CIRCL is the CERT (Computer Emergency Response Team/Computer Security Incident Response Team) for the private sector, communes and non-governmental entities in Luxembourg.
- Website
- https://www.circl.lu
- info@circl.lu
- Vendor name
- circl
- GNA identifier
- GNA-1 GCVE registry Recent publications
Products
8 products registered by Computer Incident Response Center LuxembourgOpen Source Threat Intelligence Platform & Open Standards For Threat Information Sharing
Client API to query any Passive DNS implementation following the Passive DNS - Common Output Format.
An open source platform to support analysts to organise their case and tasks.
AIL Framework
The Vulnerability-Lookup software is a powerful sharing platform to assist security teams, researchers, and system administrators in identifying and tracking vulnerabilities related to specific vendors and products. By leveraging known vulnerability databases, sightings, and configurations, the software provides...
Analyse a forensic target (such as a directory) to find and report files found and not found from CIRCL hashlookup public service or the Bloom filter from CIRCL hashlookup. This tool can help a digital forensic investigator to know the context, origin of specific files during a digital forensic investigation.
Lookyloo is a web interface that captures a webpage and then displays a tree of the domains, that call each other.
Convert Cyber Threat Intelligence data between MISP and STIX formats. Open-source REST API maintained by the MISP Project community.
Recent vulnerabilities
222 published under the CPE names of this organization's products in cvelistv5CVE-2026-86452 (GCVE-0-2026-86452)
Vulnerability from cvelistv5 – Published: 2026-09-07 13:03 – Updated: 2026-09-07 13:03
VLAI
EPSS
VEX
Title
MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding
Summary
Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting.
The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or validating its format. That value was then used to create an audit log entry and queue a password-reset job, causing the supplied value to be persisted more than once per request. The commit explicitly states that an unbounded unauthenticated request field was stored twice per call with no throttle.
The fix adds:
*
a maximum email input length of 1024 bytes;
*
email-format validation before persistent work;
*
a per-source pre-authentication request budget;
*
HTTP 429 responses when that budget is exceeded;
*
a 15-minute cooldown for API-access request emails;
*
POST-only handling and CSRF protection for the API-access request endpoint.
The new flood filter is specifically intended to limit persistent storage costs from anonymous requests such as password resets, registrations, and failed REST authentication attempts.
Version affected: ≤2.5.45
Severity
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/d75d899be | patch |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MISP",
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThanOrEqual": "2.5.45",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scottish Government - National Cyber Team"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAffected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003eusers/forgot\u003c/code\u003e password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or validating its format. That value was then used to create an audit log entry and queue a password-reset job, causing the supplied value to be persisted more than once per request. The commit explicitly states that an \u003cstrong\u003eunbounded unauthenticated request field was stored twice per call with no throttle\u003c/strong\u003e.\u003c/p\u003e\n\u003cp\u003eThe fix adds:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\na maximum email input length of 1024 bytes;\n\u003c/li\u003e\n\u003cli\u003e\nemail-format validation before persistent work;\n\u003c/li\u003e\n\u003cli\u003e\na per-source pre-authentication request budget;\n\u003c/li\u003e\n\u003cli\u003e\nHTTP 429 responses when that budget is exceeded;\n\u003c/li\u003e\n\u003cli\u003e\na 15-minute cooldown for API-access request emails;\n\u003c/li\u003e\n\u003cli\u003e\nPOST-only handling and CSRF protection for the API-access request endpoint.\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThe new flood filter is specifically intended to limit persistent storage costs from anonymous requests such as password resets, registrations, and failed REST authentication attempts.\u003c/p\u003eVersion affected: \u22642.5.45\u003cbr\u003e"
}
],
"value": "Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting.\n\n\nThe users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or validating its format. That value was then used to create an audit log entry and queue a password-reset job, causing the supplied value to be persisted more than once per request. The commit explicitly states that an unbounded unauthenticated request field was stored twice per call with no throttle.\n\n\nThe fix adds:\n\n\n\n * \na maximum email input length of 1024 bytes;\n\n\n * \nemail-format validation before persistent work;\n\n\n * \na per-source pre-authentication request budget;\n\n\n * \nHTTP 429 responses when that budget is exceeded;\n\n\n * \na 15-minute cooldown for API-access request emails;\n\n\n * \nPOST-only handling and CSRF protection for the API-access request endpoint.\n\n\n\n\n\nThe new flood filter is specifically intended to limit persistent storage costs from anonymous requests such as password resets, registrations, and failed REST authentication attempts.\n\nVersion affected: \u22642.5.45"
}
],
"impacts": [
{
"capecId": "CAPEC-125",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-125 Flooding"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T13:03:27.052Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/d75d899be"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-86452",
"datePublished": "2026-09-07T13:03:27.052Z",
"dateReserved": "2026-09-07T13:03:25.588Z",
"dateUpdated": "2026-09-07T13:03:27.052Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86451 (GCVE-0-2026-86451)
Vulnerability from cvelistv5 – Published: 2026-09-07 12:59 – Updated: 2026-09-07 12:59
VLAI
EPSS
VEX
Title
MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects
Summary
Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data() without first checking whether the requester is authorized to view the object the reference belongs to.
The vulnerable code queried ObjectReference.uuid directly and returned the matching row whenever it existed. Because no parent-object ACL was applied, a user who knew or obtained a reference UUID could retrieve information associated with an object outside their normal access scope. The commit explicitly states that any object reference could be returned by UUID without authorizing its parent object.
The fix retrieves the referenced object's object_id and calls fetchObjectSimple() with the current user. If the user cannot access that parent object, MISP now returns NotFoundException instead of exposing the reference.
Version affected: ≤2.5.45
Severity
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/c0cb5c9f8 | patch |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MISP",
"programFiles": [
"app/Lib/Tools/EventGraphTool.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThanOrEqual": "2.5.45",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scottish Government - National Cyber Team"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAffected versions of MISP allow authenticated users to retrieve object-reference records by UUID through \u003ccode\u003eEventGraphTool::get_reference_data()\u003c/code\u003e without first checking whether the requester is authorized to view the object the reference belongs to.\u003c/p\u003e\n\u003cp\u003eThe vulnerable code queried \u003ccode\u003eObjectReference.uuid\u003c/code\u003e directly and returned the matching row whenever it existed. Because no parent-object ACL was applied, a user who knew or obtained a reference UUID could retrieve information associated with an object outside their normal access scope. The commit explicitly states that \u003cstrong\u003eany object reference could be returned by UUID without authorizing its parent object\u003c/strong\u003e.\u003c/p\u003e\n\u003cp\u003eThe fix retrieves the referenced object\u0027s \u003ccode\u003eobject_id\u003c/code\u003e and calls \u003ccode\u003efetchObjectSimple()\u003c/code\u003e with the current user. If the user cannot access that parent object, MISP now returns \u003ccode\u003eNotFoundException\u003c/code\u003e instead of exposing the reference.\u003c/p\u003eVersion affected: \u22642.5.45\u003cbr\u003e"
}
],
"value": "Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data() without first checking whether the requester is authorized to view the object the reference belongs to.\n\n\nThe vulnerable code queried ObjectReference.uuid directly and returned the matching row whenever it existed. Because no parent-object ACL was applied, a user who knew or obtained a reference UUID could retrieve information associated with an object outside their normal access scope. The commit explicitly states that any object reference could be returned by UUID without authorizing its parent object.\n\n\nThe fix retrieves the referenced object\u0027s object_id and calls fetchObjectSimple() with the current user. If the user cannot access that parent object, MISP now returns NotFoundException instead of exposing the reference.\n\nVersion affected: \u22642.5.45"
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:59:43.472Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/c0cb5c9f8"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-86451",
"datePublished": "2026-09-07T12:59:43.472Z",
"dateReserved": "2026-09-07T12:59:41.676Z",
"dateUpdated": "2026-09-07T12:59:43.472Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86441 (GCVE-0-2026-86441)
Vulnerability from cvelistv5 – Published: 2026-09-07 12:39 – Updated: 2026-09-07 12:39
VLAI
EPSS
VEX
Title
MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data
Summary
Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information.
Several organisation-related widgets did not honor Security.hide_organisation_index_from_users. As a result, authenticated users without the perm_sharing_group permission could enumerate organisations even though the normal organisation index was intentionally hidden from them.
The affected widgets included paths that:
*
returned organisation names and identifiers;
*
could expose additional organisation database fields through JSON export because unrestricted find('all') queries fetched full rows;
*
accepted limit=0 or negative values in a way that could effectively remove the result limit and return the entire organisation table.
