CVE-2026-95658
MediumCVSS 6.9Summary
MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action under unlockedActions disables both CSRF token check and field hash validation. Because moduleStatelessExecution executes a workflow module's exec() method with caller-supplied input and parameters, the absence of CSRF protection allows an attacker to craft a cross-site form post that, when submitted by an authenticated administrator, would invoke the action on the MISP instance. The attacker can select any workflow module, including action modules that write blocklist and warninglist entries, and supply arbitrary input. The vulnerability was found during internal review. The fix is included in MISP v2.5.47.
Risk Assessment
A CSRF attack can lead to modification of blocklists and warninglists, having high impact on security-related data integrity. The attack requires administrator interaction and can be performed remotely.
Recommendation
Update MISP to version 2.5.47 with the fix. Enable additional CSRF protections and restrict access to administrative actions.
Other vulnerabilities in MISP
See all- CVE-2026-107180High
On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of mandatory two-factor authentication applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing non-browser requests (AJAX/XHR, REST API, .json URLs, restSearch, automation). Because these requests cannot follow the redirect to the TOTP enrolment page, the guard was skipped, and the user retained full access without completing the second-factor setup. Fixes (commits 8deb0619e and 6b527ba6e) broadened the guard to cover all non-browser requests, except API key authentication. Affected version: <2.5.48.
- CVE-2026-107175Medium
MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified. When a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted. Security impact: stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure. Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing. Preconditions: an authenticated user with write access to at least one MISP event; the user modifies the event's distribution or sharing_group_id field. Affected versions: <2.5.48
- CVE-2026-104908High
MISP before version 2.5.48 has an improper input validation vulnerability in the decaying model import functionality. A user with perm_decaying permissions can overwrite existing models of other organizations, change their ownership, or create a default model, affecting scoring behavior.
- CVE-2026-104907Medium
MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript string context, meaning a malicious linked server could supply a tag ID containing characters (such as a single quote) that break out of the JavaScript string literal and inject arbitrary script. Preconditions: a linked/remote MISP server is configured and connected to the local instance, the linked server supplies a crafted tag ID in an event, and an authenticated user views the event preview and interacts with the affected tag element. Impact: arbitrary JavaScript execution in the context of the viewing user's browser session, potentially allowing session hijacking, data exfiltration, or unauthorized actions on behalf of the user. Affected versions: MISP prior to the fix commit (v2.5.48 or later, exact boundary unconfirmed).
- CVE-2026-104906Medium
MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII object can inject arbitrary HTML or JavaScript that executes in the context of the victim's MISP session. Preconditions: the victim must be an authenticated MISP user with access to the TAXII object viewer, and the victim must open or view the crafted TAXII object. Impact: execution of arbitrary JavaScript in the victim's browser within the MISP application context, potential theft of session tokens, API keys, or other sensitive data, and potential for performing actions on behalf of the authenticated user. Affected versions: <2.5.48.
- CVE-2026-104901Medium
MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without proper output encoding. A malicious or compromised linked server could return a crafted event ID containing arbitrary HTML or JavaScript markup. This markup would be rendered in the browser of any user in the host organization who views the ID Translator page, enabling session hijacking, credential theft, or other client-side attacks. Preconditions: the victim must be an authenticated user of the host MISP instance, a linked server must be configured on the host instance, and the victim must navigate to the ID Translator page for a given event. Affected versions: <2.5.48.
- CVE-2026-104900Medium
MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link URL but rendered the field value without HTML encoding. An attacker with the ability to create or modify events on a linked (remote) MISP server could craft an event identifier containing HTML or JavaScript markup. When a user on the local MISP instance views the remote event preview index, the unescaped value is rendered directly in the browser, allowing arbitrary script execution in the victim's session. Preconditions: a linked/remote MISP server is configured and connected to the local instance, the attacker has sufficient access on the linked server to create or modify an event with a crafted identifier, and a victim user on the local instance views the remote event preview index page. Impact: execution of arbitrary JavaScript in the context of the MISP web application, potential session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user. Affected versions: <2.5.48.
- CVE-2026-103858Medium
MISP before version 2.5.48 contains an incomplete authorization check in the discussion posting functionality. An authenticated user outside the sharing group or without visibility on the associated event can read the thread title and quoted post content, and submit new posts into the thread, to which they are not authorized.
- CVE-2026-103664Medium
MISP contains a reflected XSS vulnerability in the analyst data notes panel. The seed path parameter supplied via URL is passed directly into inline JavaScript without sanitization. An attacker can trick an authenticated user into visiting a crafted URL, allowing arbitrary JavaScript execution in the victim's browser. Affects versions prior to the fix (commit 58925dbf0, post v2.5.48).
- CVE-2026-103662Medium
MISP contains a reflected XSS vulnerability in legacy taxonomy tag confirmation forms (add and disable tag). The forms echoed user-supplied tag names without escaping. An attacker can trick an administrator into visiting a crafted URL with a malicious tag, allowing arbitrary JavaScript execution in the admin's session. Affects versions <2.5.48.
Original NVD description (English source)
MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action in unlockedActions disables both the CSRF token check and the field hash validation for that action. Because moduleStatelessExecution executes a workflow module's exec() method with caller-supplied input and parameters, the absence of CSRF protection allowed an attacker to craft a cross-site form post (or equivalent cross-origin request) that, when submitted by an authenticated site administrator, would cause the administrator's browser to invoke the action on the MISP instance. The attacker could select any workflow module to execute, including action modules that write blocklist and warninglist entries, and supply arbitrary input and parameters of their choosing. This constitutes a cross-site request forgery (CSRF) vulnerability with high integrity impact on the MISP instance's security-related data. The vulnerability was identified during an internal security review and was not externally reported. The fix is included in MISP v2.5.47.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS