{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-90893",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T10:26:31.868700Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T10:28:09.993Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "UserSettingsController",
            "app/Controller/UserSettingsController.php"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/UserSettingsController.php",
            "app/View/Elements/global_menu.ctp",
            "app/View/Themed/Overmind/Elements/navbar.ctp",
            "app/View/Themed/UiBeta/Elements/global_menu.ctp",
            "app/webroot/js/misp.js"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Scottish Government - National Cyber Team"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component\u0027s unlockedActions list, which disabled all CSRF validation (both token and field-hash checks) for those endpoints. Because these endpoints accept POST requests and modify per-user application state (theme selection, default homepage URL, and event index column visibility), an attacker who can induce a logged-in MISP user to load a malicious page (e.g., via a crafted link, embedded image, or auto-submitting form) can forge requests that alter the victim\u0027s settings without their knowledge or consent. The most impactful action is setHomePage, which allows an attacker to redirect the victim\u0027s default landing page to an arbitrary attacker-controlled URL, potentially facilitating phishing or further social engineering. The setTheme action can alter the user\u0027s visual theme, and eventIndexColumnToggle can change which columns are displayed in the event index view. No authentication bypass is involved; the victim must already be authenticated to MISP. The vulnerability was reported by the Scottish Government National Cyber Team.\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component\u0027s unlockedActions list, which disabled all CSRF validation (both token and field-hash checks) for those endpoints. Because these endpoints accept POST requests and modify per-user application state (theme selection, default homepage URL, and event index column visibility), an attacker who can induce a logged-in MISP user to load a malicious page (e.g., via a crafted link, embedded image, or auto-submitting form) can forge requests that alter the victim\u0027s settings without their knowledge or consent. The most impactful action is setHomePage, which allows an attacker to redirect the victim\u0027s default landing page to an arbitrary attacker-controlled URL, potentially facilitating phishing or further social engineering. The setTheme action can alter the user\u0027s visual theme, and eventIndexColumnToggle can change which columns are displayed in the event index view. No authentication bypass is involved; the victim must already be authenticated to MISP. The vulnerability was reported by the Scottish Government National Cyber Team.\n\nVersion affected: \u22642.5.45"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T09:12:03.863Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/979337b18"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix removes the three affected actions from the Security component\u0027s unlockedActions list (which had disabled all CSRF checks) and instead registers them under a header-only CSRF token validation mechanism (_csrfTokenHeaderOnly). This requires the X-CSRF-Token header to be present and valid on each request while still permitting the AJAX-style calls that lack traditional form fields. Client-side JavaScript and view templates are updated to include the X-CSRF-Token header (sourced from window.csrfToken) in all AJAX and fetch calls to these endpoints, ensuring legitimate same-origin requests continue to function while cross-origin forged requests are rejected.\u003c/p\u003e"
            }
          ],
          "value": "The fix removes the three affected actions from the Security component\u0027s unlockedActions list (which had disabled all CSRF checks) and instead registers them under a header-only CSRF token validation mechanism (_csrfTokenHeaderOnly). This requires the X-CSRF-Token header to be present and valid on each request while still permitting the AJAX-style calls that lack traditional form fields. Client-side JavaScript and view templates are updated to include the X-CSRF-Token header (sourced from window.csrfToken) in all AJAX and fetch calls to these endpoints, ensuring legitimate same-origin requests continue to function while cross-origin forged requests are rejected."
        }
      ],
      "title": "MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The MISP instance is assumed to be deployed in a standard configuration where the Security component\u0027s CSRF protection is enabled by default; if an operator had globally disabled CSRF checks, this specific vulnerability would be subsumed by that broader misconfiguration.",
                  "The setHomePage endpoint is assumed to accept an arbitrary URL path as its argument based on the patch comment stating \u0027a single path the user picks anyway and which setSetting() validates server-side\u0027; the exact validation logic was not visible in the patch.",
                  "Exact affected version range could not be determined from the patch alone; the fix commit is 225 commits after the v2.5.46 tag, suggesting the vulnerability existed in releases around and after v2.5.46, but precise boundaries are unspecified.",
                  "CVSS UI:P assumes the victim must load an attacker-controlled page; if MISP is deployed behind a strict CSP that blocks cross-origin form submission, exploitability may be reduced, but this is not confirmed by the patch."
                ],
                "commit": "979337b182ae666fe1387342e20e061613657e83",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Scottish Government - National Cyber Team"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  },
                  {
                    "lang": "en",
                    "type": "tool",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The attack is delivered over the network via a malicious web page. AC:L: CSRF exploitation is straightforward with no race conditions or special timing. AT:N: No special target state is required beyond normal authentication. PR:N: The attacker requires no privileges on the MISP instance. UI:P: The victim must passively load the attacker\u0027s page while authenticated (e.g., click a link or visit a site). VC:N: No confidential data is exposed. VI:L: User-controlled settings (theme, homepage, column visibility) are modified, representing a low integrity impact. VA:N: No availability impact. SC/SI/SA:N: No impact on adjacent or downstream systems.",
                "draft": false,
                "fixSummary": "The fix removes the three affected actions from the Security component\u0027s unlockedActions list (which had disabled all CSRF checks) and instead registers them under a header-only CSRF token validation mechanism (_csrfTokenHeaderOnly). This requires the X-CSRF-Token header to be present and valid on each request while still permitting the AJAX-style calls that lack traditional form fields. Client-side JavaScript and view templates are updated to include the X-CSRF-Token header (sourced from window.csrfToken) in all AJAX and fetch calls to these endpoints, ensuring legitimate same-origin requests continue to function while cross-origin forged requests are rejected.",
                "generatedAt": "2026-09-14T08:59:52.615890Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 4,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "287bea96c3ef414dbe0e17b36a12cd0aed2f27c7b28ccc9867338fabf9561a0f",
                "patchSummary": "In UserSettingsController::beforeFilter(), the three lines adding eventIndexColumnToggle, setTheme, and setHomePage to $this-\u003eSecurity-\u003eunlockedActions[] are removed and replaced with a single $this-\u003e_csrfTokenHeaderOnly() call covering all four affected actions (including setEventTemplateUserFormMode). In global_menu.ctp (default and UiBeta themes), navbar.ctp (Overmind theme), and misp.js, the jQuery $.ajax() and fetch() calls that invoke setTheme, setHomePage, and eventIndexColumnToggle are updated to include an X-CSRF-Token header populated from window.csrfToken. The Overmind navbar fetch calls also gain credentials: \u0027same-origin\u0027 to ensure cookies are sent with the request.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "979337b182ae666fe1387342e20e061613657e83",
                    "patchSha256": "287bea96c3ef414dbe0e17b36a12cd0aed2f27c7b28ccc9867338fabf9561a0f",
                    "source": "https://github.com/MISP/MISP/commit/979337b18.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/979337b18.patch",
                    "subject": "fix: [security] Put the user-settings endpoints back under"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/979337b18.patch",
                "subject": "fix: [security] Put the user-settings endpoints back under",
                "tagVersionBoundary": {
                  "commits_after_fix": 225,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-352",
                    "rationale": "The endpoints were explicitly excluded from CSRF validation via the Security component\u0027s unlockedActions mechanism, allowing a cross-origin page to submit state-changing POST requests on behalf of an authenticated user without a valid CSRF token."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20226"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-90893",
    "datePublished": "2026-09-14T09:12:03.863Z",
    "dateReserved": "2026-09-14T09:12:01.736Z",
    "dateUpdated": "2026-09-14T10:28:09.993Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-90895",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T10:24:27.267671Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T10:26:12.372Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Console/Command/CLIShell/"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Console/Command/CLIShell.php",
            "app/Console/Command/CLIShell/cli_attributes.php",
            "app/Console/Command/CLIShell/cli_common.php",
            "app/Console/Command/CLIShell/cli_events.php",
            "app/Console/Command/CLIShell/cli_objects.php",
            "app/Console/Command/CLIShell/cli_organisations.php",
            "app/Console/Command/CLIShell/cli_roles.php",
            "app/Console/Command/CLIShell/cli_tags.php",
            "app/Console/Command/CLIShell/cli_users.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Scottish Government - National Cyber Team"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP\u2019s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies.\u003c/p\u003e\n\u003cp\u003eThe patch shows that CLI access could differ from the web application in multiple security-sensitive areas:\u003c/p\u003e\u2003- feed listings did not enforce the same \u003ccode\u003elookup_visible\u003c/code\u003e restrictions for non-host-organisation users;\u003cbr\u003e\u2003- feed detail access did not enforce the same host-organisation/site-admin authorization as \u003ccode\u003eFeedsController::view()\u003c/code\u003e;\u003cbr\u003e\u003ccode\u003e\u2003- Feed.headers\u003c/code\u003e, which can contain HTTP authorization credentials, could be exposed instead of being hidden or masked;\u003cbr\u003e\u2003- server synchronization \u003ccode\u003eauthkey\u003c/code\u003e values were not explicitly hidden from CLI detail output;\u003cbr\u003e\u2003- sharing-group detail access did not consistently use \u003ccode\u003eSharingGroup::checkIfAuthorised()\u003c/code\u003e;\u003cbr\u003e\u2003- the \u003ccode\u003euse\u003c/code\u003e command could establish context for a record without first proving that the user was authorized to view that record\u003cul\u003e\n\u003c/ul\u003e\u003cp\u003eThe commit additionally hardens pagination and terminal rendering, including neutralization of terminal control sequences found in database-backed values. Those are important hardening changes, but the main vulnerability is the CLI authorization/data-disclosure mismatch.\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP\u2019s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies.\n\n\nThe patch shows that CLI access could differ from the web application in multiple security-sensitive areas:\n\n\u2003- feed listings did not enforce the same lookup_visible restrictions for non-host-organisation users;\n\u2003- feed detail access did not enforce the same host-organisation/site-admin authorization as FeedsController::view();\n\u2003- Feed.headers, which can contain HTTP authorization credentials, could be exposed instead of being hidden or masked;\n\u2003- server synchronization authkey values were not explicitly hidden from CLI detail output;\n\u2003- sharing-group detail access did not consistently use SharingGroup::checkIfAuthorised();\n\u2003- the use command could establish context for a record without first proving that the user was authorized to view that record\n\n\nThe commit additionally hardens pagination and terminal rendering, including neutralization of terminal control sequences found in database-backed values. Those are important hardening changes, but the main vulnerability is the CLI authorization/data-disclosure mismatch.\n\nVersion affected: \u22642.5.45"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150 Improper Neutralization of Escape, Quote, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522 Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T09:40:55.800Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/cd9f548ed"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix replaces the shell\u0027s hand-rolled authorization logic with the same model-level accessors used by the web interface (Event::fetchSimpleEvent, MispAttribute::fetchAttributes, MispObject::fetchObjects, SharingGroup::checkIfAuthorised, Organisation::canSee), ensuring read and write operations enforce identical ACL rules. Credential columns are excluded at the query level via a hiddenFields mechanism so they are never fetched from the database. The inline detail editor now delegates to the entity-specific edit handlers, which enforce per-record write authorization. All terminal output passes through a sanitiser that neutralises C0/C1 control characters, ANSI escape sequences, and Unicode bidirectional overrides. Pagination is clamped to a safe range (1-1000) to prevent unbounded result sets.\u003c/p\u003e"
            }
          ],
          "value": "The fix replaces the shell\u0027s hand-rolled authorization logic with the same model-level accessors used by the web interface (Event::fetchSimpleEvent, MispAttribute::fetchAttributes, MispObject::fetchObjects, SharingGroup::checkIfAuthorised, Organisation::canSee), ensuring read and write operations enforce identical ACL rules. Credential columns are excluded at the query level via a hiddenFields mechanism so they are never fetched from the database. The inline detail editor now delegates to the entity-specific edit handlers, which enforce per-record write authorization. All terminal output passes through a sanitiser that neutralises C0/C1 control characters, ANSI escape sequences, and Unicode bidirectional overrides. Pagination is clamped to a safe range (1-1000) to prevent unbounded result sets."
        }
      ],
      "title": "MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The CLI shell is accessible to any authenticated MISP user with local/SSH access to the server; no additional authentication layer is assumed.",
                  "The affected version range is not precisely bounded; the fix commit is 184 commits after tag v2.5.46, but the exact release version containing the fix is not stated in the patch metadata.",
                  "CVSS assumes the attacker already possesses a low-privilege MISP account and local shell access; remote exploitation without local access is not assessed.",
                  "The terminal injection impact (VC:H) is assessed on the basis that an analyst\u0027s terminal session is the primary trust boundary for indicator review; in automated/piped contexts the impact may be lower.",
                  "The unguarded write path is assessed as allowing modification of any readable record, not limited to specific entity types, based on the patch comment stating \u0027a user rewrite any record they could read\u0027."
                ],
                "commit": "cd9f548ed808f89e4e018fad9a81a628098d73fb",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Scottish Government - National Cyber Team"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  }
                ],
                "cvssRationale": "AV:L: The CLI shell is a local console command requiring SSH or local shell access to the MISP server. AC:L: No race conditions or special timing are needed; the unguarded write path and missing ACL checks are deterministic. AT:N: The authorization bypass and credential exposure require no target interaction. PR:L: Any authenticated MISP user with basic permissions (perm_add) can exploit the write bypass and read credential columns. UI:N: The core authorization bypass and data exposure do not require the victim to perform any action. VC:H: Sensitive credentials (feed HTTP auth, server sync key, user passwords/TOTP) are exposed. VI:H: An attacker can modify events, attributes, and objects they should not be able to change. VA:H: An attacker can read records (feeds, organisations, hidden tags) outside their authorized scope. SC/SI/SA:N: Impact is confined to the local MISP instance and its data.",
                "draft": false,
                "fixSummary": "The fix replaces the shell\u0027s hand-rolled authorization logic with the same model-level accessors used by the web interface (Event::fetchSimpleEvent, MispAttribute::fetchAttributes, MispObject::fetchObjects, SharingGroup::checkIfAuthorised, Organisation::canSee), ensuring read and write operations enforce identical ACL rules. Credential columns are excluded at the query level via a hiddenFields mechanism so they are never fetched from the database. The inline detail editor now delegates to the entity-specific edit handlers, which enforce per-record write authorization. All terminal output passes through a sanitiser that neutralises C0/C1 control characters, ANSI escape sequences, and Unicode bidirectional overrides. Pagination is clamped to a safe range (1-1000) to prevent unbounded result sets.",
                "generatedAt": "2026-09-14T09:16:49.402134Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "1993ed3ac039d8fca56d636755584952f47c43046158fdd08278e2e308f1bad1",
                "patchSummary": "Replaced hand-rolled ACL conditions in attribute, object, feed, sharing-group, and organisation queries with calls to the model\u0027s authorized fetch methods (fetchAttributes, fetchObjects, fetchSimpleEvent, checkIfAuthorised, canSee). Added hiddenFields configuration for server (authkey), feed (headers), and user (password, authkey, totp, hotp_counter, external_auth_key) so credential columns are excluded from SQL SELECT. Added __detailFields() to build the field list excluding hidden columns. Rewrote __editDetailField() to delegate to entity-specific edit handlers with a $fields parameter, eliminating the unguarded direct save(). Added __canWriteEntity() and __denyWrite() as a unified write-authorization gate for add/edit/delete. Added __term() sanitiser applied via overridden out()/err() methods and __termRows() for list data, neutralising C0/C1 controls, DEL, and Unicode bidi characters. Added __normalisePagination() to clamp limit to 1-1000 and page to \u003e=1. Added __warnUnsupportedFilters() to report ignored",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "cd9f548ed808f89e4e018fad9a81a628098d73fb",
                    "patchSha256": "1993ed3ac039d8fca56d636755584952f47c43046158fdd08278e2e308f1bad1",
                    "source": "https://github.com/MISP/MISP/commit/cd9f548ed.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/cd9f548ed.patch",
                    "subject": "fix: [cli] Route interactive CLI shell authorization through"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/cd9f548ed.patch",
                "subject": "fix: [cli] Route interactive CLI shell authorization through",
                "tagVersionBoundary": {
                  "commits_after_fix": 184,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The primary vulnerability: the inline detail editor saved records without enforcing per-record write authorization, and list/detail queries used incomplete ACL conditions that did not match the web interface\u0027s access rules. A user who could read a record could modify it, and could read records (feeds, organisations, tags) the web would not expose."
                  },
                  {
                    "cweId": "CWE-200",
                    "rationale": "Credential columns (Feed.headers, Server.authkey, User.password/authkey/totp/hotp_counter/external_auth_key) were fetched from the database and exposed in CLI output to users who should not have access, and organisation/tag visibility settings were not enforced."
                  },
                  {
                    "cweId": "CWE-150",
                    "rationale": "Database values containing ANSI escape sequences, C0/C1 control characters, or Unicode bidirectional override characters were printed verbatim to the terminal, allowing output forgery, window retitling, and visual manipulation of displayed indicators."
                  },
                  {
                    "cweId": "CWE-400",
                    "rationale": "A limit value of zero, negative, or non-numeric caused the ORM to omit the SQL LIMIT clause, returning the entire table into memory and enabling denial of service."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20058"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-90895",
    "datePublished": "2026-09-14T09:40:55.800Z",
    "dateReserved": "2026-09-14T09:40:52.456Z",
    "dateUpdated": "2026-09-14T10:26:12.372Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-90955",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T12:55:46.663079Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T13:00:29.069Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "CLIShell (app/Console/Command/CLIShell)",
            "SysLogLogableBehavior (app/Plugin/SysLogLogable/Model/Behavior)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Console/Command/CLIShell.php",
            "app/Console/Command/CLIShell/cli_common.php",
            "app/Console/Command/CLIShell/cli_users.php",
            "app/Plugin/SysLogLogable/Model/Behavior/SysLogLogableBehavior.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Scottish Government - National Cyber Team"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Fable 5.1"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP\u2019s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging.\u003c/p\u003e\n\u003cp\u003eThe shell is designed to run actions as a supplied MISP user ID. However, the legacy \u003ccode\u003eSysLogLogable\u003c/code\u003e behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP\u2019s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging.\n\n\nThe shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user.\n\n\n\nVersion affected: \u22642.5.45"
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-778",
              "description": "CWE-778 Insufficient Logging",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-223",
              "description": "CWE-223 Omission of Security-relevant Information in Log Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:37:54.001Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/d13e5db33"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces a process-wide static identity (setShellUser) on SysLogLogableBehavior that is resolved at write time rather than at setup time, so it survives lazy model loads that re-run setup() on the singleton. The behavior appends \u0027via CLI\u0027 to the log description for shell-originated rows, mirroring the request_type = CLI marker in the new audit engine. The CLI shell now publishes the impersonated user through both Configure::write(\u0027CurrentUserId\u0027) and SysLogLogableBehavior::setShellUser() before any write. Explicit extralog calls were added for CLI user edit, disable, and delete operations so the default audit engine records them the same way the web path does. Background jobs that publish no user continue to log as SYSTEM without a CLI marker.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces a process-wide static identity (setShellUser) on SysLogLogableBehavior that is resolved at write time rather than at setup time, so it survives lazy model loads that re-run setup() on the singleton. The behavior appends \u0027via CLI\u0027 to the log description for shell-originated rows, mirroring the request_type = CLI marker in the new audit engine. The CLI shell now publishes the impersonated user through both Configure::write(\u0027CurrentUserId\u0027) and SysLogLogableBehavior::setShellUser() before any write. Explicit extralog calls were added for CLI user edit, disable, and delete operations so the default audit engine records them the same way the web path does. Background jobs that publish no user continue to log as SYSTEM without a CLI marker."
        }
      ],
      "title": "MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The tag_version_boundary indicates the fix commit is 183 commits after tag v2.5.46, suggesting the fix landed in a version after 2.5.46; however, no explicit fixed version tag is provided, so the exact boundary is uncertain.",
                  "The affected version range is assumed to be all versions prior to the fix commit; the patch does not specify a minimum affected version.",
                  "CVSS PR:H assumes that CLI shell access is equivalent to site-admin-equivalent access, consistent with the project\u0027s own CLI_usage.md documentation stating that running cake requires reading database.php and that the shell should not be exposed to anyone who must not have site-admin-equivalent access.",
                  "The SI:L rating assumes the audit-log inaccuracy is a secondary integrity impact on the logging subsystem rather than a primary integrity impact on the MISP application data.",
                  "The patch does not include a CVE or GCVE identifier; this analysis is a draft for CNA/GNA review."
                ],
                "commit": "d13e5db33faa8eb27c945d6561badc24f00b2cda",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Scottish Government - National Cyber Team"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Fable 5.1"
                  }
                ],
                "cvssRationale": "Attack vector is Local because the CLI shell requires direct access to the MISP host and the ability to run the cake console command. Attack complexity is Low because no race condition or special timing is needed; the identity loss occurs deterministically on the first lazy model load. No attack target is required. Privileges Required is High because running the CLI shell requires reading app/Config/database.php and passing a user ID, which the project documentation equates to site-admin-equivalent access. No user interaction is needed. There is no direct confidentiality, integrity, or availability impact on the MISP application itself. The secondary integrity impact is Low: the audit log data is inaccurate (wrong user attribution, missing CLI marker, missing user-management entries), which degrades forensic and compliance capability but does not corrupt application data. No secondary availability impact.",
                "draft": false,
                "fixSummary": "The fix introduces a process-wide static identity (setShellUser) on SysLogLogableBehavior that is resolved at write time rather than at setup time, so it survives lazy model loads that re-run setup() on the singleton. The behavior appends \u0027via CLI\u0027 to the log description for shell-originated rows, mirroring the request_type = CLI marker in the new audit engine. The CLI shell now publishes the impersonated user through both Configure::write(\u0027CurrentUserId\u0027) and SysLogLogableBehavior::setShellUser() before any write. Explicit extralog calls were added for CLI user edit, disable, and delete operations so the default audit engine records them the same way the web path does. Background jobs that publish no user continue to log as SYSTEM without a CLI marker.",
                "generatedAt": "2026-09-14T12:23:30.990762Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "8ea0cae590f0d9a3a2fa579b800f69fb5f5f8c9083de74df05945869dd3e91bf",
                "patchSummary": "In cli_common.php, __setUserContext() was replaced: instead of iterating loaded models and setting the user on each SysLogLogable behavior instance, it now calls Configure::write(\u0027CurrentUserId\u0027, $user[\u0027id\u0027]) and SysLogLogableBehavior::setShellUser($user). In SysLogLogableBehavior.php, a private static $shellUser property and setShellUser() static method were added; _saveLog() now resolves the actor via shellActor() at write time when CAKEPHP_SHELL is defined, and appends \u0027 via CLI\u0027 to the description. setup() was refactored to use the same shellActor() helper. In cli_users.php, __logUserEdit() was added to write an extralog row for user edits and disables, and __deleteUser() now calls extralog for permanent deletions. A new test file SysLogLogableShellIdentityTest.php (395 lines) covers identity persistence across lazy model attaches, CLI marker presence/absence, SYSTEM fallback, and web-request isolation. CLI_usage.md documents the audit-trail behavior.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "d13e5db33faa8eb27c945d6561badc24f00b2cda",
                    "patchSha256": "8ea0cae590f0d9a3a2fa579b800f69fb5f5f8c9083de74df05945869dd3e91bf",
                    "source": "https://github.com/MISP/MISP/commit/d13e5db33.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/d13e5db33.patch",
                    "subject": "fix: [cli] Attribute interactive CLI shell writes stably and"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/d13e5db33.patch",
                "subject": "fix: [cli] Attribute interactive CLI shell writes stably and",
                "tagVersionBoundary": {
                  "commits_after_fix": 183,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-778",
                    "rationale": "The CLI shell\u0027s audit rows lost the impersonated user identity after the first lazy model load (reset to SYSTEM), and user-management operations (edit, disable, delete) performed via CLI produced no audit row at all in the default engine. Both are failures to record security-relevant events with sufficient detail."
                  },
                  {
                    "cweId": "CWE-223",
                    "rationale": "Audit rows written by the CLI shell carried no marker distinguishing them from web-originated actions. In the default engine the description lacked \u0027via CLI\u0027; in the new engine request_type was not set to CLI. This omission prevents an investigator from determining the true origin of an action."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20197"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-90955",
    "datePublished": "2026-09-14T12:37:54.001Z",
    "dateReserved": "2026-09-14T12:37:52.348Z",
    "dateUpdated": "2026-09-14T13:00:29.069Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-90957",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T13:58:18.267352Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T13:58:30.297Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "RestResponseComponent (sendFile / sandboxInlineFile)",
            "OrganisationsController (getOrgLogo)",
            "Server model (enable_svg_logos setting)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/Component/RestResponseComponent.php",
            "app/Controller/OrganisationsController.php",
            "app/Model/Server.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Scottish Government - National Cyber Team"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox.\u003c/p\u003e\n\u003cp\u003eThe commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal \u003ccode\u003e\u0026lt;img\u0026gt;\u003c/code\u003e, they can execute when the SVG is navigated to directly or embedded as a document. In that case, malicious \u003ccode\u003e\u0026lt;script\u0026gt;\u003c/code\u003e elements, event handlers, or \u003ccode\u003ejavascript:\u003c/code\u003e URLs execute on the MISP origin with the viewer\u2019s session.\u003c/p\u003e\n\u003cp\u003eThe affected use cases include:\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u2003- organisation SVG logos;\u003cbr\u003e\u003cdiv\u003e\u2003-\u0026nbsp;event-report SVG pictures.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eImportantly, the vulnerable behavior is on the \u003cstrong\u003eserve path\u003c/strong\u003e, not merely the upload path: the patch notes that a malicious SVG uploaded while SVG support was enabled could remain dangerous even after uploads were later disabled.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox.\n\n\nThe commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal \u003cimg\u003e, they can execute when the SVG is navigated to directly or embedded as a document. In that case, malicious \u003cscript\u003e elements, event handlers, or javascript: URLs execute on the MISP origin with the viewer\u2019s session.\n\n\nThe affected use cases include:\n\n\n\n\u2003- organisation SVG logos;\n\u2003-\u00a0event-report SVG pictures.\n\n\n\n\n\n\nImportantly, the vulnerable behavior is on the serve path, not merely the upload path: the patch notes that a malicious SVG uploaded while SVG support was enabled could remain dangerous even after uploads were later disabled.\n\n\n\nVersion affected: \u22642.5.45"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63 Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input in Web Page (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693 Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T13:03:01.748Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/86496aecc"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA new sandboxInlineFile() method is added to RestResponseComponent. When a file is served inline (download=false) and its type is SVG (svg, svgz, or image/svg+xml), the response is augmented with a Content-Security-Policy header containing the sandbox directive (which assigns an opaque origin and disables script execution, plugins, and form submission) along with restrictive default-src, style-src, img-src, and font-src directives that still permit rendering of inline styles, embedded raster images, and data: fonts. An X-Content-Type-Options: nosniff header is also set. The method is invoked from both the generic sendFile() path and the org-logo endpoint. The enable_svg_logos setting description is updated to warn administrators that SVG files remain XML documents and should be left disabled unless required.\u003c/p\u003e"
            }
          ],
          "value": "A new sandboxInlineFile() method is added to RestResponseComponent. When a file is served inline (download=false) and its type is SVG (svg, svgz, or image/svg+xml), the response is augmented with a Content-Security-Policy header containing the sandbox directive (which assigns an opaque origin and disables script execution, plugins, and form submission) along with restrictive default-src, style-src, img-src, and font-src directives that still permit rendering of inline styles, embedded raster images, and data: fonts. An X-Content-Type-Options: nosniff header is also set. The method is invoked from both the generic sendFile() path and the org-logo endpoint. The enable_svg_logos setting description is updated to warn administrators that SVG files remain XML documents and should be left disabled unless required."
        }
      ],
      "title": "MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The enable_svg_logos setting must be enabled (or was previously enabled and SVG files were uploaded) for the vulnerability to be exploitable; the default value is false.",
                  "The attacker requires an authenticated MISP account with sufficient privileges to upload an organisation logo or attach a report picture.",
                  "The victim must be an authenticated MISP user whose session is active in the browser when the SVG is loaded as a document.",
                  "The fix is included in MISP v2.5.46 based on the tag boundary metadata (186 commits after the fix commit up to that tag); the exact version in which the vulnerability was introduced is not specified in the patch.",
                  "CVSS UI:P assumes the primary exploitation path requires the victim to navigate to the SVG URL or have it embedded in an object/iframe; if an attacker can embed the SVG in a page the victim is already viewing without additional interaction, UI:N would apply."
                ],
                "commit": "86496aecc35565c121820b8e60eac9508a516eb3",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Scottish Government - National Cyber Team"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The malicious SVG is delivered over HTTP/HTTPS to the victim\u0027s browser. AC:L: No race conditions or special network conditions are required; the SVG is already stored and served by the application. AT:N: No specific attack requirements beyond the SVG being present in the MISP instance. PR:L: The attacker needs an authenticated MISP account with permission to upload an organisation logo or attach a report picture. UI:P: The victim must navigate to the SVG URL or have it loaded in an \u003cobject\u003e/\u003ciframe\u003e context; it does not execute when rendered via \u003cimg\u003e. VC/VI/VA:N: The MISP server itself is not compromised; the impact is on the client-side session. SC:H: The attacker gains full read access to the victim\u0027s MISP session (threat intelligence, events, users, settings). SI:H: The attacker can perform write operations (create/modify/delete events, change settings) as the victim. SA:N: No availability impact on the victim\u0027s browser or the MISP instance.",
                "draft": false,
                "fixSummary": "A new sandboxInlineFile() method is added to RestResponseComponent. When a file is served inline (download=false) and its type is SVG (svg, svgz, or image/svg+xml), the response is augmented with a Content-Security-Policy header containing the sandbox directive (which assigns an opaque origin and disables script execution, plugins, and form submission) along with restrictive default-src, style-src, img-src, and font-src directives that still permit rendering of inline styles, embedded raster images, and data: fonts. An X-Content-Type-Options: nosniff header is also set. The method is invoked from both the generic sendFile() path and the org-logo endpoint. The enable_svg_logos setting description is updated to warn administrators that SVG files remain XML documents and should be left disabled unless required.",
                "generatedAt": "2026-09-14T12:47:25.185745Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "e2053fbcffe3476b10ba07239b8772c7760ad987e4574c0bff75f68f8cc05c98",
                "patchSummary": "Adds RestResponseComponent::sandboxInlineFile(CakeResponse, string) which checks the file type against a whitelist of SVG identifiers (svg, svgz, image/svg+xml, case-insensitive) and, on match, sets Content-Security-Policy: default-src \u0027none\u0027; style-src \u0027unsafe-inline\u0027; img-src \u0027self\u0027 data:; font-src data:; frame-ancestors \u0027self\u0027; sandbox and X-Content-Type-Options: nosniff. Calls this method from sendFile() when download is false, and from OrganisationsController::getOrgLogo() after the file response is built. Updates the enable_svg_logos setting description in Server.php to reflect the sandboxing behaviour and advise leaving the setting disabled. Adds a new PHPUnit test file RestResponseSandboxInlineFileTest.php with cases covering SVG extension, MIME type, svgz, case-insensitivity, and confirmation that raster types (png, jpg, jpeg, gif, webp) and null/empty types receive no headers.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "86496aecc35565c121820b8e60eac9508a516eb3",
                    "patchSha256": "e2053fbcffe3476b10ba07239b8772c7760ad987e4574c0bff75f68f8cc05c98",
                    "source": "https://github.com/MISP/MISP/commit/86496aecc.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/86496aecc.patch",
                    "subject": "fix: [security] Sandbox inline-served SVG images"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/86496aecc.patch",
                "subject": "fix: [security] Sandbox inline-served SVG images",
                "tagVersionBoundary": {
                  "commits_after_fix": 186,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "The core issue is that user-supplied SVG content (an XML document capable of embedding script) is served inline on the application origin without any mechanism to prevent script execution, resulting in stored XSS. The fix neutralises the script-execution capability via a sandboxing CSP."
                  },
                  {
                    "cweId": "CWE-693",
                    "rationale": "The upload-time restriction (enable_svg_logos) was the only protection, and it was insufficient because (a) it could be toggled off after files were already stored, and (b) it did not address the serve path at all. The serve path lacked its own protection mechanism (sandboxing CSP), which is what the patch adds."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20098"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-90957",
    "datePublished": "2026-09-14T13:03:01.748Z",
    "dateReserved": "2026-09-14T13:02:53.577Z",
    "dateUpdated": "2026-09-14T13:58:30.297Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-90961",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T13:55:28.674675Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T13:55:49.225Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "LdapAuth plugin (app/Plugin/LdapAuth/Controller/Component/Auth/LdapAuthenticate.php)",
            "LinOTPAuth plugin (app/Plugin/LinOTPAuth/Controller/Component/Auth/LinOTPAuthenticate.php)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Plugin/LdapAuth/Controller/Component/Auth/LdapAuthenticate.php",
            "app/Plugin/LinOTPAuth/Controller/Component/Auth/LinOTPAuthenticate.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "elhoim (David Andr\u00e9)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass vulnerability. Both LdapAuthenticate and LinOTPAuthenticate replace CakePHP\u0027s FormAuthenticate class but fail to replicate its _checkFields() input validation guard. As a result, the email and password fields extracted from the login request are passed to downstream authentication logic without verifying that they are non-empty strings.\u003c/p\u003e\u003cp\u003eIn the LDAP authenticator, an empty or null password is forwarded to ldap_bind(). Per RFC 4513 section 5.1.2, a bind request with a valid DN and an empty password constitutes an unauthenticated bind, which many LDAP directory servers accept as successful. An attacker who knows any valid user email address in the directory can therefore authenticate as that user without possessing a password. Additionally, non-string values (null, false, arrays) are either coerced to empty strings by ldap_bind(), raise TypeErrors, or are misinterpreted as find conditions in _findUser(), all of which can lead to unintended authentication outcomes.\u003c/p\u003e\u003cp\u003eIn the LinOTP authenticator, the same missing guard allows non-string credentials to be concatenated into the LinOTP verification request, and in the mixed-authentication branch an empty password is accepted against a stored hash of the empty string.\u003c/p\u003e\u003cp\u003eA secondary issue in the LDAP authenticator is that newly created user accounts (auto-provisioned on first LDAP login) were assigned an empty password. Because the save path skips validation, the empty string is hashed and stored. If the user later ceases to be found in LDAP and the mixed-authentication fallback is used, the stored hash of the empty string verifies against an empty password, again permitting unauthenticated access.\u003c/p\u003e\u003cp\u003eThe vulnerability requires that the affected plugin (LdapAuth or LinOTPAuth) is enabled on the MISP instance and that the attacker knows at least one valid email address registered in the directory or MISP user store. No prior authentication is required. Successful exploitation grants the attacker the full privileges of the impersonated user, which may include administrative access to threat intelligence data.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass vulnerability. Both LdapAuthenticate and LinOTPAuthenticate replace CakePHP\u0027s FormAuthenticate class but fail to replicate its _checkFields() input validation guard. As a result, the email and password fields extracted from the login request are passed to downstream authentication logic without verifying that they are non-empty strings.\n\nIn the LDAP authenticator, an empty or null password is forwarded to ldap_bind(). Per RFC 4513 section 5.1.2, a bind request with a valid DN and an empty password constitutes an unauthenticated bind, which many LDAP directory servers accept as successful. An attacker who knows any valid user email address in the directory can therefore authenticate as that user without possessing a password. Additionally, non-string values (null, false, arrays) are either coerced to empty strings by ldap_bind(), raise TypeErrors, or are misinterpreted as find conditions in _findUser(), all of which can lead to unintended authentication outcomes.\n\nIn the LinOTP authenticator, the same missing guard allows non-string credentials to be concatenated into the LinOTP verification request, and in the mixed-authentication branch an empty password is accepted against a stored hash of the empty string.\n\nA secondary issue in the LDAP authenticator is that newly created user accounts (auto-provisioned on first LDAP login) were assigned an empty password. Because the save path skips validation, the empty string is hashed and stored. If the user later ceases to be found in LDAP and the mixed-authentication fallback is used, the stored hash of the empty string verifies against an empty password, again permitting unauthenticated access.\n\nThe vulnerability requires that the affected plugin (LdapAuth or LinOTPAuth) is enabled on the MISP instance and that the attacker knows at least one valid email address registered in the directory or MISP user store. No prior authentication is required. Successful exploitation grants the attacker the full privileges of the impersonated user, which may include administrative access to threat intelligence data.\n\n\nVersion affected: \u22642.5.45"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T13:22:07.185Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/0ee058548"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix adds explicit type and emptiness validation for the email and password fields in both LdapAuthenticate and LinOTPAuthenticate before any authentication logic is invoked. Non-string or empty credentials are rejected with a logged error and a false return. Additionally, the LDAP authenticator now assigns a cryptographically random password to auto-provisioned user accounts instead of an empty string, preventing the stored hash of \u0027\u0027 from being verifiable in the mixed-authentication fallback path. The LinOTP authenticator also rejects an empty password specifically in the mixed-authentication branch where the password is checked against the local database.\u003c/p\u003e"
            }
          ],
          "value": "The fix adds explicit type and emptiness validation for the email and password fields in both LdapAuthenticate and LinOTPAuthenticate before any authentication logic is invoked. Non-string or empty credentials are rejected with a logged error and a false return. Additionally, the LDAP authenticator now assigns a cryptographically random password to auto-provisioned user accounts instead of an empty string, preventing the stored hash of \u0027\u0027 from being verifiable in the mixed-authentication fallback path. The LinOTP authenticator also rejects an empty password specifically in the mixed-authentication branch where the password is checked against the local database."
        }
      ],
      "title": "MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The LDAP directory server is configured to accept unauthenticated (empty-password) binds, which is common but not universal; if the directory rejects empty-password binds, the LDAP-specific bypass is mitigated at the directory level, though the non-string credential and empty-password-hash issues remain.",
                  "The attacker must know at least one valid email address that exists in the LDAP directory or MISP user store.",
                  "The LdapAuth or LinOTPAuth plugin is enabled on the affected MISP instance.",
                  "CVSS impact ratings assume the attacker can impersonate a user with high privileges (e.g., admin); actual impact scales with the privileges of the specific user impersonated.",
                  "The exact fixed version is not specified in the patch metadata; the fix commit is 238 commits after tag v2.5.46, suggesting the fix landed in a release after 2.5.46, but the precise version boundary is unconfirmed.",
                  "The LinOTP empty-password bypass in the mixed-auth branch requires the mixedauth setting to be enabled."