A related organisation-contributor leaderboard also ignored the same visibility setting. Its handler counted Event.orgc_id across the entire event table and mapped those IDs to organisation names, revealing every organisation with events regardless of whether the caller could see any of those events. The fix withdraws this widget entirely for users who lack organisation-index visibility.
Version affected: ≤2.5.45
Severity
CWE
Assigner
References
2 references
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MISP",
"programFiles": [
"app/Lib/Dashboard/NewOrgsWidget.php",
"app/Lib/Dashboard/OrgsContributorsGeneric.php",
"app/Lib/Dashboard/OrgContributionToplistWidget.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThanOrEqual": "2.5.45",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scottish Government - National Cyber Team"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAffected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information.\u003c/p\u003e\n\u003cp\u003eSeveral organisation-related widgets did not honor \u003ccode\u003eSecurity.hide_organisation_index_from_users\u003c/code\u003e. As a result, authenticated users without the \u003ccode\u003eperm_sharing_group\u003c/code\u003e permission could enumerate organisations even though the normal organisation index was intentionally hidden from them.\u003c/p\u003e\n\u003cp\u003eThe affected widgets included paths that:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\nreturned organisation names and identifiers;\n\u003c/li\u003e\n\u003cli\u003e\ncould expose additional organisation database fields through JSON export because unrestricted \u003ccode\u003efind(\u0027all\u0027)\u003c/code\u003e queries fetched full rows;\n\u003c/li\u003e\n\u003cli\u003e\naccepted \u003ccode\u003elimit=0\u003c/code\u003e or negative values in a way that could effectively remove the result limit and return the entire organisation table.\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eA related organisation-contributor leaderboard also ignored the same visibility setting. Its handler counted \u003ccode\u003eEvent.orgc_id\u003c/code\u003e across the entire event table and mapped those IDs to organisation names, revealing every organisation with events regardless of whether the caller could see any of those events. The fix withdraws this widget entirely for users who lack organisation-index visibility.\u003c/p\u003eVersion affected: \u22642.5.45\u003cbr\u003e"
}
],
"value": "Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information.\n\n\nSeveral organisation-related widgets did not honor Security.hide_organisation_index_from_users. As a result, authenticated users without the perm_sharing_group permission could enumerate organisations even though the normal organisation index was intentionally hidden from them.\n\n\nThe affected widgets included paths that:\n\n\n\n * \nreturned organisation names and identifiers;\n\n\n * \ncould expose additional organisation database fields through JSON export because unrestricted find(\u0027all\u0027) queries fetched full rows;\n\n\n * \naccepted limit=0 or negative values in a way that could effectively remove the result limit and return the entire organisation table.\n\n\n\n\n\nA related organisation-contributor leaderboard also ignored the same visibility setting. Its handler counted Event.orgc_id across the entire event table and mapped those IDs to organisation names, revealing every organisation with events regardless of whether the caller could see any of those events. The fix withdraws this widget entirely for users who lack organisation-index visibility.\n\nVersion affected: \u22642.5.45"
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:39:20.835Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/67892d90e"
},
{
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/5e333a159.patch"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-86441",
"datePublished": "2026-09-07T12:39:20.835Z",
"dateReserved": "2026-09-07T12:39:17.495Z",
"dateUpdated": "2026-09-07T12:39:20.835Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86440 (GCVE-0-2026-86440)
Vulnerability from cvelistv5 – Published: 2026-09-07 12:35 – Updated: 2026-09-07 12:35
VLAI
EPSS
VEX
Title
MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs
Summary
Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget.
The widget's URL is stored configuration controlled by a user. The previous renderer considered a URL safe if it appeared relative or if its parsed hostname matched the configured MISP hostname. That logic failed to reject dangerous schemes and URL forms that browsers normalize differently from PHP's URL parsing.
As a result, values such as javascript: URLs or backslash-based authority forms could reach the generated anchor's href and execute script or navigate to an attacker-controlled origin when another user interacted with the widget. The upstream commit describes the issue as:
“javascript: and backslash URLs reached the href (stored XSS)”.
The fix routes widget URLs through a shared DashboardURLValidator, rejects dangerous schemes, raw backslashes, control characters, and unauthorized absolute origins, and validates the URL both in the widget handler and renderer.
