MISP has a validation flaw in its object synchronization logic where objects created without a description are rejected by receiving instances during synchronization. This causes the receiving instance to silently drop the object and its attributes, resulting in loss of threat-intelligence data. The issue occurs when multiple MISP instances synchronize and an authorized user creates an object without a description. It is not exploitable externally but can cause unintended data loss within the sync topology. The affected versions are those prior to 2.5.48.
MISP has a race condition vulnerability in its email-based one-time password (OTP) login flow. When two HTTP requests with the same valid OTP are submitted concurrently, both can authenticate successfully, violating the OTP's one-time-use guarantee. This occurs because OTP validation and deletion are not atomic operations, allowing a second request to reuse the OTP before it is deleted. This affects MISP versions prior to 2.5.48 and requires that email OTP login is enabled and the attacker has a valid OTP. The vulnerability weakens authentication controls and may allow unauthorized access if the OTP is intercepted or shared.
MISP has a cross-site scripting (XSS) vulnerability in its remote event preview page. This occurs when a linked remote MISP server supplies a crafted tag ID that is improperly sanitized in JavaScript context. An authenticated user viewing the event preview and interacting with the tag element may have arbitrary JavaScript executed in their browser session. This could lead to session hijacking or unauthorized actions. The vulnerability affects versions prior to the fix commit around v2.5.48, though the exact boundary is unconfirmed.
MISP has a stored cross-site scripting (XSS) vulnerability in the remote event preview index table rendering. An attacker with write access on a linked remote MISP server can craft event identifiers containing malicious HTML or JavaScript. When a user on the local MISP instance views the remote event preview, the malicious script executes in their browser context. This can lead to arbitrary script execution, session hijacking, data theft, or unauthorized actions. The vulnerability affects versions prior to 2.5.48.
MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature affecting versions prior to 2.5.48. This vulnerability arises because event IDs returned from linked remote MISP servers are rendered without proper output encoding. An attacker controlling or compromising a linked server could inject malicious HTML or JavaScript that executes in the browser of authenticated users viewing the ID Translator page. Exploitation requires an authenticated user, a configured linked server, and navigation to the vulnerable page.
MISP versions prior to 2.5.48 contain an improper input validation vulnerability in the decaying model import functionality. This flaw allows authenticated users with decaying-model permissions to overwrite or modify decaying models belonging to other organizations, including changing ownership and default flags. The vulnerability arises because nested model keys with primary key, organization ID, and default flag can bypass input validation during import.
MISP versions prior to 2.5.48 contain an improper access control vulnerability in the attribute search and paginated attribute view endpoints. Authenticated users with read access to events owned by other organizations could query for soft-deleted attributes and receive data that should have been restricted. This vulnerability exposes confidential soft-deleted threat intelligence attributes from other organizations to unauthorized users, potentially leaking sensitive information that was intended to be hidden.
MISP contains an authorization bypass vulnerability in its related events listing functionality. Authenticated users with access to at least one event can retrieve metadata of related events they are not authorized to view. This occurs because the system uses a correlation table that does not re-validate access rights for each related event, potentially exposing event titles, dates, and correlation counts. The vulnerability affects MISP versions prior to the fix commit 2ffa97f05.
MISP versions prior to 2.5.48 contain an authorization flaw in correlation handling during attribute searches. The system uses a stale distribution snapshot for authorization checks instead of the live event access control list, allowing authenticated users with read access to retrieve attributes and event details from events they no longer have permission to view. This flaw affects confidentiality by exposing unauthorized attribute values and event metadata.
MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer that allows execution of arbitrary JavaScript when viewing crafted TAXII objects. This occurs because JSON string properties are rendered without HTML encoding. An authenticated user with access to the TAXII object viewer who opens a malicious TAXII object can have scripts executed in their browser context, potentially leading to session token theft or unauthorized actions. The vulnerability affects MISP versions prior to 2.5.48.
MISP has a privilege escalation vulnerability in its tag collection creation and editing functionality. An authenticated user with tag editor permissions can exploit this flaw by including additional model data in requests, leading to unauthorized creation or modification of User and Organisation records. This allows escalation from tag editor to site administrator. The vulnerability affects MISP versions prior to 2.5.48.
MISP has a mass assignment vulnerability in its event delegation feature affecting versions prior to 2.5.48. Authenticated users with delegation permission can manipulate delegation records to gain unauthorized read access to arbitrary events and potentially transfer event ownership. This vulnerability allows overwriting existing delegation records and unauthorized event access across organizations.
MISP contains an improper input validation vulnerability in its ORM save path that allows an authenticated user with low-level write permissions to manipulate nested input data. This flaw enables attackers to overwrite, re-parent, or soft-delete database rows belonging to other organizations or events without read access. The vulnerability affects multiple entity types including Attribute, Object, EventReport, Sighting, AttributeTag, and ShadowAttribute. It impacts versions prior to 2.5.48.
A vulnerability in affected versions of MISP (up to 2.5.45) allows any authenticated user to access the TemplatesController::uploadFile() function due to a wildcard ACL entry. This bypasses intended role restrictions, enabling low-privileged or read-only users to upload arbitrary files repeatedly, consuming server disk space. The uploaded files receive random names, are stored outside the web root, and are not served over HTTP, preventing arbitrary file overwrite, stored XSS, or remote code execution.
MISP versions up to 2.5.45 have a vulnerability in the validation of the user-configurable homepage setting. The validation only checks if the path begins with a slash (/), which is insufficient because protocol-relative URLs starting with // can bypass this check and redirect users to external origins. This unsafe homepage value can be stored and later used in post-login routing, potentially leading to unsafe redirects. The vulnerability is identified as CVE-2026-86351 and is categorized as a moderate severity issue.
MISP versions up to 2.5.45 have improper authorization checks in the freetext feed preview functionality. This flaw allows users to access correlated event attributes and feed metadata without proper access control, exposing restricted event information and feed URLs. The vulnerability arises because correlation queries do not enforce user ACLs or feed visibility restrictions correctly. Fixes address these issues by applying ACLs consistently, removing feed URLs from results, and restricting cross-feed data to visible feeds only.
Multiple vulnerabilities have been identified in the open-source MISP platform for threat information sharing. These issues affect versions prior to 2.5.40. A fix is available in version 2.5.40. There are no known exploits in the wild, and no CVSS score is provided for these vulnerabilities.
MISP versions before 2.5.37 contain a stored cross-site scripting (XSS) vulnerability in the template element attribute handling logic. The vulnerability arises because the application accepts arbitrary values for TemplateElementAttribute type and category fields without validating them against known definitions. This flaw allows an attacker with permission to create or modify template element attributes to store crafted type values that can lead to XSS. The affected old templating engine is not accessible starting from version 2.5.37 and will be removed in version 2.5.38.
CVE-2025-66386 is a path traversal vulnerability in the MISP platform prior to version 2.5.27, specifically in the app/Model/EventReport.php component. This flaw allows a site-admin user to manipulate file paths when viewing pictures, potentially accessing unauthorized files on the server. Although exploitation requires site-admin privileges, successful attacks could lead to unauthorized disclosure of sensitive files, impacting confidentiality. There are no known exploits in the wild yet, and no CVSS score has been assigned. The vulnerability affects MISP instances running versions before 2.5.27.