                ],
                "commit": "0ee0585486cd2c9df49e4f14d48a32a953666e3a",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "elhoim (David Andr\u00e9)"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The vulnerability is exploitable over the network via the MISP web login endpoint. AC:L: Exploitation requires only sending a login request with an empty or non-string password field; no race conditions, specific directory configuration beyond accepting unauthenticated binds (which is common), or other special conditions are needed. AT:N: No attack target manipulation is required. PR:N: No prior authentication is needed; the attacker is attempting to authenticate. UI:N: No user interaction is required. VC:H: Successful exploitation grants the attacker the full data-access privileges of the impersonated user, potentially including all MISP threat intelligence data. VI:H: The attacker can create, modify, or delete MISP objects, tags, and configurations at the privilege level of the impersonated user. VA:N: No direct availability impact is demonstrated. SC/SI/SA:N: No separate subsequent system is identified; the impact is contained to the MISP instance itself.",
                "draft": false,
                "fixSummary": "The fix adds explicit type and emptiness validation for the email and password fields in both LdapAuthenticate and LinOTPAuthenticate before any authentication logic is invoked. Non-string or empty credentials are rejected with a logged error and a false return. Additionally, the LDAP authenticator now assigns a cryptographically random password to auto-provisioned user accounts instead of an empty string, preventing the stored hash of \u0027\u0027 from being verifiable in the mixed-authentication fallback path. The LinOTP authenticator also rejects an empty password specifically in the mixed-authentication branch where the password is checked against the local database.",
                "generatedAt": "2026-09-14T13:14:35.161935Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 6,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "01b60b396532e5f6ff5efca8c41961e701b7b6c539edcf49ad29aba06a906149",
                "patchSummary": "In LdapAuthenticate.php: (1) email and password are now extracted with isset() defaults to empty string; (2) a guard clause checks is_string() and non-emptiness for both fields, logging an error and returning false on failure; (3) the auto-provisioned user creation block now calls $userModel-\u003egenerateRandomPassword() and stores that value in both \u0027password\u0027 and \u0027confirm_password\u0027 fields instead of empty strings. In LinOTPAuthenticate.php: (1) email, password, and otp are extracted with isset() defaults; (2) a guard clause checks is_string() and non-emptiness for email and is_string() for password, logging and returning false on failure; (3) in the mixed-authentication branch, an additional check rejects an empty password before calling _findUser().",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "0ee0585486cd2c9df49e4f14d48a32a953666e3a",
                    "patchSha256": "01b60b396532e5f6ff5efca8c41961e701b7b6c539edcf49ad29aba06a906149",
                    "source": "https://github.com/MISP/MISP/commit/0ee058548.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/0ee058548.patch",
                    "subject": "fix: [security] Reject empty and non-string credentials in"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/0ee058548.patch",
                "subject": "fix: [security] Reject empty and non-string credentials in",
                "tagVersionBoundary": {
                  "commits_after_fix": 238,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-287",
                    "rationale": "The primary impact is an authentication bypass: empty or non-string credentials allow an unauthenticated attacker to be authenticated as a known directory user. The root cause is the absence of the credential validation guard that FormAuthenticate normally provides."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "The underlying technical weakness is the failure to validate that user-supplied credential fields are non-empty strings before passing them to ldap_bind(), the LinOTP verifier, or _findUser(). Non-string types (null, false, arrays) and empty strings are all accepted and produce unintended authentication behavior."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20246"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-90961",
    "datePublished": "2026-09-14T13:22:07.185Z",
    "dateReserved": "2026-09-14T13:22:04.165Z",
    "dateUpdated": "2026-09-14T13:55:49.225Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91825",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T13:59:42.790533Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T14:19:38.987Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "EventsController (edit action)",
            "Event model (_edit method)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/EventsController.php",
            "app/Model/Event.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path.\u003c/p\u003e\n\u003cp\u003eThe vulnerable logic checked whether the acting user could use a \u003ccode\u003esharing_group_id\u003c/code\u003e only when the request explicitly supplied \u003ccode\u003edistribution = 4\u003c/code\u003e. If the attacker instead omitted \u003ccode\u003edistribution\u003c/code\u003e but supplied a different \u003ccode\u003esharing_group_id\u003c/code\u003e, that authorization branch was skipped. Later, MISP\u2019s field-recovery logic restored the existing event distribution from storage. For events already configured with sharing-group distribution, the unauthorized sharing-group ID could therefore be saved.\u003c/p\u003e\n\u003cp\u003eThe fix adds authorization checks in both the controller and \u003ccode\u003eEvent::_edit()\u003c/code\u003e whenever a non-empty \u003ccode\u003esharing_group_id\u003c/code\u003e is supplied without \u003ccode\u003edistribution\u003c/code\u003e. The model now calls \u003ccode\u003eSharingGroup::checkIfAuthorised()\u003c/code\u003e before persisting the change.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path.\n\n\nThe vulnerable logic checked whether the acting user could use a sharing_group_id only when the request explicitly supplied distribution = 4. If the attacker instead omitted distribution but supplied a different sharing_group_id, that authorization branch was skipped. Later, MISP\u2019s field-recovery logic restored the existing event distribution from storage. For events already configured with sharing-group distribution, the unauthorized sharing-group ID could therefore be saved.\n\n\nThe fix adds authorization checks in both the controller and Event::_edit() whenever a non-empty sharing_group_id is supplied without distribution. The model now calls SharingGroup::checkIfAuthorised() before persisting the change.\n\n\n\nVersion affected: \u22642.5.45"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T08:06:32.511Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/cf3ee4026"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix adds an explicit authorization check for the sharing_group_id in the code path where the distribution field is omitted from the edit request. In the controller, if no distribution is submitted but a sharing_group_id is present and differs from the stored value, the user\u0027s access to that sharing group is verified via checkIfCanBeUsed before the edit proceeds. In the model\u0027s _edit method, a parallel check via checkIfAuthorised is added for the same condition, returning an error if the user is not authorized for the submitted sharing group. This closes the gap where omitting the distribution field bypassed the existing authorization gate.\u003c/p\u003e"
            }
          ],
          "value": "The fix adds an explicit authorization check for the sharing_group_id in the code path where the distribution field is omitted from the edit request. In the controller, if no distribution is submitted but a sharing_group_id is present and differs from the stored value, the user\u0027s access to that sharing group is verified via checkIfCanBeUsed before the edit proceeds. In the model\u0027s _edit method, a parallel check via checkIfAuthorised is added for the same condition, returning an error if the user is not authorized for the submitted sharing group. This closes the gap where omitting the distribution field bypassed the existing authorization gate."
        }
      ],
      "title": "MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary (v2.5.46 with 216 commits after fix); no explicit fixed version tag is provided in the metadata, so the boundary is approximate.",
                  "The attacker must already possess authenticated edit access to at least one event in MISP; the vulnerability does not grant access to users without any event edit permission.",
                  "The impact assessment assumes the unauthorized sharing group contains other users who would gain visibility into the event data; if the target group is empty, the confidentiality impact is reduced.",
                  "The patch was found during internal review per the commit message; no external reporter or finder is identified in the metadata."