Version affected: ≤2.5.45
Severity
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/adf704e94 | patch |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MISP",
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThanOrEqual": "2.5.45",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scottish Government - National Cyber Team"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ch3\u003e\u003c/h3\u003e\n\u003cp\u003eAffected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget.\u003c/p\u003e\n\u003cp\u003eThe widget\u0027s URL is stored configuration controlled by a user. The previous renderer considered a URL safe if it appeared relative or if its parsed hostname matched the configured MISP hostname. That logic failed to reject dangerous schemes and URL forms that browsers normalize differently from PHP\u0027s URL parsing.\u003c/p\u003e\n\u003cp\u003eAs a result, values such as \u003ccode\u003ejavascript:\u003c/code\u003e URLs or backslash-based authority forms could reach the generated anchor\u0027s \u003ccode\u003ehref\u003c/code\u003e and execute script or navigate to an attacker-controlled origin when another user interacted with the widget. The upstream commit describes the issue as:\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u201cjavascript: and backslash URLs reached the href (stored XSS)\u201d\u003c/strong\u003e.\u003c/p\u003e\n\u003cp\u003eThe fix routes widget URLs through a shared \u003ccode\u003eDashboardURLValidator\u003c/code\u003e, rejects dangerous schemes, raw backslashes, control characters, and unauthorized absolute origins, and validates the URL both in the widget handler and renderer.\u003c/p\u003eVersion affected: \u22642.5.45\u003cbr\u003e"
}
],
"value": "Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget.\n\n\nThe widget\u0027s URL is stored configuration controlled by a user. The previous renderer considered a URL safe if it appeared relative or if its parsed hostname matched the configured MISP hostname. That logic failed to reject dangerous schemes and URL forms that browsers normalize differently from PHP\u0027s URL parsing.\n\n\nAs a result, values such as javascript: URLs or backslash-based authority forms could reach the generated anchor\u0027s href and execute script or navigate to an attacker-controlled origin when another user interacted with the widget. The upstream commit describes the issue as:\n\n\n\u201cjavascript: and backslash URLs reached the href (stored XSS)\u201d.\n\n\nThe fix routes widget URLs through a shared DashboardURLValidator, rejects dangerous schemes, raw backslashes, control characters, and unauthorized absolute origins, and validates the URL both in the widget handler and renderer.\n\nVersion affected: \u22642.5.45"
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:35:10.174Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/adf704e94"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-86440",
"datePublished": "2026-09-07T12:35:10.174Z",
"dateReserved": "2026-09-07T12:35:06.572Z",
"dateUpdated": "2026-09-07T12:35:10.174Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86419 (GCVE-0-2026-86419)
Vulnerability from cvelistv5 – Published: 2026-09-07 12:31 – Updated: 2026-09-07 12:31
VLAI
EPSS
VEX
Title
MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery
Summary
Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality.
In feed processing, redirects were followed without validating the redirect scheme or destination. The original request headers were reused across redirect hops, meaning authentication headers or API credentials configured for a feed could be forwarded to a different host. Redirects could also target internal network resources, resulting in SSRF. The fix adds redirect validation, blocks internal destinations for cross-host redirects, strips configured feed credentials before following redirects to another host, and pins validated DNS results to prevent re-resolution after validation.
The TAXII discovery endpoint had a related incomplete SSRF defense. It used gethostbyname() and compared the result against only a few literal addresses. This missed cases including IPv6 loopback (::1), numeric host encodings such as 0x7f000001, and potentially multiple DNS records. The fix moves TAXII discovery to the shared URL egress validator.
Together, these commits harden MISP's outbound URL handling against alternate-address representations, DNS-related bypasses, unsafe redirects, internal-host access, and cross-host credential forwarding.
