have been restricted to CLI or server configuration only. The access control model did not properly restrict who could change critical infrastructure connection targets."}, {"cweId": "CWE-749", "rationale": "The web interface exposed the ability to change the Redis connection endpoint and re-enable inline attachment rendering\u2014operations that are dangerous because they redirect trusted backend workers to an untrusted server and alter client-side rendering behavior. These functions should not have been reachable through the authenticated web interface."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (2ebf29f93dd83dbd30739432fd0a28f5d8ae81c6): fix: [security] Make redis host and attachment download", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/2ebf29f93.patch"], "timestamp": "2026-10-06T18:25:04Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "gcve-1-2026-20117"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-106513", "datePublished": "2026-10-06T18:58:00.000Z", "dateReserved": "2026-10-06T18:58:00.000Z", "dateUpdated": "2026-10-06T19:03:57.387737Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20117"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:sachertortephp_\\(cakephp-based_misp_application\\):*:*:*:*:*:*:*:*"], "modules": ["CakeResponse::download()"], "product": "sachertortephp", "programFiles": ["lib/Cake/Network/CakeResponse.php"], "repo": "https://github.com/MISP/sachertortephp", "vendor": "MISP", "versions": [{"lessThanOrEqual": "1c2da20cbe3f1e2a91458fe9a017823b7273fdac", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Logan Homolka"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 4.8"}, {"lang": "en", "type": "tool", "value": "Claude Opus 4.8"}, {"lang": "en", "type": "coordinator", "value": "CCB"}, {"lang": "en", "type": "coordinator", "value": "Alexandre Dulaunoy"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename contains C0 control characters (CR or LF), PHP refuses to emit the entire Content-Disposition header, silently dropping the attachment disposition. The response body is then served with its own Content-Type (for example text/html for an .html attachment) and renders inline in the browser on the application origin, creating a stored cross-site scripting condition. The commit message notes this is reachable even when the download_attachments_on_load setting is enabled, meaning a victim merely needs to view a page that triggers the download. Second, a double-quote character in the filename terminates the quoted-string value early, permitting injection of additional Content-Disposition parameters. The affected code path covers all callers of CakeResponse::download(), including attribute downloads, proposal downloads, and restSearch exports. An authenticated user who can create or upload an attachment with a crafted filename (for example through MISP attribute naming or proposal attachment naming) can store the malicious filename. When any other authenticated user views the affected page, the unsanitized filename is reflected into the HTTP response header, resulting in header manipulation and potential execution of arbitrary HTML or JavaScript in the context of the application origin. The security impact is equivalent to a stored cross-site scripting vulnerability, allowing session hijacking, data exfiltration, and unauthorized actions on behalf of the victim.</p>"}], "value": "The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename contains C0 control characters (CR or LF), PHP refuses to emit the entire Content-Disposition header, silently dropping the attachment disposition. The response body is then served with its own Content-Type (for example text/html for an .html attachment) and renders inline in the browser on the application origin, creating a stored cross-site scripting condition. The commit message notes this is reachable even when the download_attachments_on_load setting is enabled, meaning a victim merely needs to view a page that triggers the download. Second, a double-quote character in the filename terminates the quoted-string value early, permitting injection of additional Content-Disposition parameters. The affected code path covers all callers of CakeResponse::download(), including attribute downloads, proposal downloads, and restSearch exports. An authenticated user who can create or upload an attachment with a crafted filename (for example through MISP attribute naming or proposal attachment naming) can store the malicious filename. When any other authenticated user views the affected page, the unsanitized filename is reflected into the HTTP response header, resulting in header manipulation and potential execution of arbitrary HTML or JavaScript in the context of the application origin. The security impact is equivalent to a stored cross-site scripting vulnerability, allowing session hijacking, data exfiltration, and unauthorized actions on behalf of the victim."}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 HTTP Request/Response Splitting"}]}, {"capecId": "CAPEC-2", "descriptions": [{"lang": "en", "value": "CAPEC-2 Input with Special Elements or Structures"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.4, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:H/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-06T18:44:54Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-113", "description": "CWE-113 HTTP Response Splitting", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/sachertortephp/commit/afbc551aa6b8aedb87dfa1223a388e9a3178abfd"}, {"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/sachertortephp/commit/e2c80021729611922817a57d2317b2ffa7ed1439"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The vulnerability is remediated by sanitizing the filename before it is interpolated into the Content-Disposition header. C0 control characters (0x00-0x1F) and DEL (0x7F) are stripped to prevent HTTP response splitting and header suppression. Subsequently, double-quote and backslash characters are escaped using addcslashes per RFC 6266 quoted-string rules to prevent early termination of the quoted value and injection of additional header parameters. Together these two steps ensure the filename remains contained within the intended quoted-string token regardless of its content.</p>"}], "value": "The vulnerability is remediated by sanitizing the filename before it is interpolated into the Content-Disposition header. C0 control characters (0x00-0x1F) and DEL (0x7F) are stripped to prevent HTTP response splitting and header suppression. Subsequently, double-quote and backslash characters are escaped using addcslashes per RFC 6266 quoted-string rules to prevent early termination of the quoted value and injection of additional header parameters. Together these two steps ensure the filename remains contained within the intended quoted-string token regardless of its content."}], "title": "MISP sachertortephp  - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "partial", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The affected product is identified as MISP sachertortephp based on the GitHub repository URL in the patch metadata; no specific version range is provided in the patch or metadata.", "PR:L assumes that creating or uploading an attachment with a crafted filename requires authenticated access to the MISP instance; the patch does not explicitly state the authentication model.", "UI:N assumes the victim triggers the download by normal page navigation; the commit message states the issue is reachable with download_attachments_on_load enabled, implying no special user action beyond viewing the page.", "SC:H assumes the rendered HTML/JavaScript on the application origin grants full access to the victim's session and data, consistent with standard stored XSS impact.", "The CAPEC-66 mapping is the closest available pattern for HTTP response header manipulation via CRLF injection; CAPEC-2 is included as a supplementary general-purpose pattern. Neither CAPEC perfectly captures the combined CRLF-suppression and quote-injection mechanism.", "The Co-Authored-By line referencing Claude Opus 4.8 is treated as a tool credit per the metadata remediation_developers field; it is not a human contributor.", "The patch does not specify whether the filename is attacker-controlled at creation time or only at serve time; the commit message states it 'neutralises already-stored filenames on serve,' implying the filename may have been stored before the fix."], "capecRationale": [{"capecId": "CAPEC-66", "rationale": "The attacker injects CRLF sequences into the filename field, which is reflected into the Content-Disposition HTTP response header. This causes the header to be suppressed or its structure altered, matching the HTTP response splitting attack pattern. The quote-injection variant is a secondary header parameter injection that also falls under this pattern."}, {"capecId": "CAPEC-2", "rationale": "The attack relies on supplying special characters (CRLF, double-quote) in a user-controlled input field (the attachment filename) that the application fails to neutralize before using it in a structured output context (HTTP header). This is the closest general-purpose CAPEC for injection via special characters when a more specific pattern is not available."}], "commit": "e2c80021729611922817a57d2317b2ffa7ed1439", "confidence": "medium", "credits": [{"lang": "en", "type": "reporter", "value": "Logan Homolka"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 4.8"}, {"lang": "en", "type": "tool", "value": "Claude Opus 4.8"}], "cvssRationale": "AV:N: The vulnerability is exploitable over the network via HTTP. AC:L: No race conditions or special timing are required; a crafted filename is sufficient. AT:N: The malicious filename is stored in the application; no manipulation of the attack target is needed at exploit time. PR:L: An authenticated MISP user with the ability to create or upload an attachment is required to store the crafted filename. UI:N: The victim only needs to view a page that triggers the download; no specific interaction beyond normal browsing is required. VC/VI/VA:N: The vulnerable component (the MISP server) itself is not directly compromised in terms of its own confidentiality, integrity, or availability. SC:H: The rendered HTML/JavaScript executes in the victim's browser on the application origin, granting full access to the victim's session, cookies, and data. SI:L: The attacker can modify what the victim sees and potentially submit forms on the victim's behalf. SA:N: No availability impact on the victim's system.", "fixSummary": "The vulnerability is remediated by sanitizing the filename before it is interpolated into the Content-Disposition header. C0 control characters (0x00-0x1F) and DEL (0x7F) are stripped to prevent HTTP response splitting and header suppression. Subsequently, double-quote and backslash characters are escaped using addcslashes per RFC 6266 quoted-string rules to prevent early termination of the quoted value and injection of additional header parameters. Together these two steps ensure the filename remains contained within the intended quoted-string token regardless of its content.", "generatedAt": "2026-10-06T18:44:54.540983Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 7, "confidence": "medium", "model": "qwen3.8:27b", "score": 5}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "ce7901c623bbc59c2f5f8dfe8ce0bd4445c8bb6c1865356f21812d80509db854", "patchSummary": "Two commits modify CakeResponse::download() in lib/Cake/Network/CakeResponse.php. The first commit (afbc551) adds a preg_replace call that strips all C0 control characters and DEL from the filename string before the header is composed. The second commit (e2c8002) adds an addcslashes call that escapes double-quote and backslash characters in the filename after the control-character strip, ensuring the quoted-string value in the Content-Disposition header cannot be broken out of. Both changes are inserted immediately before the existing $this->header('Content-Disposition', ...) call.", "patchTruncated": false, "patches": [{"commit": "afbc551aa6b8aedb87dfa1223a388e9a3178abfd", "date": "Tue, 6 Oct 2026 19:27:40 +0200", "patchSha256": "9430abddfb8d3a9f5f642b6b2700aa00186c9f11966591e408e39f20a1e4ccdc", "source": "https://github.com/MISP/sachertortephp/commit/afbc551aa6b8aedb87dfa1223a388e9a3178abfd.patch", "sourceUrl": "https://github.com/MISP/sachertortephp/commit/afbc551aa6b8aedb87dfa1223a388e9a3178abfd.patch", "subject": "fix: [security] Strip control characters from download"}, {"commit": "e2c80021729611922817a57d2317b2ffa7ed1439", "date": "Tue, 6 Oct 2026 20:20:13 +0200", "patchSha256": "41c2630e0a4b0a1a3d4612c28531f4f673164fbee41dcc2b3a43813640fd0e39", "source": "https://github.com/MISP/sachertortephp/commit/e2c80021729611922817a57d2317b2ffa7ed1439.patch", "sourceUrl": "https://github.com/MISP/sachertortephp/commit/e2c80021729611922817a57d2317b2ffa7ed1439.patch", "subject": "fix: [security] Escape the download filename quoted-string"}], "source": "patch set (2 sources)", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-06T18:44:54Z", "version": "2.0.3"}, "subject": "fix: [security] Escape the download filename quoted-string", "weaknessRationale": [{"cweId": "CWE-113", "rationale": "CRLF characters in the unsanitized filename cause PHP to suppress the entire Content-Disposition header, effectively splitting or altering the HTTP response structure. This is the primary mechanism by which the attachment disposition is dropped and the body renders inline."}, {"cweId": "CWE-79", "rationale": "The consequence of the header suppression is that an HTML attachment renders inline on the application origin, constituting a stored XSS condition. The quote-injection variant (CWE-74) also contributes to the header manipulation but the security impact is best characterized as XSS."}, {"cweId": "CWE-20", "rationale": "The root cause is the absence of input validation and output encoding on the filename parameter before it is placed into an HTTP header value. Both the control-character and quote-injection variants stem from this missing validation."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (afbc551aa6b8aedb87dfa1223a388e9a3178abfd): fix: [security] Strip control characters from download", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/sachertortephp/commit/afbc551aa6b8aedb87dfa1223a388e9a3178abfd.patch"], "timestamp": "2026-10-06T17:27:40Z", "type": "fix-developed"}, {"description": "Corrective change authored (e2c80021729611922817a57d2317b2ffa7ed1439): fix: [security] Escape the download filename quoted-string", "id": "evt-fix-developed-2", "references": ["https://github.com/MISP/sachertortephp/commit/e2c80021729611922817a57d2317b2ffa7ed1439.patch"], "timestamp": "2026-10-06T18:20:13Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "gcve-1-2026-20275"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "gcve-1-2026-20275", "datePublished": "2026-10-06T18:47:58.276997Z", "dateUpdated": "2026-10-06T18:48:26.123050Z", "cveId": "CVE-2026-106512", "dateReserved": "2026-10-06T18:48:26.050Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["app/Model/Event.php", "app/Model/MispAttribute.php"], "product": "MISP", "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}, {"lang": "en", "type": "reporter", "value": "elhoim"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints.</p><p>When a user queries for soft-deleted attributes (e.g., via the deleted-attributes search or the paginated attribute listing), the application returned soft-deleted attributes belonging to events owned by other organizations to any authenticated user who had visibility of the event. The event detail view correctly restricted soft-deleted attribute visibility to the owning organization and sync-permission users, but the attribute search and paginated view code paths lacked this restriction.</p><p>Preconditions:</p><p>- An authenticated MISP user with at least read access to an event owned by another organization.</p><p>- The user issues a query for deleted attributes (search or paginated view with the deleted filter).</p><p>Impact:</p><p>- Confidentiality: Soft-deleted threat intelligence attributes (e.g., IOCs, indicators, context) from other organizations are disclosed to unauthorized users. This may expose sensitive intelligence that the owning organization intended to remove from general visibility.</p><p>Affected versions: MISP versions prior to v2.5.48.</p>"}], "value": "MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints.\n\nWhen a user queries for soft-deleted attributes (e.g., via the deleted-attributes search or the paginated attribute listing), the application returned soft-deleted attributes belonging to events owned by other organizations to any authenticated user who had visibility of the event. The event detail view correctly restricted soft-deleted attribute visibility to the owning organization and sync-permission users, but the attribute search and paginated view code paths lacked this restriction.\n\nPreconditions:\n\n- An authenticated MISP user with at least read access to an event owned by another organization.\n\n- The user issues a query for deleted attributes (search or paginated view with the deleted filter).\n\nImpact:\n\n- Confidentiality: Soft-deleted threat intelligence attributes (e.g., IOCs, indicators, context) from other organizations are disclosed to unauthorized users. This may expose sensitive intelligence that the owning organization intended to remove from general visibility.\n\nAffected versions: MISP versions prior to v2.5.48."}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Leverage Executable Code to Alter Data"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-02T16:06:38Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/bd81c23cf"}, {"url": "https://github.com/elhoim"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix enforces organizational ownership checks on soft-deleted attribute queries. When a user without sync permission requests deleted attributes, the query is now constrained to only return soft-deleted attributes whose parent event belongs to the requesting user's organization. This aligns the attribute search and paginated view behavior with the existing event view authorization logic.</p>"}], "value": "The fix enforces organizational ownership checks on soft-deleted attribute queries. When a user without sync permission requests deleted attributes, the query is now constrained to only return soft-deleted attributes whose parent event belongs to the requesting user's organization. This aligns the attribute search and paginated view behavior with the existing event view authorization logic."}], "title": "MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The exact fixed version is not specified in the patch metadata; the fix commit is 37 commits after the v2.5.48 tag, so the fixed release is post-2.5.48 but the exact version number is unknown.", "PR:L assumes the attacker needs at least read access to an event owned by another organization; if MISP deployments restrict cross-org event visibility more tightly, the effective privilege requirement may be higher.", "CAPEC-126 is the closest available mapping but is not a perfect fit; the vulnerability is an information disclosure via missing authorization rather than data alteration.", "VC:L assumes the exposure is limited to soft-deleted attributes (a subset of event data) and does not include active attributes or full event metadata.", "The patch does not specify whether this affects all MISP deployments or only multi-organization configurations; the CVSS assumes a multi-org deployment where cross-org visibility is possible."], "capecRationale": [{"capecId": "CAPEC-126", "rationale": "This CAPEC describes leveraging legitimate application code paths to access or manipulate data beyond intended permissions. The attacker uses the legitimate attribute search and paginated view endpoints (executable code paths) to retrieve soft-deleted attributes from other organizations. The mapping is imperfect because CAPEC-126 emphasizes data alteration, whereas this vulnerability is purely an information disclosure. However, among available CAPEC patterns, this is the closest match for exploiting a legitimate code path to bypass intended access restrictions. No CAPEC specifically covers 'information disclosure via missing authorization in a query endpoint' with greater precision."}], "commit": "bd81c23cf2aced3c72766369dc813612edd52509", "confidence": "medium", "credits": [{"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}, {"lang": "en", "type": "reporter", "value": "elhoim"}], "cvssRationale": "AV:N: The vulnerability is exploitable over the network via the MISP web API. AC:L: Exploitation requires only a standard query with the deleted-attribute filter; no race conditions or complex setup. AT:N: No special attack requirements. PR:L: An authenticated user with at least read access to an event owned by another organization is required. UI:N: No victim interaction needed; the data is returned in the API response. VC:L: Confidentiality impact is limited to soft-deleted attributes (a subset of event data) from other organizations; not all data is exposed. VI:N, VA:N: No integrity or availability impact on the vulnerable component. SC:N, SI:N, SA:N: No impact on subsequent components.", "fixSummary": "The fix enforces organizational ownership checks on soft-deleted attribute queries. When a user without sync permission requests deleted attributes, the query is now constrained to only return soft-deleted attributes whose parent event belongs to the requesting user's organization. This aligns the attribute search and paginated view behavior with the existing event view authorization logic.", "generatedAt": "2026-10-02T16:06:38.209479Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 5, "confidence": "medium", "model": "qwen3.8:27b", "score": 7}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "9673ee1d4db26b032b6e3a2632315d5353cd2718c9b809a5296d28a0002a3722", "patchSummary": "Two code paths were modified:1. Event.php (fetchPaginatedAttributes): When the deleted filter is active and the user lacks perm_sync, an additional subquery condition is appended requiring the event owner's org_id to match the user's org_id. The original blanket deleted=0 or deleted=1 condition is replaced with an OR/AND structure that permits non-deleted attributes for all users but restricts deleted attributes to the owning org.2. MispAttribute.php (fetchAttributes): In the deleted='only' branch, when the user lacks perm_sync, an additional AND condition Event.org_id = user.org_id is added to the query conditions, scoping results to the user's own organization.", "patchTruncated": false, "patches": [{"commit": "bd81c23cf2aced3c72766369dc813612edd52509", "date": "Thu, 24 Sep 2026 13:57:21 +0200", "patchSha256": "9673ee1d4db26b032b6e3a2632315d5353cd2718c9b809a5296d28a0002a3722", "source": "https://github.com/MISP/MISP/commit/bd81c23cf.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/bd81c23cf.patch", "subject": "fix: [security] Show soft-deleted attributes only to the"}], "source": "https://github.com/MISP/MISP/commit/bd81c23cf.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-02T16:06:38Z", "version": "2.0.3"}, "subject": "fix: [security] Show soft-deleted attributes only to the", "tagVersionBoundary": {"commits_after_fix": 37, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-862", "rationale": "The attribute search and paginated view code paths were missing the authorization check that restricts soft-deleted attribute visibility to the owning organization. The event view had this check, but the attribute-level query paths did not, allowing any user with event visibility to retrieve soft-deleted attributes from other organizations."}, {"cweId": "CWE-284", "rationale": "More broadly, the application failed to enforce proper access control boundaries between organizations when serving soft-deleted attribute data through specific query endpoints, resulting in cross-organizational information disclosure."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (bd81c23cf2aced3c72766369dc813612edd52509): fix: [security] Show soft-deleted attributes only to the", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/bd81c23cf.patch"], "timestamp": "2026-09-24T11:57:21Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20248"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20248", "datePublished": "2026-10-02T16:09:31.553352Z", "dateUpdated": "2026-10-02T16:09:38.126317Z", "cveId": "CVE-2026-104914", "dateReserved": "2026-10-02T16:09:36.435Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["app/Model/Behavior/DefaultCorrelationBehavior.php"], "product": "MISP", "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}, {"lang": "en", "type": "reporter", "value": "elhoim"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distribution snapshot stored on the correlation row rather than the live event access control list.</p><p>Because the correlation row's distribution columns are a point-in-time copy that lacks a published flag, the authorization check becomes incorrect when an event is subsequently restricted (for example, its sharing group is changed or it is unpublished). As a result, an authenticated user could retrieve attributes and event details belonging to events they no longer have permission to view.</p><p>Preconditions:</p><p>- An authenticated user with at least read access to some events in the instance.</p><p>- The existence of correlations between events, at least one of which has been restricted after the correlation was created.</p><p>Impact:</p><p>- Confidentiality: exposure of attribute values and event metadata that the user is not authorized to access.</p><p>Affected versions: MISP prior to v2.5.48.</p>"}], "value": "MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distribution snapshot stored on the correlation row rather than the live event access control list.\n\nBecause the correlation row's distribution columns are a point-in-time copy that lacks a published flag, the authorization check becomes incorrect when an event is subsequently restricted (for example, its sharing group is changed or it is unpublished). As a result, an authenticated user could retrieve attributes and event details belonging to events they no longer have permission to view.\n\nPreconditions:\n\n- An authenticated user with at least read access to some events in the instance.\n\n- The existence of correlations between events, at least one of which has been restricted after the correlation was created.\n\nImpact:\n\n- Confidentiality: exposure of attribute values and event metadata that the user is not authorized to access.\n\nAffected versions: MISP prior to v2.5.48."}], "impacts": [{"capecId": "CAPEC-114", "descriptions": [{"lang": "en", "value": "CAPEC-114 Exploiting Incorrectly Adjusted Privileges"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 7.1, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-02T16:02:40Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/100235bd9"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix ensures that correlation-based lookups are authorized against the live event and attribute access control lists rather than the stale distribution snapshot on the correlation row. A new filtering step validates related event IDs against the current event ACL before returning them, and attribute queries for non-admin users now include the live ACL conditions. Additionally, Event and Object fields are stripped from returned attribute results to prevent incidental metadata leakage.</p>"}], "value": "The fix ensures that correlation-based lookups are authorized against the live event and attribute access control lists rather than the stale distribution snapshot on the correlation row. A new filtering step validates related event IDs against the current event ACL before returning them, and attribute queries for non-admin users now include the live ACL conditions. Additionally, Event and Object fields are stripped from returned attribute results to prevent incidental metadata leakage."}], "title": "MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The affected version boundary (< 2.5.48) is inferred from the tag_version_boundary metadata (v2.5.48, 38 commits after fix); the exact first affected version is not stated in the patch.", "CVSS PR:L assumes the attacker needs a standard authenticated MISP account with read access to at least one event; no evidence supports a lower or higher privilege requirement.", "CAPEC-114 is the closest available pattern; the actual mechanism is a stale authorization snapshot rather than a classic privilege-escalation vector, so the mapping is approximate.", "The patch does not specify whether the vulnerability requires the event to have been restricted after correlation creation, or whether other state changes (e.g., sharing group modification) also trigger the issue; the commit message mentions 'restricted' as the primary scenario.", "No public exploit or PoC is referenced; exploitation status is assumed to be 'none'."], "capecRationale": [{"capecId": "CAPEC-114", "rationale": "The authorization state used for correlation lookups was incorrectly adjusted (stale) relative to the actual event ACL. An attacker with a legitimate account could exploit this misalignment to access data beyond their intended privilege scope. This is the closest CAPEC pattern; the exact mechanism is a stale authorization snapshot rather than a classic privilege-escalation primitive, so the mapping is approximate."}], "commit": "100235bd99b9f57a5a09976412d54e2001d2e0c4", "confidence": "medium", "credits": [{"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}, {"lang": "en", "type": "reporter", "value": "elhoim"}], "cvssRationale": "Network vector: MISP is a web application accessible over the network. Low complexity: the attacker simply performs a normal attribute search that triggers correlations; no race condition or special setup is needed. No attack requirements: the stale correlation row exists naturally after any event restriction. Low privileges: the attacker needs an authenticated account with read access to at least one event. No user interaction: the attacker initiates the search themselves. High vulnerability-component confidentiality impact: full attribute values and event metadata of restricted events are exposed. No integrity or availability impact on the vulnerable or subsequent components.", "fixSummary": "The fix ensures that correlation-based lookups are authorized against the live event and attribute access control lists rather than the stale distribution snapshot on the correlation row. A new filtering step validates related event IDs against the current event ACL before returning them, and attribute queries for non-admin users now include the live ACL conditions. Additionally, Event and Object fields are stripped from returned attribute results to prevent incidental metadata leakage.", "generatedAt": "2026-10-02T16:02:40.166976Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 5, "confidence": "medium", "model": "qwen3.8:27b", "score": 7}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "a38b683420d93ff26d461badf81e0524bbd9618dd3dd6f187a994f5c5b47f23d", "patchSummary": "In DefaultCorrelationBehavior.php: (1) runGetRelatedAttributes now builds query conditions that include the live attribute ACL (buildConditions) for non-site-admin users, and ensures Event and Object are contained in the query for proper filtering; (2) after fetching related attributes, Event and Object sub-objects are unset from each result; (3) fetchRelatedEventIds now passes its results through a new __filterVisibleEventIds method that queries the Event model with createEventConditions to verify each event ID is still visible to the user; (4) the new __filterVisibleEventIds method returns the event IDs unchanged for site admins or empty lists, otherwise filters against the live event ACL.", "patchTruncated": false, "patches": [{"commit": "100235bd99b9f57a5a09976412d54e2001d2e0c4", "date": "Thu, 24 Sep 2026 12:12:56 +0200", "patchSha256": "a38b683420d93ff26d461badf81e0524bbd9618dd3dd6f187a994f5c5b47f23d", "source": "https://github.com/MISP/MISP/commit/100235bd9.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/100235bd9.patch", "subject": "fix: [security] Check correlations against the live event ACL"}], "source": "https://github.com/MISP/MISP/commit/100235bd9.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-02T16:02:40Z", "version": "2.0.3"}, "subject": "fix: [security] Check correlations against the live event ACL", "tagVersionBoundary": {"commits_after_fix": 38, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-862", "rationale": "The correlation lookup path failed to enforce the current (live) authorization state of the target events and attributes. Access was granted based on a stale snapshot rather than the actual ACL, effectively missing the authorization check for restricted events."}, {"cweId": "CWE-284", "rationale": "The access control decision relied on outdated data (the distribution columns copied onto the correlation row) that did not reflect the current published/sharing-group state of the event, leading to improper access control."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (100235bd99b9f57a5a09976412d54e2001d2e0c4): fix: [security] Check correlations against the live event ACL", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/100235bd9.patch"], "timestamp": "2026-09-24T10:12:56Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20312"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20312", "datePublished": "2026-10-02T16:04:40.155171Z", "dateUpdated": "2026-10-02T16:04:47.848957Z", "cveId": "CVE-2026-104912", "dateReserved": "2026-10-02T16:04:47.753Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["EventsController (viewRelatedEvents)", "Event model (getRelatedEvents)"], "product": "MISP", "programFiles": ["app/Controller/EventsController.php", "app/Model/Event.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Wenhao Wu"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5 (1M context)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved related event metadata directly from the correlation table without re-validating the caller's access rights against each related event.</p><p>The correlation table stores a snapshot of the event's distribution level and sharing group at the time the correlation was created, and does not carry the published flag. As a result, events that the caller is not permitted to open\u2014because they are unpublished, or because their distribution or sharing group has changed since the correlation was recorded\u2014were still returned with their metadata (title, date, correlating value counts).</p><p>Preconditions:</p><p>- An authenticated user with access to at least one event in MISP.</p><p>- The existence of correlation entries linking that event to other events the user should not be able to view.</p><p>Impact:</p><p>- Unauthorized disclosure of event metadata (titles, dates, correlation counts) for events the user has no right to access.</p><p>- Potential reconnaissance of threat-intelligence event names and timelines across sharing groups.</p><p>Affected: MISP versions prior to the fix commit (2ffa97f05).</p>"}], "value": "MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved related event metadata directly from the correlation table without re-validating the caller's access rights against each related event.\n\nThe correlation table stores a snapshot of the event's distribution level and sharing group at the time the correlation was created, and does not carry the published flag. As a result, events that the caller is not permitted to open\u2014because they are unpublished, or because their distribution or sharing group has changed since the correlation was recorded\u2014were still returned with their metadata (title, date, correlating value counts).\n\nPreconditions:\n\n- An authenticated user with access to at least one event in MISP.\n\n- The existence of correlation entries linking that event to other events the user should not be able to view.\n\nImpact:\n\n- Unauthorized disclosure of event metadata (titles, dates, correlation counts) for events the user has no right to access.\n\n- Potential reconnaissance of threat-intelligence event names and timelines across sharing groups.\n\nAffected: MISP versions prior to the fix commit (2ffa97f05)."}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Leverage Trusted Relationship"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-02T15:59:27Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-285", "description": "CWE-285 Improper Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/2ffa97f05"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix enforces proper per-event authorization on the related events query by applying the user's full access-control conditions (including published status, distribution level, and sharing group membership) to the event lookup, rather than relying solely on the stale distribution snapshot stored in the correlation table. This ensures that only events the caller is currently permitted to read are returned in the related events list.</p>"}], "value": "The fix enforces proper per-event authorization on the related events query by applying the user's full access-control conditions (including published status, distribution level, and sharing group membership) to the event lookup, rather than relying solely on the stale distribution snapshot stored in the correlation table. This ensures that only events the caller is currently permitted to read are returned in the related events list."}], "title": "MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The tag_version_boundary (v2.5.48, 50 commits after fix) is used as an approximate upper bound for affected versions; exact version boundaries are not explicitly stated in the patch metadata.", "PR:L assumes the attacker needs only a basic authenticated MISP account with access to at least one event; higher-privilege roles may be required depending on deployment configuration, but the patch does not specify this.", "VC:L assumes the disclosed metadata (event titles, dates, correlation counts) constitutes a low confidentiality impact; in highly sensitive threat-intelligence environments the impact could be rated higher.", "CAPEC-126 is the closest available mapping; no CAPEC precisely describes authorization bypass via a stale snapshot in a correlation/join table.", "The 'published' flag and distribution/sharing group checks are assumed to be the primary authorization mechanisms in MISP's event model, based on the commit message and patch context.", "No public exploit or active exploitation is assumed; the patch does not reference any CVE, advisory, or exploitation evidence."], "capecRationale": [{"capecId": "CAPEC-126", "rationale": "The attacker leverages the trusted correlation relationship stored in the correlation table. The system treated the correlation entry as a sufficient authorization basis, but the snapshot data was stale and incomplete (missing published flag), allowing access to event metadata the caller should not see. This is the closest CAPEC to the pattern of relying on a trusted data source that does not reflect current authorization state. Uncertainty: no CAPEC perfectly describes 'stale authorization snapshot in a join table'; CAPEC-126 is the best available match."}], "commit": "2ffa97f0526cd6579b91a4dea560f6246ecbe108", "confidence": "medium", "credits": [{"lang": "en", "type": "reporter", "value": "Wenhao Wu"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5 (1M context)"}], "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: An authenticated user simply requests the related events endpoint; no race condition or complex manipulation is needed. AT:N: No attack-target manipulation required. PR:L: Requires a low-privilege authenticated user with access to at least one event. UI:N: No user interaction needed. VC:L: Disclosure is limited to event metadata (title, date, correlation counts), not full event content or attributes. VI:N, VA:N: No integrity or availability impact. SC:N, SI:N, SA:N: No secondary impacts on other systems. The overall score reflects a low-severity information disclosure requiring authentication.", "fixSummary": "The fix enforces proper per-event authorization on the related events query by applying the user's full access-control conditions (including published status, distribution level, and sharing group membership) to the event lookup, rather than relying solely on the stale distribution snapshot stored in the correlation table. This ensures that only events the caller is currently permitted to read are returned in the related events list.", "generatedAt": "2026-10-02T15:59:27.212571Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 6, "confidence": "medium", "model": "qwen3.8:27b", "score": 6}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "c315cbcd2cad3e0a5886680a4c6a903d9ed5f3fe3893670f74786cea77a56eb3", "patchSummary": "In EventsController.php (viewRelatedEvents) and Event.php (getRelatedEvents), the query that fetches related event metadata previously used only Event.id IN (relatedEventIds) as the condition. The patch replaces this with a call to createEventConditions($user), which builds the full set of authorization conditions (published flag, distribution, sharing group), and then adds the Event.id filter on top. The stale comment claiming ACL was enforced via the correlation table was removed. Two files changed, 8 insertions, 9 deletions.", "patchTruncated": false, "patches": [{"commit": "2ffa97f0526cd6579b91a4dea560f6246ecbe108", "date": "Tue, 22 Sep 2026 15:14:32 +0200", "patchSha256": "c315cbcd2cad3e0a5886680a4c6a903d9ed5f3fe3893670f74786cea77a56eb3", "source": "https://github.com/MISP/MISP/commit/2ffa97f05.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/2ffa97f05.patch", "subject": "fix: [security] Scope the related event list to what the"}], "source": "https://github.com/MISP/MISP/commit/2ffa97f05.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-02T15:59:27Z", "version": "2.0.3"}, "subject": "fix: [security] Scope the related event list to what the", "tagVersionBoundary": {"commits_after_fix": 50, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-862", "rationale": "The related events query did not apply the caller's per-event authorization checks (published status, distribution, sharing group). The system relied on a stale snapshot in the correlation table instead of re-validating access, effectively omitting the authorization step for the returned events."}, {"cweId": "CWE-285", "rationale": "Even though some authorization existed (via the correlation table snapshot), it was based on outdated data and lacked the published flag check, making the authorization decision incorrect for events whose access parameters had changed or that were unpublished."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (2ffa97f0526cd6579b91a4dea560f6246ecbe108): fix: [security] Scope the related event list to what the", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/2ffa97f05.patch"], "timestamp": "2026-09-22T13:14:32Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20165"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20165", "datePublished": "2026-10-02T16:01:15.540228Z", "dateUpdated": "2026-10-02T16:01:27.102405Z", "cveId": "CVE-2026-104910", "dateReserved": "2026-10-02T16:01:26.599Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["DecayingModelController"], "product": "MISP", "programFiles": ["app/Controller/DecayingModelController.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging exclusively to the importing user's organisation, with the default flag forced to off.</p><p>However, the application stripped only the top-level id and uuid fields and pinned org_id and default on the outer array before saving the data flat. A user with decaying-model permissions could supply a nested model key carrying its own primary key, organisation identifier, and default flag, which bypassed those guards during the save operation.</p><p>Impact:</p><p>- A user with perm_decaying could overwrite an existing decaying model belonging to another organisation in place, altering its name, formula, parameters, or ownership.</p><p>- A user could create or modify a model flagged as the organisation default, affecting scoring behaviour for other users.</p><p>- A user could reassign a model's organisation to an arbitrary value.</p><p>Preconditions:</p><p>- Authenticated user with decaying-model permission (perm_decaying).</p><p>- Network access to the MISP instance.</p><p>Affected: &lt;2.5.48.</p>"}], "value": "MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging exclusively to the importing user's organisation, with the default flag forced to off.\n\nHowever, the application stripped only the top-level id and uuid fields and pinned org_id and default on the outer array before saving the data flat. A user with decaying-model permissions could supply a nested model key carrying its own primary key, organisation identifier, and default flag, which bypassed those guards during the save operation.\n\nImpact:\n\n- A user with perm_decaying could overwrite an existing decaying model belonging to another organisation in place, altering its name, formula, parameters, or ownership.\n\n- A user could create or modify a model flagged as the organisation default, affecting scoring behaviour for other users.\n\n- A user could reassign a model's organisation to an arbitrary value.\n\nPreconditions:\n\n- Authenticated user with decaying-model permission (perm_decaying).\n\n- Network access to the MISP instance.\n\nAffected: <2.5.48."}], "impacts": [{"capecId": "CAPEC-13", "descriptions": [{"lang": "en", "value": "CAPEC-13 Parameter Tampering"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 7.1, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-02T15:55:12Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-915", "description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-285", "description": "CWE-285 Improper Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/70e319e4b"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The import handler now builds the model record from an explicit allow-list of permitted fields (name, parameters, description, ref, formula, version, enabled, all_orgs) using array_intersect_key, discarding any unlisted keys including nested model objects. The organisation identifier and default flag are set unconditionally after filtering. The save operation is preceded by an explicit create() call and the data is wrapped in the proper model key, preventing the ORM from interpreting attacker-supplied nested keys as separate model attributes.</p>"}], "value": "The import handler now builds the model record from an explicit allow-list of permitted fields (name, parameters, description, ref, formula, version, enabled, all_orgs) using array_intersect_key, discarding any unlisted keys including nested model objects. The organisation identifier and default flag are set unconditionally after filtering. The save operation is preceded by an explicit create() call and the data is wrapped in the proper model key, preventing the ORM from interpreting attacker-supplied nested keys as separate model attributes."}], "title": "MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 21 commits after fix); the patch metadata does not explicitly state a fixed version string, so '< 2.5.48' is an analyst inference.", "The CAPEC-13 mapping is the closest available pattern; the attack is specifically a mass-assignment bypass via a nested model key rather than a generic parameter tampering, but no CAPEC entry precisely describes ORM-level mass assignment through nested keys.", "CVSS PR:L assumes perm_decaying is a low-privilege role available to many users; if it requires elevated privileges the score would be lower.", "The Co-Authored-By line references an AI assistant (Claude Opus 5); it is recorded as a tool credit, not a human remediation developer.", "No evidence of active exploitation or public PoC was found in the patch; SSVCE exploitation is set to 'none'.", "The patch does not specify authentication requirements beyond perm_decaying; it is assumed this is a standard MISP role rather than an admin-level permission."], "capecRationale": [{"capecId": "CAPEC-13", "rationale": "The attacker tampers with the import request parameters by injecting a nested DecayingModel key containing unauthorized fields (id, org_id, default) that the application's top-level stripping did not filter. This is a direct form of parameter tampering where extra or modified parameters in the request bypass the intended input validation. The mapping is a close fit because the attack vector is manipulation of request parameters rather than a separate injection or protocol-level attack."}], "commit": "70e319e4b9dbbeca173befce2340eedf9d86f1b0", "confidence": "high", "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5"}], "cvssRationale": "AV:N - MISP is a network-accessible web application. AC:L - the attack requires only crafting a JSON payload with a nested key; no race condition or complex timing is needed. AT:N - no in-transit tampering required. PR:L - requires an authenticated user with perm_decaying, a low-privilege role. UI:N - no victim interaction needed. VC:N - no confidentiality impact; the attacker does not read data they cannot already access. VI:H - high integrity impact: an existing model belonging to another organisation can be overwritten in place, its ownership reassigned, or its default flag set, altering scoring for other users. VA:N - no availability impact. SC/SI/SA:N - the impact is confined to the MISP instance itself (same component); no secondary component is affected. Scope is not changed because both the vulnerable and impacted components are the MISP application and its data store.", "fixSummary": "The import handler now builds the model record from an explicit allow-list of permitted fields (name, parameters, description, ref, formula, version, enabled, all_orgs) using array_intersect_key, discarding any unlisted keys including nested model objects. The organisation identifier and default flag are set unconditionally after filtering. The save operation is preceded by an explicit create() call and the data is wrapped in the proper model key, preventing the ORM from interpreting attacker-supplied nested keys as separate model attributes.", "generatedAt": "2026-10-02T15:55:12.256144Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 6, "confidence": "high", "model": "qwen3.8:27b", "score": 7}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "2ea9ae3603b60db40cddef05bf41462c4b235652ccd53d6e8a5596006232e59d", "patchSummary": "In DecayingModelController::import(), the previous logic of unsetting id/uuid and pinning org_id/default on the flat array was replaced with an allow-list approach: array_intersect_key against a fixed set of importable fields, followed by explicit assignment of org_id from the authenticated user and default=0. A DecayingModel::create() call was added before save, and the save payload is now wrapped as array('DecayingModel' => $model) to bind the data to the correct model context. A regression test (DecayingModelImportOwnership) was added that verifies a nested DecayingModel key with a foreign id, org_id, and default=1 cannot overwrite or reassign an existing model.", "patchTruncated": false, "patches": [{"commit": "70e319e4b9dbbeca173befce2340eedf9d86f1b0", "date": "Fri, 25 Sep 2026 14:22:03 +0200", "patchSha256": "2ea9ae3603b60db40cddef05bf41462c4b235652ccd53d6e8a5596006232e59d", "source": "https://github.com/MISP/MISP/commit/70e319e4b.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/70e319e4b.patch", "subject": "fix: [security] Imported decaying models belong to the"}], "source": "https://github.com/MISP/MISP/commit/70e319e4b.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-02T15:55:12Z", "version": "2.0.3"}, "subject": "fix: [security] Imported decaying models belong to the", "tagVersionBoundary": {"commits_after_fix": 21, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-915", "rationale": "The import endpoint accepted user-supplied data and saved it without restricting which object attributes could be set. A nested model key allowed the attacker to modify the primary key, organisation, and default flag of a record, which are attributes that should be controlled exclusively by the application. This is a classic mass-assignment / improper dynamic attribute modification issue."}, {"cweId": "CWE-285", "rationale": "The application failed to enforce that the imported model belongs to the caller's organisation. A user with only perm_decaying could modify records owned by other organisations, indicating an authorization boundary was not enforced on the object being written."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (70e319e4b9dbbeca173befce2340eedf9d86f1b0): fix: [security] Imported decaying models belong to the", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/70e319e4b.patch"], "timestamp": "2026-09-25T12:22:03Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20189"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20189", "datePublished": "2026-10-02T15:56:06.623063Z", "dateUpdated": "2026-10-02T15:56:12.407791Z", "cveId": "CVE-2026-104908", "dateReserved": "2026-10-02T15:56:12.330Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["Servers/preview_event"], "product": "MISP", "programFiles": ["app/View/Servers/preview_event.ctp"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript string context, meaning a malicious linked server could supply a tag ID containing characters (such as a single quote) that break out of the JavaScript string literal and inject arbitrary script.</p><p>Preconditions:</p><p>- A linked/remote MISP server is configured and connected to the local instance.</p><p>- The linked server supplies a crafted tag ID in an event.</p><p>- An authenticated user views the event preview and interacts with the affected tag element.</p><p>Impact:</p><p>- Arbitrary JavaScript execution in the context of the viewing user's browser session, potentially allowing session hijacking, data exfiltration, or unauthorized actions on behalf of the user.</p><p>Affected versions: MISP prior to the fix commit (v2.5.48 or later, exact boundary unconfirmed).</p>"}], "value": "MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript string context, meaning a malicious linked server could supply a tag ID containing characters (such as a single quote) that break out of the JavaScript string literal and inject arbitrary script.\n\nPreconditions:\n\n- A linked/remote MISP server is configured and connected to the local instance.\n\n- The linked server supplies a crafted tag ID in an event.\n\n- An authenticated user views the event preview and interacts with the affected tag element.\n\nImpact:\n\n- Arbitrary JavaScript execution in the context of the viewing user's browser session, potentially allowing session hijacking, data exfiltration, or unauthorized actions on behalf of the user.\n\nAffected versions: MISP prior to the fix commit (v2.5.48 or later, exact boundary unconfirmed)."}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Cross Site Scripting"}]}, {"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Exploiting Incorrectly Handled Special/Control Characters"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 4.8, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-02T15:50:34Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-116", "description": "CWE-116 Improper Encoding or Escaping of Output", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/70ad174dd"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The vulnerability is remediated by casting the remote tag ID to an integer before embedding it in the inline JavaScript onclick handler. This ensures only a numeric value is rendered, eliminating the possibility of breaking out of the JavaScript string context with special characters.</p>"}], "value": "The vulnerability is remediated by casting the remote tag ID to an integer before embedding it in the inline JavaScript onclick handler. This ensures only a numeric value is rendered, eliminating the possibility of breaking out of the JavaScript string context with special characters."}], "title": "MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The affected version boundary is inferred from the tag v2.5.48 with 28 commits after the fix; the exact first affected version is not stated in the patch.", "The attacker is assumed to be a linked/remote MISP server that can control tag IDs in events shared with the local instance; the exact trust model and authentication for linked servers is not detailed in the patch.", "CAPEC-126 is included as a supplementary mapping; the primary and most defensible mapping is CAPEC-1 (Cross Site Scripting).", "The CVSS PR:L assumes that being a linked server requires some form of authenticated or trusted relationship, but the exact privilege level is not specified in the patch.", "The Co-Authored-By line references an AI tool (Claude Opus 5.5); it is listed as a tool credit, not a human remediation developer.", "The impact scope (SC/SI) is assessed conservatively; the actual XSS payload capability depends on the browser context and same-origin policy, which are not fully specified."], "capecRationale": [{"capecId": "CAPEC-1", "rationale": "The vulnerability is a reflected XSS where attacker-controlled data (a tag ID from a linked server) is injected into an inline JavaScript event handler without proper context-aware encoding. CAPEC-1 is the closest general match. The specific sub-technique is injection into a JavaScript string literal within an HTML attribute, which is not separately enumerated in CAPEC."}, {"capecId": "CAPEC-126", "rationale": "The attacker exploits the fact that the single-quote character (or similar) is not properly handled when the tag ID is placed inside a JavaScript string within an HTML attribute. The HTML escaping does not account for the JavaScript string delimiter. This CAPEC captures the character-handling aspect of the flaw. Uncertainty: CAPEC-1 is more directly about XSS; CAPEC-126 is included as a supplementary mapping for the encoding mismatch."}], "commit": "70ad174ddd438887687d40fc1e2e4e8b322a179e", "confidence": "medium", "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "cvssRationale": "AV:N - the attack originates from a remote linked server over the network. AC:L - the injection is straightforward (embed a quote in a tag ID). AT:N - no special timing or race conditions required. PR:L - the attacker must be a configured linked server, which requires some level of trust/access but not full admin. UI:A - the victim must actively view the event preview and interact with the tag element. VC/VI/VA:N - the MISP server itself is not compromised; the impact is in the victim's browser. SC:N - no meaningful confidentiality impact on the subsequent component is guaranteed. SI:L - the injected script can perform limited actions (redirect, read page data, submit forms) in the user's session. SA:N - no availability impact on the subsequent component.", "fixSummary": "The vulnerability is remediated by casting the remote tag ID to an integer before embedding it in the inline JavaScript onclick handler. This ensures only a numeric value is rendered, eliminating the possibility of breaking out of the JavaScript string context with special characters.", "generatedAt": "2026-10-02T15:50:34.593118Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 6, "confidence": "medium", "model": "qwen3.8:27b", "score": 6}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "048909e6f2d91cc9e6f920e8416edc5f9f44410eba1becc15373378f46a221de", "patchSummary": "In app/View/Servers/preview_event.ctp, the expression h($tag['id']) inside the onclick attribute's JavaScript string was replaced with (int)$tag['id']. This changes the output from an HTML-escaped string to a strictly integer value, preventing any non-numeric characters from being injected into the inline script context.", "patchTruncated": false, "patches": [{"commit": "70ad174ddd438887687d40fc1e2e4e8b322a179e", "date": "Thu, 24 Sep 2026 23:53:31 +0200", "patchSha256": "048909e6f2d91cc9e6f920e8416edc5f9f44410eba1becc15373378f46a221de", "source": "https://github.com/MISP/MISP/commit/70ad174dd.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/70ad174dd.patch", "subject": "fix: [security] Cast the remote tag id in the event preview"}], "source": "https://github.com/MISP/MISP/commit/70ad174dd.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-02T15:50:34Z", "version": "2.0.3"}, "subject": "fix: [security] Cast the remote tag id in the event preview", "tagVersionBoundary": {"commits_after_fix": 28, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-79", "rationale": "The tag ID is embedded in an inline JavaScript onclick handler where HTML escaping (h()) does not neutralize JavaScript string breakout characters. This is a classic case of improper output encoding for a JavaScript context, resulting in reflected XSS."}, {"cweId": "CWE-116", "rationale": "The root cause is using HTML entity encoding (h()) in a context that requires JavaScript string escaping. The encoding mechanism is inappropriate for the output context, which is a sub-category of the XSS issue."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (70ad174ddd438887687d40fc1e2e4e8b322a179e): fix: [security] Cast the remote tag id in the event preview", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/70ad174dd.patch"], "timestamp": "2026-09-24T21:53:31Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20154"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-104907", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20154", "datePublished": "2026-10-02T15:51:26.684280Z", "dateUpdated": "2026-10-02T15:51:32.620284Z", "dateReserved": "2026-10-02T15:51:32.541Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["TAXII object viewer", "app/View/Elements/genericElements/json.ctp"], "product": "MISP", "programFiles": ["app/View/Elements/genericElements/json.ctp"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII object (e.g., by publishing a malicious object to a TAXII server that the victim's MISP instance subscribes to) can inject arbitrary HTML or JavaScript that executes in the context of the victim's MISP session.</p><p>Preconditions:</p><p>- The victim must be an authenticated MISP user with access to the TAXII object viewer.</p><p>- The victim must open or view the crafted TAXII object.</p><p>Impact:</p><p>- Execution of arbitrary JavaScript in the victim's browser within the MISP application context.</p><p>- Potential theft of session tokens, API keys, or other sensitive data accessible from the MISP interface.</p><p>- Potential for performing actions on behalf of the authenticated user.</p><p>Affected versions: &lt;2.5.48.</p>"}], "value": "MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII object (e.g., by publishing a malicious object to a TAXII server that the victim's MISP instance subscribes to) can inject arbitrary HTML or JavaScript that executes in the context of the victim's MISP session.\n\nPreconditions:\n\n- The victim must be an authenticated MISP user with access to the TAXII object viewer.\n\n- The victim must open or view the crafted TAXII object.\n\nImpact:\n\n- Execution of arbitrary JavaScript in the victim's browser within the MISP application context.\n\n- Potential theft of session tokens, API keys, or other sensitive data accessible from the MISP interface.\n\n- Potential for performing actions on behalf of the authenticated user.\n\nAffected versions: <2.5.48."}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 Cross Site Scripting (XSS)"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.2, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-02T15:47:29Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/1bed4ca0c"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix applies HTML-encoding (via the h() helper) to the JSON string before it is interpolated into the HTML pre element. This ensures that any HTML or script markup present in the JSON string properties of a TAXII object is rendered as inert text rather than being parsed and executed by the browser, eliminating the XSS vector.</p>"}], "value": "The fix applies HTML-encoding (via the h() helper) to the JSON string before it is interpolated into the HTML pre element. This ensures that any HTML or script markup present in the JSON string properties of a TAXII object is rendered as inert text rather than being parsed and executed by the browser, eliminating the XSS vector."}], "title": "MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The affected version boundary (< 2.5.48) is inferred from the tag_version_boundary metadata (v2.5.48, 29 commits after fix); the patch metadata does not explicitly state a fixed version.", "PR:L assumes the TAXII object viewer requires authenticated access to MISP; if the viewer is accessible without authentication, PR would be None.", "The CAPEC-66 mapping is the closest available pattern for XSS; the exact delivery vector (stored via TAXII server vs. reflected) is not fully specified in the patch, but the core unencoded-output pattern is unambiguous.", "The Co-Authored-By line references an AI assistant (Claude Opus 5.5); it is credited as a tool rather than a human remediation developer.", "UI:A assumes the victim must actively navigate to and render the specific TAXII object; if the object is auto-loaded in a dashboard, UI could be None."], "capecRationale": [{"capecId": "CAPEC-66", "rationale": "The attack pattern involves injecting script-enabled content into a web page via untrusted data (TAXII object string properties) that is rendered without encoding. CAPEC-66 is the most specific CAPEC for XSS. The uncertainty is that the exact delivery mechanism (stored in a TAXII server vs. reflected) is not fully specified in the patch, but the core pattern of unencoded user-controlled data in an HTML context matches CAPEC-66 precisely."}], "commit": "1bed4ca0c990a4c285e8caa1d7efd91fec43eaca", "confidence": "high", "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "cvssRationale": "AV:N: The vulnerability is exploitable over the network via the MISP web interface. AC:L: No race conditions or special timing required; simply viewing the object triggers the XSS. AT:N: The malicious payload is already embedded in the TAXII object; no manipulation of the attack target is needed at exploit time. PR:L: The attacker needs a MISP account (or the ability to publish to a subscribed TAXII server) to place the payload. UI:A: The victim must actively open/view the TAXII object in the viewer. VC/VI/VA:N: The MISP server itself is not compromised; the impact is client-side. SC:H: An attacker can read session cookies, API tokens, and data visible in the MISP UI. SI:H: An attacker can perform actions as the authenticated user (create/modify objects, change settings). SA:N: No denial-of-service impact on the system.", "fixSummary": "The fix applies HTML-encoding (via the h() helper) to the JSON string before it is interpolated into the HTML pre element. This ensures that any HTML or script markup present in the JSON string properties of a TAXII object is rendered as inert text rather than being parsed and executed by the browser, eliminating the XSS vector.", "generatedAt": "2026-10-02T15:47:29.857932Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 5, "confidence": "high", "model": "qwen3.8:27b", "score": 8}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "6f48e50f2a682434a041678f85a824d0f37ffaf42dda6b0d664e756bc2c7d4b1", "patchSummary": "In app/View/Elements/genericElements/json.ctp, the sprintf call that builds the pre tag was changed from json_encode($json) to h(json_encode($json)). The h() function (CakePHP's HTML-encoding helper, equivalent to htmlspecialchars) now escapes angle brackets, ampersands, and quotes in the JSON output before it is placed inside the HTML pre element. One line changed, one file affected.", "patchTruncated": false, "patches": [{"commit": "1bed4ca0c990a4c285e8caa1d7efd91fec43eaca", "date": "Thu, 24 Sep 2026 23:24:48 +0200", "patchSha256": "6f48e50f2a682434a041678f85a824d0f37ffaf42dda6b0d664e756bc2c7d4b1", "source": "https://github.com/MISP/MISP/commit/1bed4ca0c.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/1bed4ca0c.patch", "subject": "fix: [security] Escape the JSON shown in the generic JSON"}], "source": "https://github.com/MISP/MISP/commit/1bed4ca0c.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-02T15:47:29Z", "version": "2.0.3"}, "subject": "fix: [security] Escape the JSON shown in the generic JSON", "tagVersionBoundary": {"commits_after_fix": 29, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-79", "rationale": "The patch directly addresses the failure to HTML-encode untrusted JSON data before embedding it in an HTML context. The h() wrapper is the canonical fix for CWE-79 in CakePHP applications. The data originates from external TAXII objects and is rendered without encoding, allowing script injection."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (1bed4ca0c990a4c285e8caa1d7efd91fec43eaca): fix: [security] Escape the JSON shown in the generic JSON", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/1bed4ca0c.patch"], "timestamp": "2026-09-24T21:24:48Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20251"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20251", "datePublished": "2026-10-02T15:49:26.036803Z", "dateUpdated": "2026-10-02T15:49:31.534659Z", "cveId": "CVE-2026-104906", "dateReserved": "2026-10-02T15:49:31.457Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["ServersController (idTranslator)", "View/Servers/id_translator.ctp", "View/Themed/Overmind/Servers/id_translator.ctp"], "product": "MISP", "programFiles": ["app/Controller/ServersController.php", "app/View/Servers/id_translator.ctp", "app/View/Themed/Overmind/Servers/id_translator.ctp"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without proper output encoding.</p><p>A malicious or compromised linked server could return a crafted event ID containing arbitrary HTML or JavaScript markup. This markup would be rendered in the browser of any user in the host organization who views the ID Translator page, enabling session hijacking, credential theft, or other client-side attacks.</p><p>Preconditions:</p><p>- The victim must be an authenticated user of the host MISP instance.</p><p>- A linked server must be configured on the host instance.</p><p>- The victim must navigate to the ID Translator page for a given event.</p><p>Affected versions: &lt;2.5.48.</p>"}], "value": "MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without proper output encoding.\n\nA malicious or compromised linked server could return a crafted event ID containing arbitrary HTML or JavaScript markup. This markup would be rendered in the browser of any user in the host organization who views the ID Translator page, enabling session hijacking, credential theft, or other client-side attacks.\n\nPreconditions:\n\n- The victim must be an authenticated user of the host MISP instance.\n\n- A linked server must be configured on the host instance.\n\n- The victim must navigate to the ID Translator page for a given event.\n\nAffected versions: <2.5.48."}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 XSS - Reflected"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-02T15:17:39Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/bd5e80c84"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The vulnerability is remediated by enforcing integer typing on the remote event ID at the point where it enters the application data structure in the controller, and by applying HTML output encoding (the h() helper) to all user-visible fields (remote_id, server_id) in both the default and Overmind-themed ID Translator views. This ensures that even if a remote server returns non-numeric or markup-laden data, it cannot be interpreted as HTML by the browser.</p>"}], "value": "The vulnerability is remediated by enforcing integer typing on the remote event ID at the point where it enters the application data structure in the controller, and by applying HTML output encoding (the h() helper) to all user-visible fields (remote_id, server_id) in both the default and Overmind-themed ID Translator views. This ensures that even if a remote server returns non-numeric or markup-laden data, it cannot be interpreted as HTML by the browser."}], "title": "MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 30 commits after fix); the exact first affected version is not specified in the patch.", "The CAPEC-1 mapping is the closest available pattern; the data source is a server-to-server API response rather than a direct HTTP request parameter, making the 'reflected' classification slightly imprecise.", "The attacker is assumed to be a configured linked MISP server; no evidence suggests the vulnerability is exploitable without a pre-existing server link.", "The UI:A rating assumes the victim must explicitly navigate to the ID Translator page; it is unclear whether any automated workflow could trigger this view without direct user action.", "The Co-Authored-By line references an AI assistant; it is credited as a tool rather than a human remediation developer."], "capecRationale": [{"capecId": "CAPEC-1", "rationale": "The closest CAPEC pattern is reflected XSS: data originating from an external source (the linked server's API response) is reflected into the rendered HTML page without encoding. The mapping is slightly imprecise because the data source is a server-to-server API response rather than a direct user-supplied request parameter, but the mechanism (untrusted data reflected into HTML) matches CAPEC-1 most closely among available patterns. CAPEC-120 (Persistent XSS) was considered but the data is not stored in the victim's database; it is fetched live from the remote server and rendered, making the reflected pattern a better fit."}], "commit": "bd5e80c84f0ab853d88d14e14df9bd92786eb8f4", "confidence": "medium", "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "cvssRationale": "AV:N: The attack originates from a remote linked server over the network. AC:L: No race conditions or special timing are required; the linked server simply returns a crafted ID. AT:N: No active user interaction is needed to set up the attack (the malicious server is already linked). PR:N: The attacker is the linked server itself and does not need credentials on the victim's instance. UI:A: The victim must actively navigate to the ID Translator page for the payload to execute. VC:N/VI:N/VA:N: The vulnerable component (MISP server) is not directly compromised; the impact is client-side. SC:L: A successful XSS can read cookies, session tokens, or page data in the victim's browser. SI:L: The attacker can modify the rendered page content. SA:N: No impact on the security authority of the system.", "fixSummary": "The vulnerability is remediated by enforcing integer typing on the remote event ID at the point where it enters the application data structure in the controller, and by applying HTML output encoding (the h() helper) to all user-visible fields (remote_id, server_id) in both the default and Overmind-themed ID Translator views. This ensures that even if a remote server returns non-numeric or markup-laden data, it cannot be interpreted as HTML by the browser.", "generatedAt": "2026-10-02T15:17:39.791225Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 5, "confidence": "medium", "model": "qwen3.8:27b", "score": 7}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "398814c5f528eb504bfc173c7ed3258a171d9f3feeca03d8ba4fff252d3a8c1f", "patchSummary": "In ServersController.php, the remote_event['id'] value is cast to (int) in two locations where it is stored in the remote_events array and where it is extracted from the API response. In app/View/Servers/id_translator.ctp, the h() escaping function is applied to remote_id in the anchor text and to both server_id and remote_id in the preview URL. In app/View/Themed/Overmind/Servers/id_translator.ctp, h() is applied to remote_id in the badge display and to server_id and remote_id in the preview link. An 'exception' key is also initialized to null in the first array construction for consistency.", "patchTruncated": false, "patches": [{"commit": "bd5e80c84f0ab853d88d14e14df9bd92786eb8f4", "date": "Thu, 24 Sep 2026 23:24:11 +0200", "patchSha256": "398814c5f528eb504bfc173c7ed3258a171d9f3feeca03d8ba4fff252d3a8c1f", "source": "https://github.com/MISP/MISP/commit/bd5e80c84.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/bd5e80c84.patch", "subject": "fix: [security] Treat the remote event id in the ID"}], "source": "https://github.com/MISP/MISP/commit/bd5e80c84.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-02T15:17:39Z", "version": "2.0.3"}, "subject": "fix: [security] Treat the remote event id in the ID", "tagVersionBoundary": {"commits_after_fix": 30, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-79", "rationale": "The remote event ID returned by a linked server was rendered in HTML output without output encoding, allowing injection of arbitrary markup or script. The fix applies HTML escaping (h()) and integer casting, which is the canonical remediation for CWE-79."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (bd5e80c84f0ab853d88d14e14df9bd92786eb8f4): fix: [security] Treat the remote event id in the ID", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/bd5e80c84.patch"], "timestamp": "2026-09-24T21:24:11Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20296"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20296", "datePublished": "2026-10-02T15:21:32.442817Z", "dateUpdated": "2026-10-02T15:21:47.640145Z", "cveId": "CVE-2026-104901", "dateReserved": "2026-10-02T15:21:46.840Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["Remote Event Preview Index Table (count field)"], "product": "MISP", "programFiles": ["app/View/Elements/genericElements/IndexTable/Fields/count.ctp"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link URL but rendered the field value without HTML encoding. An attacker with the ability to create or modify events on a linked (remote) MISP server could craft an event identifier containing HTML or JavaScript markup. When a user on the local MISP instance views the remote event preview index, the unescaped value is rendered directly in the browser, allowing arbitrary script execution in the victim's session.</p><p>Preconditions:</p><p>- A linked/remote MISP server is configured and connected to the local instance.</p><p>- The attacker has sufficient access on the linked server to create or modify an event with a crafted identifier.</p><p>- A victim user on the local instance views the remote event preview index page.</p><p>Impact:</p><p>- Execution of arbitrary JavaScript in the context of the MISP web application.</p><p>- Potential session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user.</p><p>Affected versions: &lt;2.5.48.</p>"}], "value": "MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link URL but rendered the field value without HTML encoding. An attacker with the ability to create or modify events on a linked (remote) MISP server could craft an event identifier containing HTML or JavaScript markup. When a user on the local MISP instance views the remote event preview index, the unescaped value is rendered directly in the browser, allowing arbitrary script execution in the victim's session.\n\nPreconditions:\n\n- A linked/remote MISP server is configured and connected to the local instance.\n\n- The attacker has sufficient access on the linked server to create or modify an event with a crafted identifier.\n\n- A victim user on the local instance views the remote event preview index page.\n\nImpact:\n\n- Execution of arbitrary JavaScript in the context of the MISP web application.\n\n- Potential session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user.\n\nAffected versions: <2.5.48."}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Cross Site Scripting"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-01T11:32:45Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/2a2981a27"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The vulnerability is remediated by applying HTML entity encoding to the count field value before it is rendered in the view template. This ensures that any HTML or script markup contained in the value from a remote server is neutralized and displayed as inert text rather than being interpreted by the browser.</p>"}], "value": "The vulnerability is remediated by applying HTML entity encoding to the count field value before it is rendered in the view template. This ensures that any HTML or script markup contained in the value from a remote server is neutralized and displayed as inert text rather than being interpreted by the browser."}], "title": "MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The affected version boundary is inferred from the nearest tag v2.5.48 with 31 commits after the fix; the exact last affected version is not explicitly stated in the patch.", "PR:L assumes the attacker needs at least low-privilege access to a linked MISP server to create or modify an event; if no authentication is required on the linked server, PR could be None.", "The CAPEC-1 mapping is the closest standard pattern; no CAPEC specifically covers 'XSS via data from a trusted remote server' as a distinct pattern.", "The Co-Authored-By line references an AI assistant (Claude Opus 5.5); it is listed as a tool credit rather than a human remediation developer.", "The commit date (24 Sep 2026) is in the future relative to typical CVE timelines; this is taken at face value from the patch metadata."], "capecRationale": [{"capecId": "CAPEC-1", "rationale": "The attack pattern involves injecting script or markup into a web page through a data field (event ID from a linked server) that is rendered without encoding. CAPEC-1 is the closest standard mapping for XSS via untrusted data rendered in a browser context. The specific vector here is a linked MISP server supplying crafted data, which is a variant of the general XSS injection pattern. No more specific CAPEC precisely captures the 'trusted remote server as injection vector' nuance, so CAPEC-1 is the best available match."}], "commit": "2a2981a27bd06bfd6fa37866db1911637d52538c", "confidence": "medium", "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "cvssRationale": "AV:N - exploitation occurs over the network via a linked MISP server. AC:L - the attacker only needs to craft an event ID with HTML/JS; no race conditions or complex timing. AT:N - the malicious data is stored in the linked server; no active attack is needed at exploitation time. PR:L - the attacker needs low-privilege access to a linked MISP server to create/modify an event. UI:N - the victim only needs to view the remote event preview index page; no special interaction. VC/VI/VA:N - no direct impact on the MISP server's own confidentiality, integrity, or availability. SC:L - XSS allows reading some data (cookies, DOM) in the victim's browser. SI:L - attacker can modify what the victim sees in the browser. SA:N - no impact on security authority of the victim's system.", "fixSummary": "The vulnerability is remediated by applying HTML entity encoding to the count field value before it is rendered in the view template. This ensures that any HTML or script markup contained in the value from a remote server is neutralized and displayed as inert text rather than being interpreted by the browser.", "generatedAt": "2026-10-01T11:32:45.636394Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 5, "confidence": "medium", "model": "qwen3.8:27b", "score": 7}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "3c8a41f55b536b1beaab7797cf106c1ef8f72ec83417cf60660c60171f939a5e", "patchSummary": "In the CakePHP view template file app/View/Elements/genericElements/IndexTable/Fields/count.ctp, the assignment of $fieldValue was changed from a raw Hash::extract() call to one wrapped in the h() helper function (CakePHP's HTML-encoding utility). This single-line change ensures the extracted value is HTML-entity-encoded before being used in the template output, preventing injection of markup through the event identifier from a linked server.", "patchTruncated": false, "patches": [{"commit": "2a2981a27bd06bfd6fa37866db1911637d52538c", "date": "Thu, 24 Sep 2026 22:20:05 +0200", "patchSha256": "3c8a41f55b536b1beaab7797cf106c1ef8f72ec83417cf60660c60171f939a5e", "source": "https://github.com/MISP/MISP/commit/2a2981a27.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/2a2981a27.patch", "subject": "fix: [security] Escape the value of the count index field"}], "source": "https://github.com/MISP/MISP/commit/2a2981a27.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-01T11:32:45Z", "version": "2.0.3"}, "subject": "fix: [security] Escape the value of the count index field", "tagVersionBoundary": {"commits_after_fix": 31, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-79", "rationale": "The patch adds HTML encoding (h() function) to a value that was previously rendered raw in an HTML context. The commit message explicitly states the value was printed raw, allowing markup injection. This is a textbook stored/reflected XSS due to missing output encoding."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (2a2981a27bd06bfd6fa37866db1911637d52538c): fix: [security] Escape the value of the count index field", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/2a2981a27.patch"], "timestamp": "2026-09-24T20:20:05Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20230"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20230", "datePublished": "2026-10-02T15:16:19.969609Z", "dateUpdated": "2026-10-02T15:16:25.390743Z", "cveId": "CVE-2026-104900", "dateReserved": "2026-10-02T15:16:25.316Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["PostsController (discussion/thread posting)"], "product": "MISP", "programFiles": ["app/Controller/PostsController.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "unspecified", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Bastien Bossiroy and C\u00e9lien Desteucq of NCIA"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization (org-only distribution). It did not enforce the full thread access control list, including sharing-group membership and event-level visibility.</p><p>As a result, an authenticated user who is outside the relevant sharing group or who does not have visibility on the associated event could:</p><p>- Read the thread title and the content of the quoted post</p><p>- Submit a new post into the discussion thread</p><p>This constitutes both an information disclosure (reading restricted thread and post content) and an integrity issue (injecting content into a thread the user is not authorized to participate in).</p><p>Affected: &lt;2.5.48</p>"}], "value": "MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization (org-only distribution). It did not enforce the full thread access control list, including sharing-group membership and event-level visibility.\n\nAs a result, an authenticated user who is outside the relevant sharing group or who does not have visibility on the associated event could:\n\n- Read the thread title and the content of the quoted post\n\n- Submit a new post into the discussion thread\n\nThis constitutes both an information disclosure (reading restricted thread and post content) and an integrity issue (injecting content into a thread the user is not authorized to participate in).\n\nAffected: <2.5.48"}], "impacts": [{"capecId": "CAPEC-10", "descriptions": [{"lang": "en", "value": "CAPEC-10 Parameter Tampering"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-01T11:16:47Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "description": "CWE-285 Improper Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/79fbd4c75"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix replaces the limited org-only distribution check with a call to the thread's full authorization method (checkIfAuthorised), which enforces the complete access control list including sharing groups and event-level visibility. The thread is only read after successful authorization, preventing disclosure of the title and content to unauthorized users. An additional null-check on the post's thread_id was added to prevent referencing posts without a valid thread association.</p>"}], "value": "The fix replaces the limited org-only distribution check with a call to the thread's full authorization method (checkIfAuthorised), which enforces the complete access control list including sharing groups and event-level visibility. The thread is only read after successful authorization, preventing disclosure of the title and content to unauthorized users. An additional null-check on the post's thread_id was added to prevent referencing posts without a valid thread association."}], "title": "MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The exact affected version range is uncertain; the tag boundary v2.5.48 with 42 commits after the fix suggests the fix landed around or before v2.5.48, but the precise first-affected and first-fixed versions are not stated in the patch.", "The checkIfAuthorised() method is assumed to enforce the full thread ACL including sharing groups and event visibility, based on the commit message description; the method's implementation is not included in the patch.", "CAPEC-10 (Parameter Tampering) is the closest available CAPEC mapping; no CAPEC specifically covers 'incomplete authorization check on a direct object reference' was identified in the catalog.", "The CVSS assumes the attacker already possesses a valid MISP account (PR:L); unauthenticated access is not indicated by the patch.", "The AI co-author (Claude Opus 5.5) is credited as a tool rather than a person, per the Co-Authored-By line."], "capecRationale": [{"capecId": "CAPEC-10", "rationale": "The attacker manipulates the target_id parameter (thread_id or post_id) in the posts/add request to reference a thread or post they do not have full access to. The incomplete server-side authorization check then permits the operation. CAPEC-10 is the closest available pattern for exploiting a server's failure to properly validate the authorization context of a user-supplied resource identifier. Uncertainty: no CAPEC specifically named 'Insecure Direct Object Reference' or 'Broken Access Control via Incomplete ACL' exists in the CAPEC catalog, so Parameter Tampering is the best available match."}], "commit": "79fbd4c7580adc0518581351c3d8c3d5b3ac7c97", "confidence": "medium", "credits": [{"lang": "en", "type": "reporter", "value": "Bastien Bossiroy and C\u00e9lien Desteucq of NCIA"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "cvssRationale": "AV:N: web application accessible over network. AC:L: attacker only needs a valid thread_id or post_id, no race conditions or special timing. AT:N: no special attack prerequisites beyond authentication. PR:L: requires an authenticated MISP user account. UI:N: no victim interaction needed; the attacker directly issues the request. VC:L: attacker can read thread titles and quoted post content they should not see. VI:L: attacker can inject posts into unauthorized threads. VA:N: no availability impact. SC/SI/SA:N: no impact on subsequent components. The impact is bounded to the MISP instance's data and does not compromise the server or other systems.", "fixSummary": "The fix replaces the limited org-only distribution check with a call to the thread's full authorization method (checkIfAuthorised), which enforces the complete access control list including sharing groups and event-level visibility. The thread is only read after successful authorization, preventing disclosure of the title and content to unauthorized users. An additional null-check on the post's thread_id was added to prevent referencing posts without a valid thread association.", "generatedAt": "2026-10-01T11:16:47.016611Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 5, "confidence": "medium", "model": "qwen3.8:27b", "score": 7}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "04551eba9b017a1a2ccf05a79c21466f3fd7095a42750bd2704d57b2e3730938", "patchSummary": "In PostsController.php add() method: (1) For the 'thread' target case, replaced the inline distribution==0 and org_id comparison with a call to Thread->checkIfAuthorised() before reading the thread; removed the separate _isSiteAdmin() bypass. (2) For the 'post' target case, added a check that the post has a non-empty thread_id, replaced the same limited distribution/org check with Thread->checkIfAuthorised(), and reordered the thread read to occur after the authorization check. Net: 8 insertions, 12 deletions in one file.", "patchTruncated": false, "patches": [{"commit": "79fbd4c7580adc0518581351c3d8c3d5b3ac7c97", "date": "Wed, 23 Sep 2026 15:27:08 +0200", "patchSha256": "04551eba9b017a1a2ccf05a79c21466f3fd7095a42750bd2704d57b2e3730938", "source": "https://github.com/MISP/MISP/commit/79fbd4c75.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/79fbd4c75.patch", "subject": "fix: [security] Apply the thread ACL when posting to a"}], "source": "https://github.com/MISP/MISP/commit/79fbd4c75.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-01T11:16:47Z", "version": "2.0.3"}, "subject": "fix: [security] Apply the thread ACL when posting to a", "tagVersionBoundary": {"commits_after_fix": 42, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-285", "rationale": "The authorization check was present but incomplete: it only verified org-level distribution (distribution==0) and org_id match, failing to enforce sharing-group membership and event-level ACL. This is a classic case of insufficient authorization logic rather than a completely missing check, making CWE-285 more precise than CWE-862."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (79fbd4c7580adc0518581351c3d8c3d5b3ac7c97): fix: [security] Apply the thread ACL when posting to a", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/79fbd4c75.patch"], "timestamp": "2026-09-23T13:27:08Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20244"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20244", "datePublished": "2026-10-01T11:31:25.274200Z", "dateUpdated": "2026-10-01T11:31:31.176439Z", "cveId": "CVE-2026-103858", "dateReserved": "2026-10-01T11:31:31.101Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["AttributesController::viewAnalystData", "ObjectsController::viewAnalystData", "Analyst_data view templates"], "product": "MISP", "programFiles": ["app/Controller/AttributesController.php", "app/Controller/ObjectsController.php", "app/View/Elements/genericElements/Analyst_data/generic_simple.ctp", "app/View/Elements/genericElements/Analyst_data/thread.ctp"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement.</p><p>An attacker who can convince an authenticated MISP user to navigate to a crafted URL (for example, via a phishing link) can inject arbitrary JavaScript that executes in the victim's browser context. This may allow the attacker to read session tokens, manipulate the page, or perform actions on behalf of the victim.</p><p>Preconditions:</p><p>- The victim must be authenticated to MISP and access the analyst data view for an attribute or object.</p><p>- The attacker must supply a malicious seed value in the URL path.</p><p>Impact:</p><p>- Execution of arbitrary JavaScript in the victim's browser session.</p><p>- Potential theft of session credentials or sensitive data visible in the page.</p><p>- Manipulation of the analyst data interface.</p><p>Affected: MISP versions prior to the fix (commit 58925dbf0, post v2.5.48).</p>"}], "value": "MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement.\n\nAn attacker who can convince an authenticated MISP user to navigate to a crafted URL (for example, via a phishing link) can inject arbitrary JavaScript that executes in the victim's browser context. This may allow the attacker to read session tokens, manipulate the page, or perform actions on behalf of the victim.\n\nPreconditions:\n\n- The victim must be authenticated to MISP and access the analyst data view for an attribute or object.\n\n- The attacker must supply a malicious seed value in the URL path.\n\nImpact:\n\n- Execution of arbitrary JavaScript in the victim's browser session.\n\n- Potential theft of session credentials or sensitive data visible in the page.\n\n- Manipulation of the analyst data interface.\n\nAffected: MISP versions prior to the fix (commit 58925dbf0, post v2.5.48)."}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 XSS - Reflected"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 4.8, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-01T08:49:54Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/58925dbf0"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The vulnerability is remediated by enforcing integer type on the seed parameter at both the controller layer and the view/template layer. Casting the value to an integer ensures that any non-numeric input (including script payloads) is neutralized before it reaches the inline JavaScript context, eliminating the injection vector.</p>"}], "value": "The vulnerability is remediated by enforcing integer type on the seed parameter at both the controller layer and the view/template layer. Casting the value to an integer ensures that any non-numeric input (including script payloads) is neutralized before it reaches the inline JavaScript context, eliminating the injection vector."}], "title": "MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["MISP requires user authentication to access the analyst data views; PR:L assumes a low-privilege authenticated account is sufficient for the attacker to craft or deliver the malicious URL.", "The exact fixed version number is not stated in the patch; the fix commit is 32 commits after the v2.5.48 tag, so the fixed version is presumed to be a release after 2.5.48.", "The UI:A rating assumes the victim must click a link or navigate to the crafted URL; if the seed could be injected via a different vector requiring no user interaction, UI could be None.", "CAPEC-1 (Reflected XSS) is selected as the closest match; the injection occurs server-side into the HTML response, distinguishing it from DOM-based XSS (CAPEC-64)."], "capecRationale": [{"capecId": "CAPEC-1", "rationale": "The attacker supplies a malicious value in a URL parameter (seed), which the server reflects unmodified into inline JavaScript in the HTTP response. The victim's browser executes the injected script. This matches the reflected XSS pattern precisely. No uncertainty in this mapping."}], "commit": "58925dbf01c2fe5dfe9b2f61a421f6463f66ca56", "confidence": "high", "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "cvssRationale": "AV:N - exploitable over the network via a crafted URL. AC:L - no race conditions or special conditions; a simple URL with a malicious seed suffices. AT:N - no prior manipulation of the target system needed. PR:L - MISP is an authenticated platform; the attacker needs at least a low-privilege account or must target an authenticated user. UI:A - the victim must actively navigate to the crafted URL. VC/VI/VA:N - the server-side confidentiality, integrity, and availability are not directly impacted. SC:L - the victim's browser session data (cookies, tokens) can be read. SI:L - the victim's page content can be modified. SA:N - no impact on security authority.", "fixSummary": "The vulnerability is remediated by enforcing integer type on the seed parameter at both the controller layer and the view/template layer. Casting the value to an integer ensures that any non-numeric input (including script payloads) is neutralized before it reaches the inline JavaScript context, eliminating the injection vector.", "generatedAt": "2026-10-01T08:49:54.035056Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 4, "confidence": "high", "model": "qwen3.8:27b", "score": 9}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "7e384946a0fb4f1d43dee43a5374cabf2e70c31add4a6d2e4fa845cdc5ee5b37", "patchSummary": "In AttributesController.php and ObjectsController.php, the seed value set for the view is now cast to an integer with a fallback to a random integer if the cast yields zero. In the two analyst data view templates (generic_simple.ctp and thread.ctp), the seed variable is similarly cast to an integer before use in inline script, replacing the previous logic that only checked for emptiness without type enforcement.", "patchTruncated": false, "patches": [{"commit": "58925dbf01c2fe5dfe9b2f61a421f6463f66ca56", "date": "Thu, 24 Sep 2026 18:06:24 +0200", "patchSha256": "7e384946a0fb4f1d43dee43a5374cabf2e70c31add4a6d2e4fa845cdc5ee5b37", "source": "https://github.com/MISP/MISP/commit/58925dbf0.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/58925dbf0.patch", "subject": "fix: [security] Cast the analyst data seed to an integer"}], "source": "https://github.com/MISP/MISP/commit/58925dbf0.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-01T08:49:54Z", "version": "2.0.3"}, "subject": "fix: [security] Cast the analyst data seed to an integer", "tagVersionBoundary": {"commits_after_fix": 32, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-79", "rationale": "The user-supplied seed parameter was reflected into inline JavaScript in the HTML response without sanitization or type coercion, allowing script injection. This is a textbook reflected XSS."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (58925dbf01c2fe5dfe9b2f61a421f6463f66ca56): fix: [security] Cast the analyst data seed to an integer", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/58925dbf0.patch"], "timestamp": "2026-09-24T16:06:24Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20241"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20241", "datePublished": "2026-10-01T08:55:43.692084Z", "dateUpdated": "2026-10-01T08:55:50.070131Z", "cveId": "CVE-2026-103664", "dateReserved": "2026-10-01T08:55:49.992Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["Taxonomies (add_tag", "disable_tag views)"], "product": "MISP", "programFiles": ["app/View/Taxonomies/add_tag.ctp", "app/View/Taxonomies/disable_tag.ctp"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "C\u00e9lien Desteucq of NCIA"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag).</p><p>The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site administrator to visit a crafted URL containing a malicious tag name parameter can execute arbitrary JavaScript in the administrator's browser session.</p><p>Preconditions:</p><p>- The target must be running a MISP instance with the legacy taxonomy tag confirmation views enabled.</p><p>- The victim must be an authenticated site administrator.</p><p>- The victim must navigate to the attacker-crafted URL (e.g., via a phishing link).</p><p>Security impact:</p><p>- Execution of arbitrary client-side script in the context of the administrator's browser.</p><p>- Potential theft of session tokens, CSRF tokens, or other sensitive data accessible from the page.</p><p>- Potential for performing privileged actions on behalf of the administrator within the MISP interface.</p><p>Affected versions: &lt;2.5.48.</p>"}], "value": "MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag).\n\nThe affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site administrator to visit a crafted URL containing a malicious tag name parameter can execute arbitrary JavaScript in the administrator's browser session.\n\nPreconditions:\n\n- The target must be running a MISP instance with the legacy taxonomy tag confirmation views enabled.\n\n- The victim must be an authenticated site administrator.\n\n- The victim must navigate to the attacker-crafted URL (e.g., via a phishing link).\n\nSecurity impact:\n\n- Execution of arbitrary client-side script in the context of the administrator's browser.\n\n- Potential theft of session tokens, CSRF tokens, or other sensitive data accessible from the page.\n\n- Potential for performing privileged actions on behalf of the administrator within the MISP interface.\n\nAffected versions: <2.5.48."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Reflected Cross-Site Scripting"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-01T08:34:46Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/9619083c8"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The vulnerability is remediated by HTML-encoding the user-supplied tag name value before it is interpolated into the confirmation form description text. This ensures that any HTML metacharacters in the input are rendered as inert text rather than executable markup, neutralizing the reflected XSS vector.</p>"}], "value": "The vulnerability is remediated by HTML-encoding the user-supplied tag name value before it is interpolated into the confirmation form description text. This ensures that any HTML metacharacters in the input are rendered as inert text rather than executable markup, neutralizing the reflected XSS vector."}], "title": "MISP Reflected XSS in Taxonomy Tag Confirmation Forms", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The tag v2.5.48 is assumed to be the first release containing the fix based on the tag_version_boundary metadata showing 44 commits after the fix commit; the exact release version that first shipped the fix is not explicitly stated.", "The vulnerability requires the legacy taxonomy tag confirmation views to be in use; if MISP has migrated to a different UI for taxonomy management, the attack surface may not be reachable.", "PR:N is assumed because the attacker does not need their own MISP account; they only need to deliver a crafted URL to an authenticated admin. If the form is only reachable via authenticated session and the parameter cannot be injected via URL for unauthenticated users, PR could be elevated.", "The Co-Authored-By line references an AI tool (Claude Opus 5.5); this is not credited as a human contributor per standard CVE credit practices.", "CAPEC-63 is selected as the closest match; the exact CAPEC taxonomy does not have a more specific entry for reflected XSS in server-rendered template engines."], "capecRationale": [{"capecId": "CAPEC-63", "rationale": "The commit message explicitly states the tag name is 'echoed from the URL unescaped, a reflected XSS.' The attacker supplies a malicious value via a URL parameter, the application reflects it into the HTML response without encoding, and the script executes in the victim's browser. This is a textbook reflected XSS pattern matching CAPEC-63 exactly."}], "commit": "9619083c8cea496fd3ddbad5bf9be57c91fd2118", "confidence": "high", "credits": [{"lang": "en", "type": "reporter", "value": "C\u00e9lien Desteucq of NCIA"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "cvssRationale": "AV:N - the vulnerability is exploitable over the network via a crafted URL. AC:L - no race conditions or special conditions; simply visiting a crafted URL triggers the XSS. AT:N - no attack target manipulation required. PR:N - the attacker does not need authentication; they craft a URL for the admin to visit. UI:A - the administrator must actively navigate to the malicious URL. VC:L - the XSS can read session cookies and page data in the admin's browser. VI:L - the XSS can perform actions on behalf of the admin within the MISP interface. VA:N - no availability impact. SC/SI/SA:N - the impact is confined to the victim's browser session; no secondary system impact is evidenced.", "fixSummary": "The vulnerability is remediated by HTML-encoding the user-supplied tag name value before it is interpolated into the confirmation form description text. This ensures that any HTML metacharacters in the input are rendered as inert text rather than executable markup, neutralizing the reflected XSS vector.", "generatedAt": "2026-10-01T08:34:46.777011Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 5, "confidence": "high", "model": "qwen3.8:27b", "score": 8}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "0255a5f82ee8c34e3f27c236a85f0dfc4379393d7e75c42d4d33fbc6d6b151ac", "patchSummary": "Two view template files (app/View/Taxonomies/add_tag.ctp and app/View/Taxonomies/disable_tag.ctp) are modified. In each file, the raw request data value $this->request->data['Taxonomy']['name'] is wrapped with CakePHP's h() HTML-encoding helper function before being passed to the translation string that renders the confirmation description. This is a one-line change per file, adding the h() wrapper around the previously unescaped variable.", "patchTruncated": false, "patches": [{"commit": "9619083c8cea496fd3ddbad5bf9be57c91fd2118", "date": "Wed, 23 Sep 2026 11:17:07 +0200", "patchSha256": "0255a5f82ee8c34e3f27c236a85f0dfc4379393d7e75c42d4d33fbc6d6b151ac", "source": "https://github.com/MISP/MISP/commit/9619083c8.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/9619083c8.patch", "subject": "fix: [security] Escape the tag name on the taxonomy tag"}], "source": "https://github.com/MISP/MISP/commit/9619083c8.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-01T08:34:46Z", "version": "2.0.3"}, "subject": "fix: [security] Escape the tag name on the taxonomy tag", "tagVersionBoundary": {"commits_after_fix": 44, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-79", "rationale": "The patch directly addresses a reflected XSS: user-controlled input from the request is echoed into HTML output without encoding. The fix applies HTML entity encoding (h() helper), which is the canonical remediation for CWE-79."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (9619083c8cea496fd3ddbad5bf9be57c91fd2118): fix: [security] Escape the tag name on the taxonomy tag", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/9619083c8.patch"], "timestamp": "2026-09-23T09:17:07Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20300"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20300", "datePublished": "2026-10-01T08:48:29.795091Z", "dateUpdated": "2026-10-01T08:48:36.628843Z", "cveId": "CVE-2026-103662", "dateReserved": "2026-10-01T08:48:36.324Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["Event model (app/Model/Event.php)"], "product": "MISP", "programFiles": ["app/Model/Event.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Wenhao Wu"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 4.8"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distribution and sharing-group access control check was not re-applied to those attributes.</p><p>As a result, a user who can view a community-distributed event could retrieve attributes belonging to organisation-only objects (distribution level 0) or objects restricted to a specific sharing group, even though the user's organisation does not have access to those objects. This constitutes an unauthorized disclosure of sensitive threat intelligence data.</p><p>A secondary issue was introduced by the initial remediation: the fix reused the full Object contain conditions (including soft-delete state) as the gate for flattened attributes, causing an event owner requesting deleted attributes to lose all attributes whose parent object was still live. The final fix isolates the distribution ACL condition as the sole gate.</p><p>Preconditions:</p><p>- An authenticated user with access to a community-distributed event</p><p>- The event contains at least one object with a distribution level or sharing group that restricts access beyond the event's own distribution</p><p>Impact:</p><p>- Unauthorized disclosure of attributes belonging to restricted objects</p><p>- Potential exposure of organisation-specific threat intelligence to other organisations</p><p>Affected versions: &lt;2.5.48</p>"}], "value": "MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distribution and sharing-group access control check was not re-applied to those attributes.\n\nAs a result, a user who can view a community-distributed event could retrieve attributes belonging to organisation-only objects (distribution level 0) or objects restricted to a specific sharing group, even though the user's organisation does not have access to those objects. This constitutes an unauthorized disclosure of sensitive threat intelligence data.\n\nA secondary issue was introduced by the initial remediation: the fix reused the full Object contain conditions (including soft-delete state) as the gate for flattened attributes, causing an event owner requesting deleted attributes to lose all attributes whose parent object was still live. The final fix isolates the distribution ACL condition as the sole gate.\n\nPreconditions:\n\n- An authenticated user with access to a community-distributed event\n\n- The event contains at least one object with a distribution level or sharing group that restricts access beyond the event's own distribution\n\nImpact:\n\n- Unauthorized disclosure of attributes belonging to restricted objects\n\n- Potential exposure of organisation-specific threat intelligence to other organisations\n\nAffected versions: <2.5.48"}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Exploiting Incorrectly Adjusted Privileges"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 7.1, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-01T08:10:59Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-285", "description": "CWE-285 Improper Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/ab08edf92"}, {"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/07f3486d5"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix re-applies the object distribution and sharing-group ACL as a subquery condition on the Attribute.object_id field whenever the flatten option is active. This ensures that attributes belonging to objects the caller is not authorized to see are excluded from the flattened result set. The second commit refines the gate to use only the distribution ACL condition (correlated on Object.id) rather than the entire Object contain, preventing soft-delete state from incorrectly filtering attributes for the event owner.</p>"}], "value": "The fix re-applies the object distribution and sharing-group ACL as a subquery condition on the Attribute.object_id field whenever the flatten option is active. This ensures that attributes belonging to objects the caller is not authorized to see are excluded from the flattened result set. The second commit refines the gate to use only the distribution ACL condition (correlated on Object.id) rather than the entire Object contain, preventing soft-delete state from incorrectly filtering attributes for the event owner."}], "title": "MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The affected version range is unspecified; the patch does not include version tags or release boundaries. All MISP versions prior to the fix commit are assumed affected.", "The CVSS PR:L assumes the attacker needs at minimum a read-access role on the community event; no evidence supports a lower or higher privilege requirement.", "The CAPEC-126 mapping is the closest available pattern; no CAPEC specifically describes a missing per-object ACL in a flattened API response. The mapping is approximate.", "The second commit (soft-delete fix) is treated as part of the same vulnerability remediation per the patch-set assumption, though it addresses a regression introduced by the first fix rather than the original authorization bypass.", "AI co-authors (Claude Opus 4.8, Claude Opus 5) are listed in commit metadata but are not included as advisory credits as they are tooling, not human contributors.", "No evidence of active exploitation, public PoC, or in-the-wild abuse was found in the supplied data."], "capecRationale": [{"capecId": "CAPEC-126", "rationale": "The attacker (a legitimate user with access to a community event) exploits the fact that the application's privilege/access-control enforcement is incorrectly adjusted during the flatten operation. The object-level ACL is not applied, effectively elevating the user's data access beyond their intended scope. This is the closest CAPEC pattern to an authorization bypass where the application fails to enforce a narrower access control in a specific code path. Uncertainty: no CAPEC pattern specifically describes 'missing per-object ACL in a flattened view'; CAPEC-126 is the best available match for privilege/access-control bypass."}], "commit": "07f3486d50f2a5ee0f31ea66c920692664397ddb", "confidence": "medium", "credits": [{"lang": "en", "type": "reporter", "value": "Wenhao Wu"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 4.8"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5"}], "cvssRationale": "AV:N - exploited over the network via the MISP REST API. AC:L - the attack is a simple API request with the flatten parameter; no race conditions or complex setup required. AT:N - no special target-side conditions beyond the existence of a community event with restricted objects. PR:L - requires an authenticated user with at least read access to the community event. UI:N - no user interaction needed; the API call is self-contained. VC:H - sensitive threat-intelligence attributes from organisation-only objects are fully exposed to unauthorized users. VI:N, VA:N - no integrity or availability impact on the vulnerable component. SC:N, SI:N, SA:N - no impact on subsequent components; the data resides within the same application.", "fixSummary": "The fix re-applies the object distribution and sharing-group ACL as a subquery condition on the Attribute.object_id field whenever the flatten option is active. This ensures that attributes belonging to objects the caller is not authorized to see are excluded from the flattened result set. The second commit refines the gate to use only the distribution ACL condition (correlated on Object.id) rather than the entire Object contain, preventing soft-delete state from incorrectly filtering attributes for the event owner.", "generatedAt": "2026-10-01T08:10:59.855811Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 6, "confidence": "medium", "model": "qwen3.8:27b", "score": 6}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "e74b42214be094a3c715d859dd20b9ecd7091d30a187ab4583a7ec0f070c0581", "patchSummary": "In app/Model/Event.php, two code paths were modified. In fetchPaginatedAttributes(), a new subquery is generated against the Object table using the distribution and sharing-group ACL conditions, and an OR condition is added to the attribute query: either Attribute.object_id = 0 (top-level attribute) or the attribute's object passes the ACL. In fetchEvent(), when flatten is true and the user is not a site admin, a similar subquery is injected into the Attribute contain conditions. The second commit refactors the ACL condition into a standalone variable ($objectAclCondition) and uses only that condition (plus Object.id = Attribute.object_id) in the subquery, removing the soft-delete and other contain conditions that were incorrectly included. A regression test class (FlattenedObjectAcl) in tests/testregressions.py verifies: (1) an outsider cannot see organisation-only object attributes via flatten, (2) the owner retains soft-deleted attributes of a live object, and (3) the outsider cannot see another org's soft", "patchTruncated": false, "patches": [{"commit": "ab08edf9256bb3c9c8a382e0778ecd10b9e29c7c", "date": "Wed, 23 Sep 2026 09:25:31 +0200", "patchSha256": "ebc10168f16d00a458d924a62fe76e00277217c8449c694eeb4442d6d3a724a0", "source": "https://github.com/MISP/MISP/commit/ab08edf92.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/ab08edf92.patch", "subject": "fix: [security] Apply the object ACL to flattened attributes"}, {"commit": "07f3486d50f2a5ee0f31ea66c920692664397ddb", "date": "Mon, 28 Sep 2026 13:41:23 +0200", "patchSha256": "18601512c29df510bfdc629de713cffd41af868e7d230374aa346c92829e40de", "source": "https://github.com/MISP/MISP/commit/07f3486d5.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/07f3486d5.patch", "subject": "fix: [event] Gate flattened attributes on the object ACL"}], "source": "patch set (2 sources)", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-01T08:10:59Z", "version": "2.0.3"}, "subject": "fix: [event] Gate flattened attributes on the object ACL", "weaknessRationale": [{"cweId": "CWE-862", "rationale": "The flattening code path removed the Object contain (which enforced distribution and sharing-group ACLs) without re-applying an equivalent authorization check on the resulting top-level attributes. The object-level access control was simply absent from the flattened query, allowing unauthorized data access."}, {"cweId": "CWE-285", "rationale": "The authorization decision for object attributes was based solely on the event-level distribution rather than the object-level distribution and sharing group. This is an improper authorization check that grants broader access than intended."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (ab08edf9256bb3c9c8a382e0778ecd10b9e29c7c): fix: [security] Apply the object ACL to flattened attributes", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/ab08edf92.patch"], "timestamp": "2026-09-23T07:25:31Z", "type": "fix-developed"}, {"description": "Corrective change authored (07f3486d50f2a5ee0f31ea66c920692664397ddb): fix: [event] Gate flattened attributes on the object ACL", "id": "evt-fix-developed-2", "references": ["https://github.com/MISP/MISP/commit/07f3486d5.patch"], "timestamp": "2026-09-28T11:41:23Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20257"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20257", "datePublished": "2026-10-01T08:32:55.873922Z", "dateUpdated": "2026-10-01T08:33:03.298255Z", "cveId": "CVE-2026-103659", "dateReserved": "2026-10-01T08:33:03.219Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["app/Controller/UsersController.php (otp method)"], "product": "MISP", "programFiles": ["app/Controller/UsersController.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Tanguy Snoeck of NCIA"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window.</p><p>The issue exists in the user login flow where a TOTP code is verified as a second authentication factor. Because the system did not record whether a given TOTP period had already been consumed, the same code remained valid for its entire time window (typically 30 seconds). An attacker who captures a legitimate code during a user's login could replay it to authenticate a second session as that user.</p><p>Preconditions:</p><p>- The target user has TOTP-based two-factor authentication enabled.</p><p>- The attacker is in a position to observe or intercept the TOTP code during a legitimate login (e.g., network-level interception, shoulder surfing, or a compromised client).</p><p>- The replay must occur within the TOTP validity period.</p><p>Security impact:</p><p>- Unauthorized account access by replaying a captured one-time code.</p><p>- Potential compromise of threat-intelligence data and administrative functions accessible to the targeted user.</p><p>Affected versions: &lt;v2.5.48.</p>"}], "value": "MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window.\n\nThe issue exists in the user login flow where a TOTP code is verified as a second authentication factor. Because the system did not record whether a given TOTP period had already been consumed, the same code remained valid for its entire time window (typically 30 seconds). An attacker who captures a legitimate code during a user's login could replay it to authenticate a second session as that user.\n\nPreconditions:\n\n- The target user has TOTP-based two-factor authentication enabled.\n\n- The attacker is in a position to observe or intercept the TOTP code during a legitimate login (e.g., network-level interception, shoulder surfing, or a compromised client).\n\n- The replay must occur within the TOTP validity period.\n\nSecurity impact:\n\n- Unauthorized account access by replaying a captured one-time code.\n\n- Potential compromise of threat-intelligence data and administrative functions accessible to the targeted user.\n\nAffected versions: <v2.5.48."}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Session Hijacking"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "Supplier", "timestamp": "2026-10-01T07:52:43Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-294", "description": "CWE-294 Authentication Bypass via Logical Flaw", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/a020fa47b"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix introduces a single-use enforcement mechanism for TOTP codes. Upon successful verification, the system records the TOTP period step in a Redis key scoped to the user and step number, using a SET-NX (set-if-not-exists) operation with a TTL of three times the TOTP period. Any subsequent attempt to authenticate with a code from the same period will fail the SET-NX check and be rejected, effectively making each TOTP code single-use within its validity window.</p>"}], "value": "The fix introduces a single-use enforcement mechanism for TOTP codes. Upon successful verification, the system records the TOTP period step in a Redis key scoped to the user and step number, using a SET-NX (set-if-not-exists) operation with a TTL of three times the TOTP period. Any subsequent attempt to authenticate with a code from the same period will fail the SET-NX check and be rejected, effectively making each TOTP code single-use within its validity window."}], "title": "MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The affected version range is inferred from the tag_version_boundary (v2.5.48, 40 commits after fix); the exact first affected version is not stated in the patch metadata and is recorded as unspecified.", "The TOTP validity period is assumed to be the standard 30 seconds based on the OTPHP library default; the patch does not hard-code a specific period value.", "The CAPEC-122 mapping is the closest available pattern; no CAPEC specifically addresses one-time-code replay, so the mapping carries uncertainty.", "CVSS AC is rated High because exploitation requires intercepting a valid TOTP code during a live login and replaying it within a short time window; if the attacker already possesses the code (e.g., via a compromised client), complexity would be lower.", "The Redis dependency for the fix is assumed to be available in the deployment; if Redis is unavailable, the fix's behavior is not specified in the patch.", "The Co-Authored-By line references an AI tool (Claude Opus 5.5); it is credited as a tool rather than a human remediation developer."], "capecRationale": [{"capecId": "CAPEC-122", "rationale": "The closest available CAPEC pattern is Session Hijacking, as the attacker gains unauthorized access to a user's authenticated session by replaying a captured credential (the TOTP code). The mapping is imperfect because the attack targets a one-time authentication token rather than a persistent session identifier, and the window is very short (one TOTP period). No CAPEC specifically covers one-time-code replay, so CAPEC-122 is the best available match."}], "commit": "a020fa47b6c3cb5b43d841afe2ccf149889fad6b", "confidence": "medium", "credits": [{"lang": "en", "type": "reporter", "value": "Tanguy Snoeck of NCIA"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "cvssRationale": "AV:N: the TOTP code is transmitted over the network during login. AC:H: exploitation requires the attacker to intercept a valid TOTP code during a legitimate login and replay it within the short validity window (typically 30 s), which is a non-trivial timing and positioning requirement. AT:N: no manipulation of the target system is needed. PR:N: the attacker is unauthenticated. UI:N: no user interaction beyond the victim's normal login is required. VC:H / VI:H: successful exploitation grants full access to the targeted user's account, including threat-intelligence data and administrative capabilities. VA:L: the attacker could disrupt services by modifying or deleting data. SC/SI/SA:N: no impact on secondary systems is evidenced.", "fixSummary": "The fix introduces a single-use enforcement mechanism for TOTP codes. Upon successful verification, the system records the TOTP period step in a Redis key scoped to the user and step number, using a SET-NX (set-if-not-exists) operation with a TTL of three times the TOTP period. Any subsequent attempt to authenticate with a code from the same period will fail the SET-NX check and be rejected, effectively making each TOTP code single-use within its validity window.", "generatedAt": "2026-10-01T07:52:44.000034Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 6, "confidence": "medium", "model": "qwen3.8:27b", "score": 6}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "6fce2d1f789e3b4c0cbb7b4d81079334f66f1707bb5422f49915393cab88143f", "patchSummary": "In app/Controller/UsersController.php, the otp() method was modified to capture the current timestamp and pass it to the TOTP verify call. A new private method __claimTotpStep() was added, which computes the TOTP step (intdiv of elapsed time over period), constructs a Redis key of the form misp:otp:totp_used:{userId}:{step}, and attempts a SET with NX and EX (3x period) flags via RedisTool. The login proceeds only if both the TOTP verification and the claim succeed. Thirteen lines added, one line modified.", "patchTruncated": false, "patches": [{"commit": "a020fa47b6c3cb5b43d841afe2ccf149889fad6b", "date": "Wed, 23 Sep 2026 16:24:44 +0200", "patchSha256": "6fce2d1f789e3b4c0cbb7b4d81079334f66f1707bb5422f49915393cab88143f", "source": "https://github.com/MISP/MISP/commit/a020fa47b.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/a020fa47b.patch", "subject": "fix: [security] Refuse a TOTP code that was already used to"}], "source": "https://github.com/MISP/MISP/commit/a020fa47b.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "Supplier", "timestamp": "2026-10-01T07:52:44Z", "version": "2.0.3"}, "subject": "fix: [security] Refuse a TOTP code that was already used to", "tagVersionBoundary": {"commits_after_fix": 40, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-294", "rationale": "The TOTP verification logic accepted the same code multiple times within its validity period because no state was tracked to mark a period as consumed. This is a logical flaw in the authentication mechanism that permits replay of a valid one-time credential, fitting CWE-294 more precisely than the broader CWE-287."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (a020fa47b6c3cb5b43d841afe2ccf149889fad6b): fix: [security] Refuse a TOTP code that was already used to", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/a020fa47b.patch"], "timestamp": "2026-09-23T14:24:44Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20194"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20194", "datePublished": "2026-10-01T08:08:43.998140Z", "dateUpdated": "2026-10-01T08:08:53.306604Z", "cveId": "CVE-2026-103655", "dateReserved": "2026-10-01T08:08:52.909Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["app/Controller/UsersController.php"], "product": "MISP", "programFiles": ["app/Controller/UsersController.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Tanguy Snoeck of NCIA"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token counter.</p><p>The HOTP verification logic compared the submitted token against a counter value that was cached in the user's session at the time the password was entered, rather than against the authoritative counter stored in the database. Because the session-cached counter is not updated after a token is successfully consumed, an attacker who holds a valid session (password already submitted) can reuse a previously burned HOTP token. The stale cached counter still matches the replayed token, granting a second successful authentication and effectively rewinding the counter state.</p><p>Preconditions:</p><p>- The target user has HOTP (paper token) second-factor authentication enabled.</p><p>- The attacker possesses a valid session in which the password step has already been completed (the OTP step is pending).</p><p>- The attacker has access to at least one HOTP token value (e.g., a paper token list).</p><p>Security impact:</p><p>- Bypass of the second authentication factor, allowing unauthorized access to a user's MISP account.</p><p>- Corruption of the HOTP counter state, potentially invalidating subsequent legitimate tokens or enabling further replays.</p><p>Affected versions: &lt;2.5.48.</p>"}], "value": "MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token counter.\n\nThe HOTP verification logic compared the submitted token against a counter value that was cached in the user's session at the time the password was entered, rather than against the authoritative counter stored in the database. Because the session-cached counter is not updated after a token is successfully consumed, an attacker who holds a valid session (password already submitted) can reuse a previously burned HOTP token. The stale cached counter still matches the replayed token, granting a second successful authentication and effectively rewinding the counter state.\n\nPreconditions:\n\n- The target user has HOTP (paper token) second-factor authentication enabled.\n\n- The attacker possesses a valid session in which the password step has already been completed (the OTP step is pending).\n\n- The attacker has access to at least one HOTP token value (e.g., a paper token list).\n\nSecurity impact:\n\n- Bypass of the second authentication factor, allowing unauthorized access to a user's MISP account.\n\n- Corruption of the HOTP counter state, potentially invalidating subsequent legitimate tokens or enabling further replays.\n\nAffected versions: <2.5.48."}], "impacts": [{"capecId": "CAPEC-111", "descriptions": [{"lang": "en", "value": "CAPEC-111 Race Condition"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 7.6, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "Supplier", "timestamp": "2026-10-01T07:22:27Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/f34aee2c7"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix replaces the session-cached HOTP counter lookup with a direct read of the authoritative counter from the database, performed under a Redis-based distributed lock scoped to the user. The token is verified against the current stored counter, the counter is incremented and persisted atomically within the locked section, and the lock is released in a finally block. Additionally, the cached OTP user session entry is deleted immediately after a successful login (for both TOTP and HOTP paths), preventing the stale session state from being reused.</p>"}], "value": "The fix replaces the session-cached HOTP counter lookup with a direct read of the authoritative counter from the database, performed under a Redis-based distributed lock scoped to the user. The token is verified against the current stored counter, the counter is incremented and persisted atomically within the locked section, and the lock is released in a finally block. Additionally, the cached OTP user session entry is deleted immediately after a successful login (for both TOTP and HOTP paths), preventing the stale session state from being reused."}], "title": "MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The tag_version_boundary metadata (v2.5.48, 41 commits after fix) is interpreted as the first release containing the fix; no explicit fixed_version or affected_version was provided in the metadata.", "The CAPEC-111 mapping is the closest available pattern; the vulnerability is specifically a stale-session-cache replay rather than a classic TOCTOU race, and no more precise CAPEC exists in the catalog.", "CVSS PR:L assumes the attacker already has a valid authenticated session (password step completed); if the threat model requires unauthenticated access, PR would be None but AC would remain High.", "The Redis lock is assumed to be available in the deployment; if Redis is not configured, the locking mechanism may be bypassed, though this is a deployment concern not reflected in the patch.", "The Co-Authored-By line references an AI assistant; it is recorded as a tool credit rather than a human remediation developer."], "capecRationale": [{"capecId": "CAPEC-111", "rationale": "The vulnerability is exploited by exploiting the time window between the session-cached counter being set (at password entry) and the token being consumed, allowing a replayed token to be validated against the stale value. CAPEC-111 (Race Condition) is the closest available CAPEC pattern; the attack is not a classic TOCTOU on a file or memory location but rather a stale-cache race on a shared counter, which falls under the broader race-condition category. No more specific CAPEC for session-cached credential state replay exists in the CAPEC catalog, so this is the best available match."}], "commit": "f34aee2c74e111fffd07e8ddde8e4843ccf998db", "confidence": "medium", "credits": [{"lang": "en", "type": "reporter", "value": "Tanguy Snoeck of NCIA"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "cvssRationale": "AV:N \u2013 MISP is a network-accessible web application. AC:H \u2013 exploitation requires a valid session with the password step already completed, possession of a valid HOTP token value, and the session must still hold the stale cached counter; multiple preconditions must align. AT:N \u2013 no manipulation of the target system is needed. PR:L \u2013 the attacker must be an authenticated user with a pending OTP session. UI:N \u2013 no additional user interaction is required beyond the initial login flow. VC:H \u2013 successful exploitation grants full access to the target user's MISP account and its data. VI:H \u2013 the attacker can perform any action the user is authorized to perform, and the counter corruption may affect subsequent legitimate authentication. VA:N \u2013 no denial-of-service impact is evident. SC/SI/SA:N \u2013 no secondary system impact is indicated by the patch.", "fixSummary": "The fix replaces the session-cached HOTP counter lookup with a direct read of the authoritative counter from the database, performed under a Redis-based distributed lock scoped to the user. The token is verified against the current stored counter, the counter is incremented and persisted atomically within the locked section, and the lock is released in a finally block. Additionally, the cached OTP user session entry is deleted immediately after a successful login (for both TOTP and HOTP paths), preventing the stale session state from being reused.", "generatedAt": "2026-10-01T07:22:27.568266Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 5, "confidence": "medium", "model": "qwen3.8:27b", "score": 7}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "9ec05e4a3d95b183604c7e89e3fbb93950ac4d23dfe478809b868b6dfe85bad6", "patchSummary": "In UsersController::otp(), the inline HOTP verification block (which used the session-cached $user['hotp_counter']) is replaced with a call to a new private method __consumeHotp(). This method acquires a Redis SETNX lock (misp:otp:hotp_lock:{userId}, 10 s TTL), re-fetches the user's totp secret and hotp_counter from the database, verifies the submitted OTP against the stored counter, increments and saves the counter, and releases the lock in a finally block. The otp_user session key is now deleted after both TOTP and HOTP successful login paths. Net change: +36 / -5 lines in app/Controller/UsersController.php.", "patchTruncated": false, "patches": [{"commit": "f34aee2c74e111fffd07e8ddde8e4843ccf998db", "date": "Wed, 23 Sep 2026 16:20:38 +0200", "patchSha256": "9ec05e4a3d95b183604c7e89e3fbb93950ac4d23dfe478809b868b6dfe85bad6", "source": "https://github.com/MISP/MISP/commit/f34aee2c7.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/f34aee2c7.patch", "subject": "fix: [security] Burn paper OTP tokens against the stored"}], "source": "https://github.com/MISP/MISP/commit/f34aee2c7.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "Supplier", "timestamp": "2026-10-01T07:22:27Z", "version": "2.0.3"}, "subject": "fix: [security] Burn paper OTP tokens against the stored", "tagVersionBoundary": {"commits_after_fix": 41, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-362", "rationale": "The HOTP counter is shared mutable state accessed without synchronization. The session-cached copy becomes stale relative to the database copy, and no lock is held during read-verify-increment, allowing a concurrent or replayed request to operate on the old value."}, {"cweId": "CWE-287", "rationale": "The OTP verification logic accepts a token that has already been consumed because it compares against a stale cached counter rather than the authoritative stored counter, effectively weakening the second-factor authentication check."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (f34aee2c74e111fffd07e8ddde8e4843ccf998db): fix: [security] Burn paper OTP tokens against the stored", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/f34aee2c7.patch"], "timestamp": "2026-09-23T14:20:38Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20307"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20307", "datePublished": "2026-10-01T07:24:12.952115Z", "dateUpdated": "2026-10-01T07:34:00.932644Z", "cveId": "CVE-2026-103651", "dateReserved": "2026-10-01T07:34:00.794Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["Galaxy model", "Correlation Graph (default theme)", "Correlation Graph (Overmind theme)", "Galaxy sync/import capture"], "product": "MISP", "programFiles": ["app/Model/Galaxy.php", "app/Lib/Tools/CorrelationGraphTool.php", "app/webroot/js/correlation-graph.js", "app/webroot/js/correlation-graphOvermind.js"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Fable 5.1"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored value was subsequently concatenated directly into HTML markup by the D3-based correlation graph rendering scripts (both the default and Overmind themes) using the .html() method.</p><p>A user holding the perm_galaxy_editor permission, which is granted to the stock User role, could store arbitrary HTML or JavaScript in the icon field. Any other user who opened the correlation graph of an event containing a cluster belonging to that galaxy would have the injected script executed in their browser session.</p><p>Impact:</p><p>- Arbitrary script execution in the context of the victim's MISP session</p><p>- Potential theft of session credentials, manipulation of displayed data, or initiation of actions on behalf of the victim</p><p>- Affects both the default and Overmind UI themes</p><p>Affected versions: &lt;2.5.48</p>"}], "value": "MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored value was subsequently concatenated directly into HTML markup by the D3-based correlation graph rendering scripts (both the default and Overmind themes) using the .html() method.\n\nA user holding the perm_galaxy_editor permission, which is granted to the stock User role, could store arbitrary HTML or JavaScript in the icon field. Any other user who opened the correlation graph of an event containing a cluster belonging to that galaxy would have the injected script executed in their browser session.\n\nImpact:\n\n- Arbitrary script execution in the context of the victim's MISP session\n\n- Potential theft of session credentials, manipulation of displayed data, or initiation of actions on behalf of the victim\n\n- Affects both the default and Overmind UI themes\n\nAffected versions: <2.5.48"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Cross Site Scripting"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.2, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/8ea5783dd"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The vulnerability is remediated by enforcing strict input validation on the galaxy icon field so that only valid Font Awesome icon names (lowercase alphanumeric characters and dashes) are accepted at write time. The sync/import capture path discards any icon value that does not conform. The correlation graph JSON generation falls back to a safe default icon for any previously stored invalid value. On the client side, both correlation graph scripts now set the icon as a CSS class attribute rather than injecting it as raw HTML, and apply an additional regex sanitization pass. The asset cache-busting version is incremented to ensure browsers load the corrected scripts.</p>"}], "value": "The vulnerability is remediated by enforcing strict input validation on the galaxy icon field so that only valid Font Awesome icon names (lowercase alphanumeric characters and dashes) are accepted at write time. The sync/import capture path discards any icon value that does not conform. The correlation graph JSON generation falls back to a safe default icon for any previously stored invalid value. On the client side, both correlation graph scripts now set the icon as a CSS class attribute rather than injecting it as raw HTML, and apply an additional regex sanitization pass. The asset cache-busting version is incremented to ensure browsers load the corrected scripts."}], "title": "MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The affected version boundary is inferred from the tag_version_boundary metadata indicating the fix commit precedes v2.5.48 by 20 commits; no explicit 'fixed in' version is stated in the patch itself.", "The perm_galaxy_editor permission is assumed to be granted to the stock User role as stated in the commit message; the exact role-permission mapping was not independently verified from the patch.", "CAPEC-1 is the closest available mapping; no CAPEC entry specifically describes stored XSS via a graph-rendering library data field, so the general Cross Site Scripting pattern is used.", "CVSS UI:A assumes the victim must navigate to the correlation graph view of a specific event; if the graph is auto-loaded on a commonly visited page, UI could be lowered to Passive.", "The Co-Authored-By line references an AI assistant (Claude Fable 5.1); it is recorded as a tool credit rather than a human remediation developer."], "capecRationale": [{"capecId": "CAPEC-1", "rationale": "The attack pattern is a stored XSS: an authenticated user with galaxy editor permission injects a script payload into a persistent data field (galaxy icon), which is later rendered unsanitized in another user's browser via the correlation graph. CAPEC-1 is the closest and most direct match. No more specific CAPEC entry for stored XSS via a data field rendered by a graphing library exists in the CAPEC catalog, so CAPEC-1 is the best available mapping."}], "commit": "8ea5783ddcfe69be6013337a0d6732ac75a862e6", "confidence": "high", "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Fable 5.1"}, {"lang": "en", "type": "tool", "value": "Claude Fable 5.1"}], "cvssRationale": "AV:N: exploited over the network via the MISP web interface. AC:L: no race conditions or special timing; simply set the icon field and wait for a victim to view the graph. AT:N: no manipulation of the attack target required. PR:L: requires an authenticated user with perm_galaxy_editor, which is the default stock User role. UI:A: the victim must actively open the correlation graph of an event containing the affected galaxy cluster. VC/VI/VA:N: the server-side application is not directly compromised; the impact is on the victim's browser session. SC:H: script execution in the victim's session can read cookies, tokens, and sensitive page data. SI:H: the attacker can modify the victim's view, inject content, or trigger actions. SA:N: no availability impact on the system.", "fixSummary": "The vulnerability is remediated by enforcing strict input validation on the galaxy icon field so that only valid Font Awesome icon names (lowercase alphanumeric characters and dashes) are accepted at write time. The sync/import capture path discards any icon value that does not conform. The correlation graph JSON generation falls back to a safe default icon for any previously stored invalid value. On the client side, both correlation graph scripts now set the icon as a CSS class attribute rather than injecting it as raw HTML, and apply an additional regex sanitization pass. The asset cache-busting version is incremented to ensure browsers load the corrected scripts.", "generatedAt": "2026-09-30T14:24:01.890608Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 9, "assumptionCount": 5, "confidence": "high", "model": "qwen3.8:27b", "score": 6}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "382869c811e8df5875a463c4b6275f754f4969445196f08d708cfee926528b0f", "patchSummary": "Added a static isValidIconName() method and a regex constant (ICON_NAME_PATTERN) to the Galaxy model, plus a model-level validation rule restricting the icon field to lowercase letters, digits, and dashes. The captureGalaxy() method now blanks out any icon value that fails validation before persistence. CorrelationGraphTool::__createNode() now checks the icon against the validator and substitutes 'globe' for invalid stored values. Both correlation-graph.js and correlation-graphOvermind.js were changed from .html() string concatenation to .attr('class', ...) with a regex strip of non-conforming characters. AppController asset query version bumped from 225 to 226. A new PHPUnit test file (GalaxyIconNameTest.php) validates the icon name rule against known-good and known-bad payloads including the originally reported XSS vector.", "patchTruncated": false, "patches": [{"commit": "8ea5783ddcfe69be6013337a0d6732ac75a862e6", "patchSha256": "382869c811e8df5875a463c4b6275f754f4969445196f08d708cfee926528b0f", "source": "https://github.com/MISP/MISP/commit/8ea5783dd.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/8ea5783dd.patch", "subject": "fix: [security] Galaxy icons are icon names, and the"}], "source": "https://github.com/MISP/MISP/commit/8ea5783dd.patch", "subject": "fix: [security] Galaxy icons are icon names, and the", "tagVersionBoundary": {"commits_after_fix": 20, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-79", "rationale": "The galaxy icon field was stored without validation and later rendered into the DOM via D3 .html(), allowing an attacker to inject and execute arbitrary script in the victim's browser. This is a textbook stored XSS."}, {"cweId": "CWE-20", "rationale": "The root enabler is the absence of any server-side validation on the icon field at write time (add, edit, capture). The field accepted arbitrary strings including HTML markup, which was the precondition for the XSS."}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20142"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20142", "datePublished": "2026-09-30T14:25:50.603841Z", "dateUpdated": "2026-09-30T14:25:57.591909Z", "cveId": "CVE-2026-103389", "dateReserved": "2026-09-30T14:25:56.802Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["GalaxyClusters view (default theme)", "GalaxyClusters view (Overmind theme)"], "product": "MISP", "programFiles": ["app/View/GalaxyClusters/view.ctp", "app/View/Themed/Overmind/Elements/GalaxyClusters/View/galaxy_clusters_general.ctp"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source.</p><p>When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim's browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim.</p><p>Preconditions:</p><p>- Attacker must hold galaxy editor privileges (local or via sync).</p><p>- Victim must view the affected cluster and click the malicious link.</p><p>Impact:</p><p>- Stored cross-site scripting (XSS) in the victim's browser.</p><p>- Potential session theft, credential harvesting, or unauthorized actions within the MISP application.</p><p>Affected: &lt;2.5.48.</p>"}], "value": "MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source.\n\nWhen another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim's browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim.\n\nPreconditions:\n\n- Attacker must hold galaxy editor privileges (local or via sync).\n\n- Victim must view the affected cluster and click the malicious link.\n\nImpact:\n\n- Stored cross-site scripting (XSS) in the victim's browser.\n\n- Potential session theft, credential harvesting, or unauthorized actions within the MISP application.\n\nAffected: <2.5.48."}], "impacts": [{"capecId": "CAPEC-64", "descriptions": [{"lang": "en", "value": "CAPEC-64 XSS - Persistent"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.2, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input in Web Page ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/118528767"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix restricts the rendering of the Galaxy Cluster source field as a hyperlink to only http:// and https:// URLs by adding a regular-expression check (preg_match for ^https?://) in addition to the existing FILTER_VALIDATE_URL validation. This prevents javascript: and other non-HTTP URI schemes from being rendered as clickable links, eliminating the stored XSS vector. The change is applied consistently in both the default theme and the Overmind theme.</p>"}], "value": "The fix restricts the rendering of the Galaxy Cluster source field as a hyperlink to only http:// and https:// URLs by adding a regular-expression check (preg_match for ^https?://) in addition to the existing FILTER_VALIDATE_URL validation. This prevents javascript: and other non-HTTP URI schemes from being rendered as clickable links, eliminating the stored XSS vector. The change is applied consistently in both the default theme and the Overmind theme."}], "title": "MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 26 commits after fix); the exact first affected release is not stated in the patch.", "PR:L assumes galaxy editor privileges are a non-admin, role-based permission; the exact privilege model is not detailed in the patch.", "UI:A assumes the victim must actively click the rendered link; passive rendering without click does not execute the script.", "The CAPEC-64 mapping is the closest available pattern for stored XSS; no CAPEC specifically covers URI-scheme-based stored XSS, so CAPEC-64 is the best fit.", "The Co-Authored-By line references an AI assistant; it is credited as a tool rather than a human remediation developer."], "capecRationale": [{"capecId": "CAPEC-64", "rationale": "The attack pattern involves storing a malicious payload (a javascript: URL) in a persistent data field (galaxy cluster source) that is later rendered in a web page, executing script in the victim's browser upon interaction. This is a textbook persistent/stored XSS. CAPEC-64 is the closest and most precise match in the CAPEC catalog."