                ],
                "commit": "cf3ee40265ee102f28dae9ec313abe4162aff8e3",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The attack requires only omitting a field from a standard edit request; no race condition or complex manipulation is needed. AT:N: No prior user interaction or attack preparation is required. PR:L: The attacker must be an authenticated user with edit access to at least one event. UI:N: No victim interaction is needed. VC:L: Event data may be exposed to members of the unauthorized sharing group. VI:H: The event\u0027s sharing group assignment is modified without authorization, directly compromising data integrity. VA:N: No availability impact. SC/SI/SA: No secondary system impact is evidenced; the impact is confined to the MISP instance\u0027s data integrity and the confidentiality of the affected event record.",
                "draft": false,
                "fixSummary": "The fix adds an explicit authorization check for the sharing_group_id in the code path where the distribution field is omitted from the edit request. In the controller, if no distribution is submitted but a sharing_group_id is present and differs from the stored value, the user\u0027s access to that sharing group is verified via checkIfCanBeUsed before the edit proceeds. In the model\u0027s _edit method, a parallel check via checkIfAuthorised is added for the same condition, returning an error if the user is not authorized for the submitted sharing group. This closes the gap where omitting the distribution field bypassed the existing authorization gate.",
                "generatedAt": "2026-09-15T07:50:41.743787Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 4,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "5229e7ba08a4a77a41d8205ce51428ae17242c7dc7873bc4c087fb828631869e",
                "patchSummary": "Two files are modified with 25 lines of insertions. In EventsController.php (edit method), a new else-if branch is added after the existing distribution-handling logic: when distribution is not set, sharing_group_id is non-empty, and it differs from the stored value, the code calls SharingGroup-\u003echeckIfCanBeUsed() and throws MethodNotAllowedException on failure. In Event.php (_edit method), a new elseif branch is added for the case where distribution is not set in the submitted data but sharing_group_id is present; it calls SharingGroup-\u003echeckIfAuthorised() and returns an error array if the user lacks access. Both additions are narrowly scoped to the omitted-distribution path and do not alter behavior for explicitly stated non-4 distribution values.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "cf3ee40265ee102f28dae9ec313abe4162aff8e3",
                    "patchSha256": "5229e7ba08a4a77a41d8205ce51428ae17242c7dc7873bc4c087fb828631869e",
                    "source": "https://github.com/MISP/MISP/commit/cf3ee4026.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/cf3ee4026.patch",
                    "subject": "fix: [security] Authorise the event sharing group when"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/cf3ee4026.patch",
                "subject": "fix: [security] Authorise the event sharing group when",
                "tagVersionBoundary": {
                  "commits_after_fix": 216,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The authorization check for the sharing_group_id was conditionally executed only when the distribution field was explicitly set to 4. By omitting the distribution field, an attacker bypassed the authorization gate entirely, allowing an unauthorized sharing group assignment to be persisted. The check existed but was not applied to all code paths that could result in the sharing group being saved."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20122"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-91825",
    "datePublished": "2026-09-15T08:06:32.511Z",
    "dateReserved": "2026-09-15T08:06:29.530Z",
    "dateUpdated": "2026-09-15T14:19:38.987Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91846",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T13:41:15.313807Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T13:50:14.847Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "CollectionElementsController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/CollectionElementsController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object.\u003c/p\u003e\n\u003cp\u003eThe commit explains that collection elements themselves only store UUIDs, while the collection view later resolves those UUIDs into their underlying objects. Before this fix, the generic \u003ccode\u003eadd()\u003c/code\u003e path could therefore persist a UUID for an Event or Galaxy Cluster that the caller could not normally read. The patch explicitly notes that this made collections a way to reference another organisation\u2019s private data and had caused disclosure of organisation-only events in the beta collection view.\u003c/p\u003e\n\u003cp\u003eThe fix centralizes authorization in \u003ccode\u003e__assertCanUseElements()\u003c/code\u003e. Event UUIDs are validated through \u003ccode\u003eEvent::fetchSimpleEvent()\u003c/code\u003e under the current user\u2019s ACL, while Galaxy Cluster UUIDs are checked through \u003ccode\u003eGalaxyCluster::fetchGalaxyClusters()\u003c/code\u003e. The check is applied both to the CRUD \u003ccode\u003eadd()\u003c/code\u003e path and to \u003ccode\u003eaddElementToCollection()\u003c/code\u003e.\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object.\n\n\nThe commit explains that collection elements themselves only store UUIDs, while the collection view later resolves those UUIDs into their underlying objects. Before this fix, the generic add() path could therefore persist a UUID for an Event or Galaxy Cluster that the caller could not normally read. The patch explicitly notes that this made collections a way to reference another organisation\u2019s private data and had caused disclosure of organisation-only events in the beta collection view.\n\n\nThe fix centralizes authorization in __assertCanUseElements(). Event UUIDs are validated through Event::fetchSimpleEvent() under the current user\u2019s ACL, while Galaxy Cluster UUIDs are checked through GalaxyCluster::fetchGalaxyClusters(). The check is applied both to the CRUD add() path and to addElementToCollection().\n\nVersion affected: \u22642.5.45"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T08:36:22.825Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/334d53709"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces a dedicated __assertCanUseElements() authorization guard that is invoked in the beforeSave callback of the add() CRUD path (covering both form and REST submission) and in addElementToCollection(). For each element UUID, the method resolves the element type (deducing it if the caller omitted the field, preventing bypass by omission) and performs an ACL-aware lookup: for Events it calls fetchSimpleEvent() scoped to the current user, and for GalaxyClusters it calls fetchGalaxyClusters() with the user context. If the object does not exist or the caller lacks access, a NotFoundException is raised and the save is aborted. This ensures that no collection element can reference an object the caller is not authorized to read.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces a dedicated __assertCanUseElements() authorization guard that is invoked in the beforeSave callback of the add() CRUD path (covering both form and REST submission) and in addElementToCollection(). For each element UUID, the method resolves the element type (deducing it if the caller omitted the field, preventing bypass by omission) and performs an ACL-aware lookup: for Events it calls fetchSimpleEvent() scoped to the current user, and for GalaxyClusters it calls fetchGalaxyClusters() with the user context. If the object does not exist or the caller lacks access, a NotFoundException is raised and the save is aborted. This ensures that no collection element can reference an object the caller is not authorized to read."
        }
      ],
      "title": "MISP Collection Element Add Missing Authorization on Referenced Object UUID",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is not explicitly stated in the patch; the tag boundary indicates the fix is 204 commits after v2.5.46, but the exact fixed release version is unconfirmed.",
                  "PR:L assumes the attacker needs only a basic authenticated MISP account with collection-element management rights; if a higher privilege level is required, PR should be raised.",
                  "The commit message references \u0027V17\u0027 as a related disclosure scenario; this is treated as internal context and not used to expand the affected scope.",
                  "The deduceType() fallback path is assumed to be reachable by an attacker omitting the element_type field, which the patch explicitly guards against."
                ],
                "commit": "334d537095971df4855a4a4d9d9da0d6fd93d0df",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The attacker simply submits a UUID to the existing add endpoint; no race condition or complex bypass is needed. AT:N: No prior compromise or user interaction is required. PR:L: An authenticated MISP user with permission to manage collection elements is required. UI:N: No victim interaction is needed; the disclosure occurs when the attacker views their own collection. VC:L: The attacker gains read access to Events or GalaxyClusters belonging to other organizations or restricted scopes. VI:L: Unauthorized references are persisted in the collection, altering data integrity. VA:N: No availability impact. SC/SI/SA:N: No impact on adjacent systems.",
                "draft": false,
                "fixSummary": "The fix introduces a dedicated __assertCanUseElements() authorization guard that is invoked in the beforeSave callback of the add() CRUD path (covering both form and REST submission) and in addElementToCollection(). For each element UUID, the method resolves the element type (deducing it if the caller omitted the field, preventing bypass by omission) and performs an ACL-aware lookup: for Events it calls fetchSimpleEvent() scoped to the current user, and for GalaxyClusters it calls fetchGalaxyClusters() with the user context. If the object does not exist or the caller lacks access, a NotFoundException is raised and the save is aborted. This ensures that no collection element can reference an object the caller is not authorized to read.",
                "generatedAt": "2026-09-15T08:32:37.109406Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 4,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "259d46cb772765da8e97cb71e005610ab690f9f92b29e58b0a95aabe71fb0bdf",
                "patchSummary": "In app/Controller/CollectionElementsController.php, a new private method __assertCanUseElements() is added (approximately 45 lines) that iterates over normalized element UUIDs, deduces the element type when not explicitly supplied, and performs an ACL-scoped existence check via Event::fetchSimpleEvent() or GalaxyCluster::fetchGalaxyClusters(). The add() method\u0027s beforeSave closure is modified to call this guard before persisting the row. The addElementToCollection() method is refactored to replace its inline Event-only check with a call to the same __assertCanUseElements() helper, gaining GalaxyCluster coverage. Net change: 53 insertions, 12 deletions in one file.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "334d537095971df4855a4a4d9d9da0d6fd93d0df",
                    "patchSha256": "259d46cb772765da8e97cb71e005610ab690f9f92b29e58b0a95aabe71fb0bdf",
                    "source": "https://github.com/MISP/MISP/commit/334d53709.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/334d53709.patch",
                    "subject": "fix: [acl] Authorise the object a collection element points"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/334d53709.patch",
                "subject": "fix: [acl] Authorise the object a collection element points",
                "tagVersionBoundary": {
                  "commits_after_fix": 204,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The add() method stored collection element UUIDs without performing any authorization check on the referenced object. The fix adds an explicit ACL verification step before persistence, confirming the original code lacked the required authorization control."