Version affected: ≤2.5.45
Severity
CWE
Assigner
References
2 references
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MISP",
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThanOrEqual": "2.5.45",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scottish Government - National Cyber Team"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cp\u003eAffected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality.\u003c/p\u003e\n\u003cp\u003eIn feed processing, redirects were followed without validating the redirect scheme or destination. The original request headers were reused across redirect hops, meaning authentication headers or API credentials configured for a feed could be forwarded to a different host. Redirects could also target internal network resources, resulting in SSRF. The fix adds redirect validation, blocks internal destinations for cross-host redirects, strips configured feed credentials before following redirects to another host, and pins validated DNS results to prevent re-resolution after validation.\u003c/p\u003e\n\u003cp\u003eThe TAXII discovery endpoint had a related incomplete SSRF defense. It used \u003ccode\u003egethostbyname()\u003c/code\u003e and compared the result against only a few literal addresses. This missed cases including IPv6 loopback (\u003ccode\u003e::1\u003c/code\u003e), numeric host encodings such as \u003ccode\u003e0x7f000001\u003c/code\u003e, and potentially multiple DNS records. The fix moves TAXII discovery to the shared URL egress validator.\u003c/p\u003e\n\u003cp\u003eTogether, these commits harden MISP\u0027s outbound URL handling against alternate-address representations, DNS-related bypasses, unsafe redirects, internal-host access, and cross-host credential forwarding.\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eVersion affected: \u22642.5.45\u003c/div\u003e"
}
],
"value": "Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality.\n\n\nIn feed processing, redirects were followed without validating the redirect scheme or destination. The original request headers were reused across redirect hops, meaning authentication headers or API credentials configured for a feed could be forwarded to a different host. Redirects could also target internal network resources, resulting in SSRF. The fix adds redirect validation, blocks internal destinations for cross-host redirects, strips configured feed credentials before following redirects to another host, and pins validated DNS results to prevent re-resolution after validation.\n\n\nThe TAXII discovery endpoint had a related incomplete SSRF defense. It used gethostbyname() and compared the result against only a few literal addresses. This missed cases including IPv6 loopback (::1), numeric host encodings such as 0x7f000001, and potentially multiple DNS records. The fix moves TAXII discovery to the shared URL egress validator.\n\n\nTogether, these commits harden MISP\u0027s outbound URL handling against alternate-address representations, DNS-related bypasses, unsafe redirects, internal-host access, and cross-host credential forwarding.\n\n\n\n\n\n\nVersion affected: \u22642.5.45"
}
],
"impacts": [
{
"capecId": "CAPEC-664",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-664 Server Side Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:H/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:31:35.184Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/08d6efe24"
},
{
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/06f541dcf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-86419",
"datePublished": "2026-09-07T12:31:35.184Z",
"dateReserved": "2026-09-07T12:31:32.941Z",
"dateUpdated": "2026-09-07T12:31:35.184Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86418 (GCVE-0-2026-86418)
Vulnerability from cvelistv5 – Published: 2026-09-07 12:22 – Updated: 2026-09-07 12:22
VLAI
EPSS
VEX
Title
MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users
Summary
Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view.
The affected endpoint returned fields including:
*
organisation ID;
*
UUID;
*
name.
When Security.hide_organisation_index_from_users was enabled, normal organisation enumeration was restricted, but the dashboard picker still queried all organisations. This allowed authenticated users to discover organisations that should have remained hidden from them.
The fix calls Organisation::createConditions($this->Auth->user()) and appends the resulting ACL conditions to the picker query. Ordinary users are thereby limited to organisations associated with events or proposals they can already see, plus their own organisation, while users with the appropriate sharing-group privilege retain broader visibility.
Version affected: ≤2.5.45
Severity
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/8ca4486af | patch |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MISP",
"programFiles": [
"app/Controller/DashboardsController.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThanOrEqual": "2.5.45",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scottish Government - National Cyber Team"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cp\u003eAffected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view.\u003c/p\u003e\n\u003cp\u003eThe affected endpoint returned fields including:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\norganisation ID;\n\u003c/li\u003e\n\u003cli\u003e\nUUID;\n\u003c/li\u003e\n\u003cli\u003e\nname.\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eWhen \u003ccode\u003eSecurity.hide_organisation_index_from_users\u003c/code\u003e was enabled, normal organisation enumeration was restricted, but the dashboard picker still queried all organisations. This allowed authenticated users to discover organisations that should have remained hidden from them.\u003c/p\u003e\n\u003cp\u003eThe fix calls \u003ccode\u003eOrganisation::createConditions($this-\u0026gt;Auth-\u0026gt;user())\u003c/code\u003e and appends the resulting ACL conditions to the picker query. Ordinary users are thereby limited to organisations associated with events or proposals they can already see, plus their own organisation, while users with the appropriate sharing-group privilege retain broader visibility.\u003c/p\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/div\u003e"
}
],
"value": "Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view.\n\n\nThe affected endpoint returned fields including:\n\n\n\n * \norganisation ID;\n\n\n * \nUUID;\n\n\n * \nname.\n\n\n\n\n\nWhen Security.hide_organisation_index_from_users was enabled, normal organisation enumeration was restricted, but the dashboard picker still queried all organisations. This allowed authenticated users to discover organisations that should have remained hidden from them.\n\n\nThe fix calls Organisation::createConditions($this-\u003eAuth-\u003euser()) and appends the resulting ACL conditions to the picker query. Ordinary users are thereby limited to organisations associated with events or proposals they can already see, plus their own organisation, while users with the appropriate sharing-group privilege retain broader visibility.\n\n\n\n\nVersion affected: \u22642.5.45"
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:22:52.859Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/8ca4486af"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-86418",
"datePublished": "2026-09-07T12:22:52.859Z",
"dateReserved": "2026-09-07T12:22:51.171Z",
"dateUpdated": "2026-09-07T12:22:52.859Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86417 (GCVE-0-2026-86417)
Vulnerability from cvelistv5 – Published: 2026-09-07 12:17 – Updated: 2026-09-07 12:17
VLAI
EPSS
VEX
Title
MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users
Summary
Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates().