}], "commit": "11852876773554d79ff57937a235d18a1e4473dc", "confidence": "high", "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "cvssRationale": "AV:N \u2013 MISP is a web application accessed over the network. AC:L \u2013 no race conditions or special environment needed; storing a javascript: URL is straightforward. AT:N \u2013 no manipulation of the attack target required. PR:L \u2013 attacker needs galaxy editor privileges (authenticated, non-admin role). UI:A \u2013 victim must click the malicious link for script execution. VC/VI/VA:N \u2013 the MISP server itself is not directly compromised; impact is on the victim's browser. SC:H \u2013 attacker can read cookies, session tokens, and manipulate the DOM in the victim's session. SI:H \u2013 attacker can perform actions on behalf of the victim within MISP. SA:N \u2013 no direct compromise of the application's security controls or system integrity.", "fixSummary": "The fix restricts the rendering of the Galaxy Cluster source field as a hyperlink to only http:// and https:// URLs by adding a regular-expression check (preg_match for ^https?://) in addition to the existing FILTER_VALIDATE_URL validation. This prevents javascript: and other non-HTTP URI schemes from being rendered as clickable links, eliminating the stored XSS vector. The change is applied consistently in both the default theme and the Overmind theme.", "generatedAt": "2026-09-30T14:12:32.112077Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 9, "assumptionCount": 5, "confidence": "high", "model": "qwen3.8:27b", "score": 6}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "b68dbd6726929ff1680daeae2a273fc346e7075d7ded36195994315c19ccf278", "patchSummary": "Two view templates are modified. In app/View/GalaxyClusters/view.ctp, the source value is extracted into a local variable and the conditional for rendering an anchor tag now requires both FILTER_VALIDATE_URL and a preg_match against /^https?:\\/\\//i. In app/View/Themed/Overmind/Elements/GalaxyClusters/View/galaxy_clusters_general.ctp, the same preg_match guard is added to the existing FILTER_VALIDATE_URL check. Net effect: only http(s) URLs produce a clickable link; all other values (including javascript:) are rendered as plain escaped text.", "patchTruncated": false, "patches": [{"commit": "11852876773554d79ff57937a235d18a1e4473dc", "patchSha256": "b68dbd6726929ff1680daeae2a273fc346e7075d7ded36195994315c19ccf278", "source": "https://github.com/MISP/MISP/commit/118528767.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/118528767.patch", "subject": "fix: [security] Link a galaxy cluster source only when it is"}], "source": "https://github.com/MISP/MISP/commit/118528767.patch", "subject": "fix: [security] Link a galaxy cluster source only when it is", "tagVersionBoundary": {"commits_after_fix": 26, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-79", "rationale": "The application renders user-controlled data (the galaxy cluster source field) into an HTML anchor tag without restricting the URI scheme to safe values. Although output is HTML-escaped via h(), the href attribute still accepts javascript: URIs, resulting in stored XSS. CWE-79 is the narrowest defensible mapping."}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20256"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20256", "datePublished": "2026-09-30T14:22:25.402175Z", "dateUpdated": "2026-09-30T14:22:33.037624Z", "cveId": "CVE-2026-103388", "dateReserved": "2026-09-30T14:22:32.098Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["EventGraph model", "event-graph.js client-side rendering"], "product": "MISP", "programFiles": ["app/Model/EventGraph.php", "app/webroot/js/event-graph.js"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Bastien Bossiroy of NCIA"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 4.8"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature.</p><p>The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string concatenation, allowing a crafted value to break out of the attribute context and inject arbitrary script.</p><p>Preconditions:</p><p>- An authenticated MISP user with the ability to create or modify an event graph entry.</p><p>- A second user (the victim) who views the event graph and triggers the preview popover.</p><p>Impact:</p><p>- Execution of arbitrary JavaScript in the victim's browser within the MISP application context.</p><p>- Potential theft of session tokens, cookies, or sensitive data accessible to the victim's browser.</p><p>- Potential for performing actions on behalf of the victim within the MISP application.</p><p>Affected: MISP versions prior to the fix (commit applied after v2.5.48).</p>"}], "value": "MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature.\n\nThe event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string concatenation, allowing a crafted value to break out of the attribute context and inject arbitrary script.\n\nPreconditions:\n\n- An authenticated MISP user with the ability to create or modify an event graph entry.\n\n- A second user (the victim) who views the event graph and triggers the preview popover.\n\nImpact:\n\n- Execution of arbitrary JavaScript in the victim's browser within the MISP application context.\n\n- Potential theft of session tokens, cookies, or sensitive data accessible to the victim's browser.\n\n- Potential for performing actions on behalf of the victim within the MISP application.\n\nAffected: MISP versions prior to the fix (commit applied after v2.5.48)."}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Cross Site Scripting (XSS)"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.3, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/92c7ccc43"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The vulnerability is remediated by enforcing strict server-side validation of the preview image field, restricting it to a well-formed base64-encoded PNG data URL, and by replacing the client-side string-concatenation rendering with DOM-based attribute assignment that does not interpret the value as HTML.</p>"}], "value": "The vulnerability is remediated by enforcing strict server-side validation of the preview image field, restricting it to a well-formed base64-encoded PNG data URL, and by replacing the client-side string-concatenation rendering with DOM-based attribute assignment that does not interpret the value as HTML."}], "title": "MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The affected version range is inferred from the tag_version_boundary (v2.5.48 with 43 commits after the fix); the exact fixed release version is not stated in the patch metadata.", "PR:L assumes the attacker needs at least a basic authenticated MISP account to create or modify an event graph entry; the patch does not specify the exact permission level required.", "UI:P assumes the victim triggers the XSS by viewing the event graph preview as part of normal workflow (hovering the plot button), which is a passive interaction rather than an active click on a crafted link.", "The CAPEC-1 mapping is direct and unambiguous given the explicit stored XSS identification in the commit message.", "The Co-Authored-By line referencing Claude Opus 4.8 is treated as a tool credit per the commit metadata; it is not a human contributor."], "capecRationale": [{"capecId": "CAPEC-1", "rationale": "The patch directly addresses a stored XSS where attacker-controlled data is rendered into a web page without proper encoding or validation. CAPEC-1 is the canonical attack pattern for XSS and is the closest match. No uncertainty in this mapping; the commit message explicitly identifies the issue as stored XSS."}], "commit": "92c7ccc4398a64e61699bd79fb4010703616fc59", "confidence": "high", "credits": [{"lang": "en", "type": "reporter", "value": "Bastien Bossiroy of NCIA"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 4.8"}], "cvssRationale": "AV:N: exploited over the network via the MISP web interface. AC:L: no race conditions or special conditions required; storing a crafted value and viewing the graph is straightforward. AT:N: no manipulation of the attack target needed. PR:L: attacker needs a low-privilege authenticated MISP account to create/modify an event graph. UI:P: the victim passively triggers the XSS by viewing the event graph preview (hovering a button), a normal workflow action. VC/VI/VA:N: the MISP server itself is not compromised; the impact is in the victim's browser. SC:H: the attacker can read cookies, tokens, and data in the victim's session. SI:H: the attacker can perform authenticated actions as the victim. SA:N: no availability impact on the victim's system.", "fixSummary": "The vulnerability is remediated by enforcing strict server-side validation of the preview image field, restricting it to a well-formed base64-encoded PNG data URL, and by replacing the client-side string-concatenation rendering with DOM-based attribute assignment that does not interpret the value as HTML.", "generatedAt": "2026-09-30T11:21:27.655462Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 9, "assumptionCount": 5, "confidence": "high", "model": "qwen3.8:27b", "score": 6}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "0ecb893de30056bc3f9609fcb8de43d60b1cedd6a1eea7d6aa53ef6d351d642a", "patchSummary": "In app/Model/EventGraph.php, a new validation rule is added for the preview_img field requiring it to match the regex /^data:image\\/png;base64,[A-Za-z0-9+\\/]*={0,2}$/ (allowing empty). In app/webroot/js/event-graph.js, two occurrences of string-concatenated img tag construction (return '<img ... src=\"' + value + '\" />') are replaced with jQuery DOM construction using $('<img ...>').prop('src', value), which sets the attribute safely without HTML parsing.", "patchTruncated": false, "patches": [{"commit": "92c7ccc4398a64e61699bd79fb4010703616fc59", "patchSha256": "0ecb893de30056bc3f9609fcb8de43d60b1cedd6a1eea7d6aa53ef6d351d642a", "source": "https://github.com/MISP/MISP/commit/92c7ccc43.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/92c7ccc43.patch", "subject": "fix: [security] Validate the event graph preview and stop"}], "source": "https://github.com/MISP/MISP/commit/92c7ccc43.patch", "subject": "fix: [security] Validate the event graph preview and stop", "tagVersionBoundary": {"commits_after_fix": 43, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-79", "rationale": "The stored preview_img value was rendered into an HTML attribute via string concatenation without sufficient neutralization, enabling script injection in the victim's browser. This is a textbook stored XSS."}, {"cweId": "CWE-20", "rationale": "The server accepted and persisted the preview_img field without any format validation, allowing arbitrary content to be stored and later rendered. The fix adds a strict regex validation rule."}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20294"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20294", "datePublished": "2026-09-30T12:18:47.503336Z", "dateUpdated": "2026-09-30T12:18:55.326462Z", "cveId": "CVE-2026-103321", "dateReserved": "2026-09-30T12:18:54.232Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["TagCollectionsController"], "product": "MISP", "programFiles": ["app/Controller/TagCollectionsController.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 4.8"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any associated model data present in the payload.</p><p>A user holding the tag editor permission could craft a request that includes additional model data (such as User or Organisation records) alongside the tag collection fields. Because the save operation processed all associated models indiscriminately, the injected sibling records were written to the database, enabling the attacker to modify or create privileged accounts and escalate to site administrator.</p><p>Preconditions:</p><p>- An authenticated account with the tag editor permission (perm_tag_editor)</p><p>- Network access to the MISP instance</p><p>Impact:</p><p>- Unauthorized creation or modification of User and Organisation records</p><p>- Privilege escalation from tag editor to site administrator</p><p>Affected versions: &lt; 2.5.48</p>"}], "value": "MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any associated model data present in the payload.\n\nA user holding the tag editor permission could craft a request that includes additional model data (such as User or Organisation records) alongside the tag collection fields. Because the save operation processed all associated models indiscriminately, the injected sibling records were written to the database, enabling the attacker to modify or create privileged accounts and escalate to site administrator.\n\nPreconditions:\n\n- An authenticated account with the tag editor permission (perm_tag_editor)\n\n- Network access to the MISP instance\n\nImpact:\n\n- Unauthorized creation or modification of User and Organisation records\n\n- Privilege escalation from tag editor to site administrator\n\nAffected versions: < 2.5.48"}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Parameter Tampering"}]}, {"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Improper Input Validation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.6, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/96f735e7b"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix replaces the bulk-association save call with an explicit two-step process: first, only the TagCollection data is extracted from the request and saved via a plain save() operation that does not write belongsTo siblings; second, tag association rows are persisted individually in a controlled loop. This ensures that any User, Organisation, or other sibling model data present in the request payload is silently discarded and never reaches the database, eliminating the privilege escalation path.</p>"}], "value": "The fix replaces the bulk-association save call with an explicit two-step process: first, only the TagCollection data is extracted from the request and saved via a plain save() operation that does not write belongsTo siblings; second, tag association rows are persisted individually in a controlled loop. This ensures that any User, Organisation, or other sibling model data present in the request payload is silently discarded and never reaches the database, eliminating the privilege escalation path."}], "title": "MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48 with 24 commits after fix), suggesting the fix is included in v2.5.48. No explicit version range is stated in the patch itself.", "The privilege level required is assumed to be 'perm_tag_editor' based on the commit message; the exact permission model and whether other roles are affected is not fully verifiable from the patch alone.", "CAPEC-126 (Parameter Tampering) is selected as the closest match; the attack is more precisely a mass-assignment / sibling-model injection via an ORM bulk-save, for which no exact CAPEC exists. CAPEC-126 is the best available approximation.", "The CVSS assumes the attacker can reach the MISP web interface over the network and holds a valid session with tag editor permissions. No multi-step or race-condition requirements are evident.", "The Co-Authored-By line references an AI assistant (Claude Opus 4.8); it is credited as a tool rather than a human remediation developer."], "capecRationale": [{"capecId": "CAPEC-126", "rationale": "The attacker tampers with the HTTP request by injecting additional model fields (User, Organisation) into the tag collection payload. The application's bulk-save logic processes these unexpected parameters without filtering, leading to unauthorized record creation or modification. This is the closest CAPEC to the observed attack: adding extra parameters to a legitimate request to trigger unintended side effects."}, {"capecId": "CAPEC-1", "rationale": "The application accepted the entire request body without validating or restricting which model keys were present before passing it to the persistence layer. This is a secondary mapping; CAPEC-126 is more specific to the parameter-injection attack vector observed here."}], "commit": "96f735e7b5d9e28ea2eaf3d8a02ab800bad5c9ed", "confidence": "high", "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 4.8"}], "cvssRationale": "The vulnerability is exploitable over the network (AV:N) with low complexity (AC:L) by simply adding extra fields to a legitimate tag collection request. No special attack conditions are required (AT:N). The attacker needs an authenticated account with the tag editor permission (PR:L). No user interaction is needed (UI:N). The primary impact is on integrity (VI:H) because the attacker can create or modify User and Organisation records to escalate to site admin. Modifications can be made so data can be see (VC:H) but no availability impact (VA:N). No subsequent component is affected (SC:N, SI:N, SA:N).", "fixSummary": "The fix replaces the bulk-association save call with an explicit two-step process: first, only the TagCollection data is extracted from the request and saved via a plain save() operation that does not write belongsTo siblings; second, tag association rows are persisted individually in a controlled loop. This ensures that any User, Organisation, or other sibling model data present in the request payload is silently discarded and never reaches the database, eliminating the privilege escalation path.", "generatedAt": "2026-09-30T09:58:24.508004Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 9, "assumptionCount": 5, "confidence": "high", "model": "qwen3.8:27b", "score": 6}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "67f9b5741b88384cd891423b2a8b9f5c8e071b5895b93eb337a16c7f780ee88c", "patchSummary": "In TagCollectionsController.php, both addWithTags() and editWithTags() were modified. The full $this->request->data is no longer passed to saveAssociated(). Instead, only the TagCollection key is extracted from the request. The saveAssociated() call is replaced with a plain save() for the collection, followed by an explicit loop that creates and saves each TagCollectionTag row individually. In editWithTags(), the tag rewrite logic is restructured to delete existing tag associations and re-insert them after the collection save. REST success/failure response handling is added to both methods.", "patchTruncated": false, "patches": [{"commit": "96f735e7b5d9e28ea2eaf3d8a02ab800bad5c9ed", "patchSha256": "67f9b5741b88384cd891423b2a8b9f5c8e071b5895b93eb337a16c7f780ee88c", "source": "https://github.com/MISP/MISP/commit/96f735e7b.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/96f735e7b.patch", "subject": "fix: [security] Tag collection saves no longer write sibling"}], "source": "https://github.com/MISP/MISP/commit/96f735e7b.patch", "subject": "fix: [security] Tag collection saves no longer write sibling", "tagVersionBoundary": {"commits_after_fix": 24, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-284", "rationale": "A user with only tag editor permissions was able to write to User and Organisation records through the bulk-association save, bypassing the intended access control boundaries. The authorization model did not restrict which associated models could be persisted."}, {"cweId": "CWE-862", "rationale": "The saveAssociated() call did not enforce per-model authorization checks, allowing any associated model data in the payload to be written regardless of the caller's permissions for those models."}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20019"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20019", "datePublished": "2026-09-30T10:16:09.364718Z", "dateUpdated": "2026-09-30T10:16:16.553111Z", "cveId": "CVE-2026-103239", "dateReserved": "2026-09-30T10:16:15.941Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["AttributesController", "EventReportsController", "EventsController", "ObjectReferencesController", "ShadowAttributesController", "UsersController", "AppModel", "Event model", "MispAttribute model", "MispObject model", "ShadowAttribute model", "Sighting model"], "product": "MISP", "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints (attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit), the application sanitizes the flat record by stripping the primary key and pinning the event_id or object_id to the caller's context. However, the underlying ORM's set() method gives priority to a nested key whose name matches the model alias and discards the outer scalar fields.</p><p>An authenticated user with basic write permissions can exploit this by embedding a nested block under the model alias key inside their request. The sanitization logic (id removal, event_id pinning) is applied to the outer record, but the ORM binds to the inner record instead, which carries an attacker-chosen id and event_id. This allows the attacker to overwrite, re-parent, or soft-delete rows belonging to other organizations or events they have no read access to.</p><p>Impact:</p><p>- Cross-tenant data integrity compromise (attribute values rewritten, objects re-parented to attacker events, rows soft-deleted)</p><p>- Affects multiple entity types: Attribute, Object, EventReport, Sighting, AttributeTag, ShadowAttribute</p><p>- Requires only a low-privilege authenticated account with perm_add</p><p>Affected versions: &lt;2.5.48</p>"}], "value": "MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints (attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit), the application sanitizes the flat record by stripping the primary key and pinning the event_id or object_id to the caller's context. However, the underlying ORM's set() method gives priority to a nested key whose name matches the model alias and discards the outer scalar fields.\n\nAn authenticated user with basic write permissions can exploit this by embedding a nested block under the model alias key inside their request. The sanitization logic (id removal, event_id pinning) is applied to the outer record, but the ORM binds to the inner record instead, which carries an attacker-chosen id and event_id. This allows the attacker to overwrite, re-parent, or soft-delete rows belonging to other organizations or events they have no read access to.\n\nImpact:\n\n- Cross-tenant data integrity compromise (attribute values rewritten, objects re-parented to attacker events, rows soft-deleted)\n\n- Affects multiple entity types: Attribute, Object, EventReport, Sighting, AttributeTag, ShadowAttribute\n\n- Requires only a low-privilege authenticated account with perm_add\n\nAffected versions: <2.5.48"}], "impacts": [{"capecId": "CAPEC-24", "descriptions": [{"lang": "en", "value": "CAPEC-24 Parameter Tampering"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.3, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/9485ae40d"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix introduces a defensive save() override in the base model class that refuses to persist any record where the data array simultaneously contains a nested key matching the model alias and other top-level scalar fields, logging a warning and returning false. Additionally, all code paths that sanitize and save records (free-text import, module result processing, object delta merge, attribute bulk edit, sighting capture, shadow attribute proposal, event report creation) now explicitly unset the nested alias key from the data array before calling save(), ensuring the ORM cannot be redirected to an attacker-chosen row. Controller-level request reshaping was also corrected to avoid creating self-referencing data structures.</p>"}], "value": "The fix introduces a defensive save() override in the base model class that refuses to persist any record where the data array simultaneously contains a nested key matching the model alias and other top-level scalar fields, logging a warning and returning false. Additionally, all code paths that sanitize and save records (free-text import, module result processing, object delta merge, attribute bulk edit, sighting capture, shadow attribute proposal, event report creation) now explicitly unset the nested alias key from the data array before calling save(), ensuring the ORM cannot be redirected to an attacker-chosen row. Controller-level request reshaping was also corrected to avoid creating self-referencing data structures."}], "title": "MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48); the exact last affected release and first fixed release are not explicitly stated in the patch.", "PR:L assumes the attacker needs only a basic authenticated account with perm_add; the regression tests confirm a non-admin, non-sync role suffices, but the minimum permission set is not exhaustively enumerated in the patch.", "VA:N assumes soft-delete is treated as an integrity impact (data state change) rather than an availability impact; if the organization considers soft-deleted records as unavailable, VA could be raised to L.", "CAPEC-24 (Parameter Tampering) is the closest available pattern; the specific ORM-level key-binding manipulation does not have a dedicated CAPEC entry, so the mapping is approximate.", "The Co-Authored-By line references an AI tool (Claude Opus 5); it is listed as a tool credit, not a human remediation developer, per CVE credit role semantics.", "The commit date is 2026-09-25; the vulnerability may have existed for an unknown duration prior to reporting."], "capecRationale": [{"capecId": "CAPEC-24", "rationale": "The attacker tampers with the structure of request parameters by injecting a nested key matching the model alias, causing the ORM to target a different row than the application intended. The outer parameters (sanitized id, pinned event_id) are effectively ignored in favor of the attacker-controlled inner parameters. This is a structural parameter tampering attack exploiting the ORM's data-binding semantics. The mapping is the closest available CAPEC; no more specific pattern for ORM-level key injection exists in the CAPEC catalog."}], "commit": "9485ae40d334471882e3bd246651acaa68feef34", "confidence": "high", "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5"}], "cvssRationale": "AV:N - MISP is a network-accessible web application. AC:L - The attack requires only crafting a request with a nested alias key; no race condition or complex state is needed. AT:N - No in-transit tampering required. PR:L - An authenticated user with basic write permission (perm_add) suffices; no admin or sync role needed. UI:N - No victim interaction required. VC:N - The attacker does not gain new read access; the impact is on data they can already partially see or infer. VI:H - The attacker can overwrite, re-parent, or soft-delete rows in the same instance, causing high integrity loss to the vulnerable component's data. VA:N - Soft-delete is a state change (integrity) rather than a service disruption. SC:N - No impact on separate components' confidentiality. SI:H - The cross-tenant nature means integrity of other organizations' data (a separate security scope) is compromised. SA:N - No security mechanism is weakened.", "fixSummary": "The fix introduces a defensive save() override in the base model class that refuses to persist any record where the data array simultaneously contains a nested key matching the model alias and other top-level scalar fields, logging a warning and returning false. Additionally, all code paths that sanitize and save records (free-text import, module result processing, object delta merge, attribute bulk edit, sighting capture, shadow attribute proposal, event report creation) now explicitly unset the nested alias key from the data array before calling save(), ensuring the ORM cannot be redirected to an attacker-chosen row. Controller-level request reshaping was also corrected to avoid creating self-referencing data structures.", "generatedAt": "2026-09-30T09:24:37.816321Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 9, "assumptionCount": 6, "confidence": "high", "model": "qwen3.8:27b", "score": 5}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "03af388a5ac0d93cebef902e0050aa8496aae8d88d1496b80abc0b9a929cb39a", "patchSummary": "Added a save() override in AppModel.php that detects and rejects ambiguous payloads containing both a nested model-alias key and outer scalars. Added unset($data[$this->alias]) calls in Event.php (free-text, module results, object attribute save), MispAttribute.php (saveAttributes, captureAttribute, editAttributeBulk), MispObject.php (deltaMerge, editObject), ShadowAttribute.php (__preCaptureMassage), and Sighting.php (captureSightings) to strip the nested alias key before save. Changed six controller files to use $this->request->data = array('Model' => $this->request->data) instead of $this->request->data['Model'] = $this->request->data, preventing self-referencing structures. Added a new regression test suite (tests/testregressions.py) with cross-tenant attack scenarios and wired it into the CI workflow.", "patchTruncated": false, "patches": [{"commit": "9485ae40d334471882e3bd246651acaa68feef34", "patchSha256": "03af388a5ac0d93cebef902e0050aa8496aae8d88d1496b80abc0b9a929cb39a", "source": "https://github.com/MISP/MISP/commit/9485ae40d.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/9485ae40d.patch", "subject": "fix: [security] A nested model alias key no longer selects"}], "source": "https://github.com/MISP/MISP/commit/9485ae40d.patch", "subject": "fix: [security] A nested model alias key no longer selects", "tagVersionBoundary": {"commits_after_fix": 23, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-639", "rationale": "The attacker controls the row identifier (id) inside the nested alias block, which the ORM uses to select the target row. The application's authorization and sanitization (id stripping, event_id pinning) is applied to the outer record and is bypassed because the ORM binds to the inner record. This is a direct case of a user-controlled key selecting an unauthorized resource."}, {"cweId": "CWE-20", "rationale": "The application fails to validate or strip the nested model-alias key from user-supplied data before passing it to the ORM. The ORM's set() method interprets this key as the record to save, contradicting the application's intent. The absence of validation on this structural aspect of the input is the root cause."}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20280"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20280", "datePublished": "2026-09-30T09:56:28.525185Z", "dateUpdated": "2026-09-30T09:56:33.959884Z", "cveId": "CVE-2026-103237", "dateReserved": "2026-09-30T09:56:33.891Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["EventDelegationsController"], "product": "MISP", "programFiles": ["app/Controller/EventDelegationsController.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submitted record, including caller-supplied fields such as the primary key and event_id.</p><p>An authenticated attacker could inject a primary key or event_id into the delegation payload to retarget an existing delegation record to any event on the instance. Because a delegation row grants the requesting organisation read access to the event it references, this effectively granted read access to arbitrary events belonging to other organisations. If the target organisation subsequently accepted the delegation, ownership of the event was transferred and the original record was deleted.</p><p>Preconditions:</p><p>- An authenticated user with the delegation permission (perm_delegate)</p><p>- The MISP.delegation server setting must be enabled</p><p>Impact:</p><p>- Confidentiality: read access to any event on the instance</p><p>- Integrity: overwriting existing delegation records and transferring event ownership</p><p>Affected versions: MISP &lt; 2.5.48</p>"}], "value": "MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submitted record, including caller-supplied fields such as the primary key and event_id.\n\nAn authenticated attacker could inject a primary key or event_id into the delegation payload to retarget an existing delegation record to any event on the instance. Because a delegation row grants the requesting organisation read access to the event it references, this effectively granted read access to arbitrary events belonging to other organisations. If the target organisation subsequently accepted the delegation, ownership of the event was transferred and the original record was deleted.\n\nPreconditions:\n\n- An authenticated user with the delegation permission (perm_delegate)\n\n- The MISP.delegation server setting must be enabled\n\nImpact:\n\n- Confidentiality: read access to any event on the instance\n\n- Integrity: overwriting existing delegation records and transferring event ownership\n\nAffected versions: MISP < 2.5.48"}], "impacts": [{"capecId": "CAPEC-12", "descriptions": [{"lang": "en", "value": "CAPEC-12 Mass Assignment"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-915", "description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/d1f5684f9"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The delegation record is now constructed from a strict allow-list of fields rather than persisting the raw user-submitted payload. The event_id is always derived from the authorized event in the URL, the requester_org_id is always taken from the authenticated session, and the primary key is never included in the saved data. Only message, distribution, and sharing_group_id are accepted from user input, eliminating the ability to retarget or overwrite existing delegation records.</p>"}], "value": "The delegation record is now constructed from a strict allow-list of fields rather than persisting the raw user-submitted payload. The event_id is always derived from the authorized event in the URL, the requester_org_id is always taken from the authenticated session, and the primary key is never included in the saved data. Only message, distribution, and sharing_group_id are accepted from user input, eliminating the ability to retarget or overwrite existing delegation records."}], "source": {"discovery": "UNKNOWN"}, "title": "MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The affected version boundary (< 2.5.48) is inferred from the tag_version_boundary metadata showing v2.5.48 as the nearest tag with 22 commits after the fix; the exact last affected release is not explicitly stated in the patch.", "PR:L assumes the attacker needs only the perm_delegate permission, which is a non-admin role; the exact role configuration may vary by deployment.", "VA:N assumes the availability impact (deletion of the original event) requires victim acceptance and is therefore not a direct availability impact of the vulnerability itself.", "The CAPEC-12 mapping is the closest standard pattern; the vulnerability also has IDOR characteristics (CWE-639) but CAPEC-12 best captures the mass-assignment mechanism demonstrated in the patch.", "The MISP.delegation server setting must be enabled for the vulnerability to be exploitable; this is a deployment configuration assumption."], "capecRationale": [{"capecId": "CAPEC-12", "rationale": "The attacker manipulates hidden or additional fields in a form/API request (injecting id and event_id into the EventDelegation payload) to modify data beyond what the application intended to accept. This is the canonical mass assignment pattern: the server processes user-supplied fields it should have ignored. The mapping is direct and well-supported by the patch evidence."}], "commit": "d1f5684f9a193ea0a8a4f7709703011aa69d9682", "confidence": "high", "credits": [{"lang": "en", "type": "reporter", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5"}], "cvssRationale": "Network vector: MISP is a web application accessible over HTTP. Low complexity: a single crafted POST request suffices. No attack target manipulation. Low privileges: requires an authenticated user with perm_delegate. No user interaction: read access is granted immediately upon creating the retargeted delegation. High confidentiality: grants read access to any event on the instance. High integrity: overwrites existing delegation records and can transfer event ownership. No availability impact without victim acceptance. Scope change (SC:H, SI:H): the vulnerability crosses organisational boundaries, affecting data owned by other organisations. No sub-system availability impact.", "fixSummary": "The delegation record is now constructed from a strict allow-list of fields rather than persisting the raw user-submitted payload. The event_id is always derived from the authorized event in the URL, the requester_org_id is always taken from the authenticated session, and the primary key is never included in the saved data. Only message, distribution, and sharing_group_id are accepted from user input, eliminating the ability to retarget or overwrite existing delegation records.", "generatedAt": "2026-09-30T07:37:05.841152Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 9, "assumptionCount": 5, "confidence": "high", "model": "qwen3.8:27b", "score": 6}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "f478751165e658f2b26822845ec034386d8a1740527cf30863792e9521f24611", "patchSummary": "In EventDelegationsController::delegateEvent(), the code previously saved $this->request->data['EventDelegation'] directly after setting a few fields. The fix replaces this with an explicit allow-list array containing only event_id (from the authorized URL event), requester_org_id (from the session), org_id (resolved from submitted UUID), message, distribution, and sharing_group_id. The primary key id is never included. A regression test class DelegationRequestRetargeting was added to verify that injecting a nested EventDelegation with a foreign id and event_id does not grant read access to the victim event.", "patchTruncated": false, "patches": [{"commit": "d1f5684f9a193ea0a8a4f7709703011aa69d9682", "patchSha256": "f478751165e658f2b26822845ec034386d8a1740527cf30863792e9521f24611", "source": "https://github.com/MISP/MISP/commit/d1f5684f9.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/d1f5684f9.patch", "subject": "fix: [security] Delegation requests stay bound to the event"}], "source": "https://github.com/MISP/MISP/commit/d1f5684f9.patch", "subject": "fix: [security] Delegation requests stay bound to the event", "tagVersionBoundary": {"commits_after_fix": 22, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-915", "rationale": "The application persisted the entire user-submitted record including fields (id, event_id) that should not be attacker-controllable, allowing mass assignment of sensitive fields to retarget the delegation."}, {"cweId": "CWE-639", "rationale": "The authorization check validated only the event in the URL, but the attacker-supplied primary key or event_id in the payload redirected the operation to a different record, bypassing the intended authorization boundary."}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20227"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-103235", "datePublished": "2026-09-30T09:09:00.000Z", "dateReserved": "2026-09-30T09:09:00.000Z", "dateUpdated": "2026-09-30T09:12:45.330040Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2026-20227"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}, {"containers": {"cna": {"affected": [{"modules": ["website/models/user.py", "website/web/views/user.py", "website/lib/user_utils.py"], "product": "vulnerability-lookup", "programFiles": ["website/models/user.py", "website/web/views/user.py", "website/lib/user_utils.py"], "repo": "https://github.com/vulnerability-lookup/vulnerability-lookup", "vendor": "vulnerability-lookup", "versions": [{"lessThanOrEqual": "6.2.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "remediation developer", "value": "Alexandre Dulaunoy"}, {"lang": "en", "type": "remediation developer", "value": "C\u00e9dric Bonhomme"}, {"lang": "en", "type": "remediation developer", "value": "Claude Fable 5.1"}, {"lang": "en", "type": "finder", "value": "avrlab233"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use (TOCTOU) race condition in the consumption of single-use recovery tokens. The original implementation verified the token nonce against the stored digest and then consumed (cleared) it in separate database operations. Two concurrent HTTP requests presenting the same valid recovery token could both pass the verification check before either transaction committed, allowing both to set their own password on the target account. The last transaction to commit overwrites the first, enabling an attacker who possesses a valid recovery token to replace the legitimate user's password with one of their choosing.</p><p>A secondary defect in the same endpoint (confirm_account) allowed a valid recovery link to be used to set an empty or trivially short password (e.g., three characters). The view handler performed only a manual equality comparison between the two password fields and never invoked the form's validation logic, bypassing the intended minimum-length and complexity constraints.</p><p>The affected component is the user account recovery endpoint (/user/confirm_account/&lt;token&gt;) and the associated token verification and consumption logic in the User model (website/models/user.py) and the view layer (website/web/views/user.py).</p>"}], "value": "The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use (TOCTOU) race condition in the consumption of single-use recovery tokens. The original implementation verified the token nonce against the stored digest and then consumed (cleared) it in separate database operations. Two concurrent HTTP requests presenting the same valid recovery token could both pass the verification check before either transaction committed, allowing both to set their own password on the target account. The last transaction to commit overwrites the first, enabling an attacker who possesses a valid recovery token to replace the legitimate user's password with one of their choosing.\n\nA secondary defect in the same endpoint (confirm_account) allowed a valid recovery link to be used to set an empty or trivially short password (e.g., three characters). The view handler performed only a manual equality comparison between the two password fields and never invoked the form's validation logic, bypassing the intended minimum-length and complexity constraints.\n\nThe affected component is the user account recovery endpoint (/user/confirm_account/<token>) and the associated token verification and consumption logic in the User model (website/models/user.py) and the view layer (website/web/views/user.py)."}], "impacts": [{"capecId": "CAPEC-111", "descriptions": [{"lang": "en", "value": "CAPEC-111 Race Condition"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "description": "CWE-362 Concurrency: Race Condition", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-9000-000000000000"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/5462bab62d76df852619e01eb67da36c023c8c40"}, {"name": "Security patch", "tags": ["patch"], "url": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/ad6f22882975516adf193a1a920aaa54025c71d4"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The non-atomic check-then-consume pattern is replaced with a single conditional UPDATE statement (compare-and-set) that atomically verifies the stored SHA-256 nonce digest, updates the password hash, sets is_confirmed, and clears the token in one database operation. Only the first transaction to commit succeeds; all concurrent attempts match zero rows and are rejected with an error. The view now calls form.validate() before processing the password change, enforcing the form's length and equality validators. The dead consume_account_token() method is removed to eliminate the non-atomic consumption path entirely.</p>"}], "value": "The non-atomic check-then-consume pattern is replaced with a single conditional UPDATE statement (compare-and-set) that atomically verifies the stored SHA-256 nonce digest, updates the password hash, sets is_confirmed, and clears the token in one database operation. Only the first transaction to commit succeeds; all concurrent attempts match zero rows and are rejected with an error. The view now calls form.validate() before processing the password change, enforcing the form's length and equality validators. The dead consume_account_token() method is removed to eliminate the non-atomic consumption path entirely."}], "title": "Vulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeover", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "partial", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The product version and exact release boundary are not specified in the patch metadata; the affected version range is recorded as unspecified.", "The CAPEC-111 mapping is the closest available pattern for a database-level TOCTOU race on a single-use token; no CAPEC specifically describes concurrent compare-and-set exploitation, so this is the best available match.", "The CVSS AC:H reflects the race-condition aspect; the missing-validation aspect alone would be AC:L, but the patch set is treated as one vulnerability per the caller's instruction.", "The vendor is not explicitly identified in the metadata; the GitHub repository name 'vulnerability-lookup' is used as the product identifier.", "No specific authentication or deployment preconditions beyond possession of a valid recovery token are stated in the patch; the token is assumed to be delivered out-of-band (e.g., email).", "The Co-Authored-By line for Claude Fable 5.1 is treated as a remediation developer credit per the metadata's remediation_developers list; no finder or reporter is identified in the supplied evidence."], "capecRationale": [{"capecId": "CAPEC-111", "rationale": "The attacker exploits the window between token verification and token consumption by issuing a concurrent request with the same token. Both requests pass the check; the last to commit overwrites the first's password. This is a textbook race-condition attack on a shared resource (the single-use token). CAPEC-111 is the closest available pattern; no CAPEC specifically covers TOCTOU on database-level token consumption, so this is the best match."}], "commit": "ad6f22882975516adf193a1a920aaa54025c71d4", "confidence": "medium", "credits": [{"lang": "en", "type": "remediation developer", "value": "Alexandre Dulaunoy"}, {"lang": "en", "type": "remediation developer", "value": "C\u00e9dric Bonhomme"}, {"lang": "en", "type": "remediation developer", "value": "Claude Fable 5.1"}], "cvssRationale": "AV:N: the recovery endpoint is reachable over the network. AC:H: exploiting the race condition requires precise timing of two concurrent requests, making the attack condition high complexity. AT:N: no active user interaction or deception is required beyond possessing a valid token. PR:N: no prior authentication is needed; the recovery token itself is the credential. UI:N: no user interaction is required. VC:N: the vulnerability does not directly expose confidential data. VI:H: the integrity of the user's password (a critical credential) is directly compromised. VA:N: no availability impact. SC:N: the impact is confined to the vulnerable component. SI:H: the integrity of the user's account (password, confirmation state) is compromised, affecting the user's ability to access their own account. SA:N: no security-authority impact.", "fixSummary": "The non-atomic check-then-consume pattern is replaced with a single conditional UPDATE statement (compare-and-set) that atomically verifies the stored SHA-256 nonce digest, updates the password hash, sets is_confirmed, and clears the token in one database operation. Only the first transaction to commit succeeds; all concurrent attempts match zero rows and are rejected with an error. The view now calls form.validate() before processing the password change, enforcing the form's length and equality validators. The dead consume_account_token() method is removed to eliminate the non-atomic consumption path entirely.", "generatedAt": "2026-09-27T14:43:09.207406Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 9, "assumptionCount": 6, "confidence": "medium", "model": "qwen3.8:27b", "score": 4}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "ccb7572963e8b2435c2ee54cea019a60b1b70a5717cc3848ccd940232eae0b91", "patchSummary": "Added reset_password_with_account_token() to the User model performing a single conditional UPDATE (WHERE id = ? AND account_token_digest = sha256(nonce)) that sets pwdhash, is_confirmed=True, and account_token_digest=None atomically. Removed the separate consume_account_token() method. Changed the confirm_account view to call form.validate() instead of only comparing password1 and password2 manually. Introduced a _account_token_digest() static helper to centralize the SHA-256 computation (previously three inline calls). Removed synchronize_session=False from the UPDATE execution options so the ORM session stays consistent. Added regression tests for concurrent token consumption (two threads, barrier-synchronized) and for rejection of passwords that fail form validation (empty, three-character, mismatched).", "patchTruncated": false, "patches": [{"commit": "5462bab62d76df852619e01eb67da36c023c8c40", "patchSha256": "75ed8b215e2769b5d20b161ddfbde9e0b2975f836397979a94387340b0501ec1", "source": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/5462bab62d76df852619e01eb67da36c023c8c40.patch", "sourceUrl": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/5462bab62d76df852619e01eb67da36c023c8c40.patch", "subject": "Fix recovery token consumption race"}, {"commit": "ad6f22882975516adf193a1a920aaa54025c71d4", "patchSha256": "c1cecff5ac5f7804ff42f0583b156cefa2add775cb6f80506c917f84a26bf43d", "source": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/ad6f22882975516adf193a1a920aaa54025c71d4.patch", "sourceUrl": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/ad6f22882975516adf193a1a920aaa54025c71d4.patch", "subject": "fix: [user] Validate the recovery form and harden the token"}], "source": "patch set (2 sources)", "subject": "fix: [user] Validate the recovery form and harden the token", "weaknessRationale": [{"cweId": "CWE-362", "rationale": "The primary defect is a TOCTOU race: the token nonce is verified and then consumed in separate operations, allowing two concurrent transactions to both pass verification before either commits. The fix replaces this with an atomic compare-and-set UPDATE, confirming the race condition as the root cause."}, {"cweId": "CWE-20", "rationale": "The confirm_account view never called form.validate() on POST, so the form's minimum-length and equality validators were bypassed. A valid recovery link alone permitted setting an empty or three-character password. The fix adds the form.validate() call before processing."}]}}}, "recordType": "advisory", "vulnId": "gcve-1-2026-20252"}]}}, "cveMetadata": {"assignerOrgId": "00000000-0000-4000-9000-000000000000", "state": "PUBLISHED", "vulnId": "gcve-1-2026-20252", "datePublished": "2026-09-27T14:47:33.302690Z", "dateUpdated": "2026-09-27T14:47:50.875076Z", "cveId": "CVE-2026-101041", "dateReserved": "2026-09-27T14:47:50.804Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}]