The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal HTML interface could request the REST/JSON representation and receive template owners’ email addresses without the intended privilege check.
The fix moves the decision to a centralized User::canSeeEmails() authorization helper. Email addresses are now fetched only when the requester is a site administrator or the instance explicitly enables Security.disclose_user_emails. The same helper is also reused by other dashboard widgets to keep email-disclosure policy consistent.
Version affected: ≤2.5.45
Severity
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/fd554c3bd.patch | patch |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MISP",
"programFiles": [
"app/Controller/DashboardsController.php",
"app/Lib/Dashboard/NewUsersWidget.php",
"app/Lib/Dashboard/UserContributionToplistWidget.php",
"app/Model/User.php",
"app/Test/UserCanSeeEmailsTest.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThanOrEqual": "2.5.45",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scottish Government - National Cyber Team"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAffected versions of MISP inconsistently enforced email-address visibility in \u003ccode\u003eDashboardsController::listTemplates()\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThe query always fetched \u003ccode\u003eUser.email\u003c/code\u003e, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal HTML interface could request the REST/JSON representation and receive template owners\u2019 email addresses without the intended privilege check.\u003c/p\u003e\n\u003cp\u003eThe fix moves the decision to a centralized \u003ccode\u003eUser::canSeeEmails()\u003c/code\u003e authorization helper. Email addresses are now fetched only when the requester is a site administrator or the instance explicitly enables \u003ccode\u003eSecurity.disclose_user_emails\u003c/code\u003e. The same helper is also reused by other dashboard widgets to keep email-disclosure policy consistent.\u003c/p\u003eVersion affected: \u22642.5.45\u003cbr\u003e"
}
],
"value": "Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates().\n\n\nThe query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal HTML interface could request the REST/JSON representation and receive template owners\u2019 email addresses without the intended privilege check.\n\n\nThe fix moves the decision to a centralized User::canSeeEmails() authorization helper. Email addresses are now fetched only when the requester is a site administrator or the instance explicitly enables Security.disclose_user_emails. The same helper is also reused by other dashboard widgets to keep email-disclosure policy consistent.\n\nVersion affected: \u22642.5.45"
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:17:43.320Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/fd554c3bd.patch"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-86417",
"datePublished": "2026-09-07T12:17:43.320Z",
"dateReserved": "2026-09-07T12:17:41.496Z",
"dateUpdated": "2026-09-07T12:17:43.320Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86408 (GCVE-0-2026-86408)
Vulnerability from cvelistv5 – Published: 2026-09-07 12:11 – Updated: 2026-09-07 12:11
VLAI
EPSS
VEX
Title
MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events
Summary
Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view().
The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as:
*
type
*
key_data
*
fingerprint
but did not fetch or authorize the associated parent event first.
The upstream commit explicitly states that cryptographicKeys/view could return a protected event’s signing key to any authenticated user.
The fix adds parent_id and parent_type to the lookup and then enforces authorization through the associated event using fetchSimpleEvent($user, parent_id). If the parent is not an Event, access is limited to site administrators.
Version affected: ≤2.5.45
Severity
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/2edde619b | patch |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MISP",
"programFiles": [
"app/Controller/CryptographicKeysController.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThanOrEqual": "2.5.45",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scottish Government - National Cyber Team"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAffected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through \u003ccode\u003eCryptographicKeysController::view()\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThe vulnerable handler queried \u003ccode\u003eCryptographicKey\u003c/code\u003e directly using the supplied key ID and selected sensitive fields such as:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003ccode\u003etype\u003c/code\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003ccode\u003ekey_data\u003c/code\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003ccode\u003efingerprint\u003c/code\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003ebut did not fetch or authorize the associated parent event first.\u003c/p\u003e\n\u003cp\u003eThe upstream commit explicitly states that \u003ccode\u003ecryptographicKeys/view\u003c/code\u003e could return a \u003cstrong\u003eprotected event\u2019s signing key to any authenticated user\u003c/strong\u003e.\u003c/p\u003e\n\u003cp\u003eThe fix adds \u003ccode\u003eparent_id\u003c/code\u003e and \u003ccode\u003eparent_type\u003c/code\u003e to the lookup and then enforces authorization through the associated event using \u003ccode\u003efetchSimpleEvent($user, parent_id)\u003c/code\u003e. If the parent is not an Event, access is limited to site administrators.\u003c/p\u003eVersion affected: \u22642.5.45\u003cbr\u003e"
}
],
"value": "Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view().\n\n\nThe vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as:\n\n\n\n * \ntype\n\n\n * \nkey_data\n\n\n * \nfingerprint\n\n\n\n\n\nbut did not fetch or authorize the associated parent event first.\n\n\nThe upstream commit explicitly states that cryptographicKeys/view could return a protected event\u2019s signing key to any authenticated user.\n\n\nThe fix adds parent_id and parent_type to the lookup and then enforces authorization through the associated event using fetchSimpleEvent($user, parent_id). If the parent is not an Event, access is limited to site administrators.\n\nVersion affected: \u22642.5.45"
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:11:18.233Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/2edde619b"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-86408",
"datePublished": "2026-09-07T12:11:18.233Z",
"dateReserved": "2026-09-07T12:11:12.888Z",
"dateUpdated": "2026-09-07T12:11:18.233Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86351 (GCVE-0-2026-86351)
Vulnerability from cvelistv5 – Published: 2026-09-07 09:59 – Updated: 2026-09-07 09:59
VLAI
EPSS
VEX
Title
MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL
Summary
Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers.
The vulnerable homepage value can be stored as a user setting and later used by the post-login routing logic. The commit explicitly identifies //attacker.example as a payload that passed validation and was emitted to the Location header after login.
The fix introduces a shared InternalRedirectValidator that rejects URLs containing a host, scheme, userinfo, unsafe leading // or /\, malformed URLs, and control characters. It also revalidates homepage settings on read so legacy or internally written unsafe values cannot bypass the new storage-time validation.
Version affected: ≤2.5.45
Severity
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/bd454f65a | patch |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MISP",
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThanOrEqual": "2.5.45",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scottish Government - National Cyber Team"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAffected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with \u003ccode\u003e/\u003c/code\u003e. That check is insufficient because protocol-relative URLs such as \u003ccode\u003e//attacker.example\u003c/code\u003e also begin with \u003ccode\u003e/\u003c/code\u003e but resolve to an external origin in browsers.\u003c/p\u003e\n\u003cp\u003eThe vulnerable homepage value can be stored as a user setting and later used by the post-login routing logic. The commit explicitly identifies \u003ccode\u003e//attacker.example\u003c/code\u003e as a payload that passed validation and was emitted to the \u003ccode\u003eLocation\u003c/code\u003e header after login.\u003c/p\u003e\u003cp\u003eThe fix introduces a shared \u003ccode\u003eInternalRedirectValidator\u003c/code\u003e that rejects URLs containing a host, scheme, userinfo, unsafe leading \u003ccode\u003e//\u003c/code\u003e or \u003ccode\u003e/\\\u003c/code\u003e, malformed URLs, and control characters. It also revalidates homepage settings on read so legacy or internally written unsafe values cannot bypass the new storage-time validation.\u003c/p\u003eVersion affected: \u22642.5.45"
}
],
"value": "Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers.\n\n\nThe vulnerable homepage value can be stored as a user setting and later used by the post-login routing logic. The commit explicitly identifies //attacker.example as a payload that passed validation and was emitted to the Location header after login.\n\nThe fix introduces a shared InternalRedirectValidator that rejects URLs containing a host, scheme, userinfo, unsafe leading // or /\\, malformed URLs, and control characters. It also revalidates homepage settings on read so legacy or internally written unsafe values cannot bypass the new storage-time validation.\n\nVersion affected: \u22642.5.45"
}
],
"impacts": [
{
"capecId": "CAPEC-178",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-178 Cross-Site Flashing"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T09:59:34.850Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/bd454f65a"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-86351",
"datePublished": "2026-09-07T09:59:34.850Z",
"dateReserved": "2026-09-07T09:59:32.940Z",
"dateUpdated": "2026-09-07T09:59:34.850Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86347 (GCVE-0-2026-86347)
Vulnerability from cvelistv5 – Published: 2026-09-07 09:30 – Updated: 2026-09-07 09:30
VLAI
EPSS
VEX
Title
MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion
Summary
Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry for templates/uploadFile used the wildcard *. This bypasses the intended role restrictions applied to neighboring template-management operations.
The upload handler accepts arbitrary content with only minimal checks and writes it into app/tmp/files/. A low-privileged or read-only user can therefore repeatedly upload files and consume server disk space without requiring perm_add or perm_template. The fix changes the ACL requirement from * to perm_add.
The commit also rules out stronger impacts: uploaded files receive random names, path traversal/predictable overwrite is not available, the temporary directory is outside the web root, and the files are not directly served over HTTP. Therefore, the issue should not be described as arbitrary file overwrite, stored XSS, or RCE.
Version affected: ≤2.5.45
Severity
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/8e8885971 | patch |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MISP",
"programFiles": [
"app/Controller/Component/ACLComponent.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThanOrEqual": "2.5.45",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scottish Government - National Cyber Team"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAffected versions of MISP allow any authenticated user to access \u003ccode\u003eTemplatesController::uploadFile()\u003c/code\u003e because the ACL entry for \u003ccode\u003etemplates/uploadFile\u003c/code\u003e used the wildcard \u003ccode\u003e*\u003c/code\u003e. This bypasses the intended role restrictions applied to neighboring template-management operations.\u003c/p\u003e\n\u003cp\u003eThe upload handler accepts arbitrary content with only minimal checks and writes it into \u003ccode\u003eapp/tmp/files/\u003c/code\u003e. A low-privileged or read-only user can therefore repeatedly upload files and consume server disk space without requiring \u003ccode\u003eperm_add\u003c/code\u003e or \u003ccode\u003eperm_template\u003c/code\u003e. The fix changes the ACL requirement from \u003ccode\u003e*\u003c/code\u003e to \u003ccode\u003eperm_add\u003c/code\u003e.\u003c/p\u003e\u003cp\u003eThe commit also rules out stronger impacts: uploaded files receive random names, path traversal/predictable overwrite is not available, the temporary directory is outside the web root, and the files are not directly served over HTTP. Therefore, the issue should \u003cstrong\u003enot\u003c/strong\u003e be described as arbitrary file overwrite, stored XSS, or RCE.\u003c/p\u003eVersion affected:\u0026nbsp;\u22642.5.45"
}
],
"value": "Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry for templates/uploadFile used the wildcard *. This bypasses the intended role restrictions applied to neighboring template-management operations.\n\n\nThe upload handler accepts arbitrary content with only minimal checks and writes it into app/tmp/files/. A low-privileged or read-only user can therefore repeatedly upload files and consume server disk space without requiring perm_add or perm_template. The fix changes the ACL requirement from * to perm_add.\n\nThe commit also rules out stronger impacts: uploaded files receive random names, path traversal/predictable overwrite is not available, the temporary directory is outside the web root, and the files are not directly served over HTTP. Therefore, the issue should not be described as arbitrary file overwrite, stored XSS, or RCE.\n\nVersion affected:\u00a0\u22642.5.45"
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T09:30:58.087Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/8e8885971"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-86347",
"datePublished": "2026-09-07T09:30:58.087Z",
"dateReserved": "2026-09-07T09:30:56.492Z",
"dateUpdated": "2026-09-07T09:30:58.087Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
displaying 1 - 10 vulnerabilities in total 222