                  },
                  {
                    "cweId": "CWE-639",
                    "rationale": "The attacker-supplied UUID (a user-controlled key) was accepted and stored without verifying that the caller held a valid access grant for that specific object, allowing reference to objects outside the caller\u0027s authorized scope."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20267"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-91846",
    "datePublished": "2026-09-15T08:36:22.825Z",
    "dateReserved": "2026-09-15T08:36:20.997Z",
    "dateUpdated": "2026-09-15T13:50:14.847Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91851",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T13:29:22.086413Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T13:29:55.108Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "DashboardsController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/DashboardsController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eDashboardsController::listTemplates()\u003c/code\u003e allowed a template when either:\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e\u2003-\u0026nbsp;its \u003ccode\u003erestrict_to_permission_flag\u003c/code\u003e matched one of the current user\u2019s permission flags, or\u003c/div\u003e\u003cdiv\u003e\u2003-\u0026nbsp;\u003ccode\u003erestrict_to_permission_flag\u003c/code\u003e equaled integer \u003ccode\u003e0\u003c/code\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003ccode\u003e\u003c/code\u003e\u003c/div\u003e\u003cp\u003e\u003ccode\u003e\u003c/code\u003e\u003c/p\u003e\u003cp\u003eHowever, \u003ccode\u003erestrict_to_permission_flag\u003c/code\u003e is a \u003ccode\u003evarchar\u003c/code\u003e. MySQL therefore performed numeric coercion when comparing the column against integer \u003ccode\u003e0\u003c/code\u003e. Strings such as \u003ccode\u003eperm_site_admin\u003c/code\u003e convert numerically to zero, making expressions such as \u003ccode\u003eperm_site_admin = 0\u003c/code\u003e evaluate true and causing the \u201cunrestricted\u201d branch to match permission-restricted templates as well.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag.\n\n\nDashboardsController::listTemplates() allowed a template when either:\n\n\n\n\u2003-\u00a0its restrict_to_permission_flag matched one of the current user\u2019s permission flags, or\n\n\u2003-\u00a0restrict_to_permission_flag equaled integer 0\n\n\n\n\n\n\nHowever, restrict_to_permission_flag is a varchar. MySQL therefore performed numeric coercion when comparing the column against integer 0. Strings such as perm_site_admin convert numerically to zero, making expressions such as perm_site_admin = 0 evaluate true and causing the \u201cunrestricted\u201d branch to match permission-restricted templates as well.\n\n\n\nVersion affected: \u22642.5.45"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-697",
              "description": "CWE-697 Incorrect Comparison",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T08:50:01.513Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/245b8d63a"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix corrects the type mismatch in the permission flag comparison by replacing the integer literal 0 with the explicit string values \u0027\u0027 and \u00270\u0027, which are the actual database values representing an unrestricted dashboard template. This ensures MySQL performs a proper string-to-string comparison, so only rows genuinely marked as unrestricted are returned, restoring the intended per-permission-level access control on dashboard templates.\u003c/p\u003e"
            }
          ],
          "value": "The fix corrects the type mismatch in the permission flag comparison by replacing the integer literal 0 with the explicit string values \u0027\u0027 and \u00270\u0027, which are the actual database values representing an unrestricted dashboard template. This ensures MySQL performs a proper string-to-string comparison, so only rows genuinely marked as unrestricted are returned, restoring the intended per-permission-level access control on dashboard templates."
        }
      ],
      "title": "MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary (v2.5.46 with 200 commits after fix); no explicit affected or fixed version is stated in the patch metadata.",
                  "The vulnerability requires an authenticated MISP user with any role; the exact minimum privilege level needed to access the listTemplates endpoint is not specified in the patch.",
                  "The impact is assessed as Low confidentiality because the disclosed data is dashboard template definitions (layout, widget configuration) rather than raw threat intelligence or user credentials.",
                  "The MySQL type-coercion behavior described in the commit message and code comments is assumed to be accurate for the MySQL versions supported by MISP."
                ],
                "commit": "245b8d63a3794d048fb88275512fa0d32981f0b8",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "The vulnerability is exploitable over the network (AV:N) via the MISP web interface with low attack complexity (AC:L) and no attack target manipulation (AT:N). It requires a low-privilege authenticated user (PR:L) and no user interaction (UI:N). The impact is limited to confidentiality (VC:L) as restricted dashboard template definitions are disclosed to unauthorized users; there is no integrity or availability impact (VI:N, VA:N) and no secondary effects (SC:N, SI:N, SA:N). The severity is moderate because the disclosed data is dashboard template metadata rather than raw threat intelligence, but it still represents a breach of the intended access control boundary.",
                "draft": false,
                "fixSummary": "The fix corrects the type mismatch in the permission flag comparison by replacing the integer literal 0 with the explicit string values \u0027\u0027 and \u00270\u0027, which are the actual database values representing an unrestricted dashboard template. This ensures MySQL performs a proper string-to-string comparison, so only rows genuinely marked as unrestricted are returned, restoring the intended per-permission-level access control on dashboard templates.",
                "generatedAt": "2026-09-15T08:40:44.690048Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 4,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "ac03cd1103d5fb0998c2406836df41d3449e5a5d6a0a5d2ffc77685eba48e188",
                "patchSummary": "In app/Controller/DashboardsController.php, the listTemplates() method\u0027s query condition was changed from [\u0027Dashboard.restrict_to_permission_flag\u0027 =\u003e 0] to [\u0027Dashboard.restrict_to_permission_flag\u0027 =\u003e [\u0027\u0027, \u00270\u0027]]. A multi-line comment was added explaining that restrict_to_permission_flag is a VARCHAR column and that comparing it to integer 0 causes MySQL to coerce the column, making the clause a no-op. The two values that actually represent unrestricted access are the empty string (column default) and the string \u00270\u0027 (posted by the save form).",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "245b8d63a3794d048fb88275512fa0d32981f0b8",
                    "patchSha256": "ac03cd1103d5fb0998c2406836df41d3449e5a5d6a0a5d2ffc77685eba48e188",
                    "source": "https://github.com/MISP/MISP/commit/245b8d63a.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/245b8d63a.patch",
                    "subject": "fix: [acl] Compare the dashboard template permission flag as"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/245b8d63a.patch",
                "subject": "fix: [acl] Compare the dashboard template permission flag as",
                "tagVersionBoundary": {
                  "commits_after_fix": 200,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-863",
                    "rationale": "The permission-based filter on dashboard templates was effectively bypassed because the type-coerced comparison matched all rows, allowing any authenticated user to access templates restricted to higher-privilege roles. The authorization check was present in code but did not function correctly."
                  },
                  {
                    "cweId": "CWE-697",
                    "rationale": "The root cause is a comparison between a VARCHAR column and an integer literal. MySQL\u0027s implicit type coercion caused the comparison to evaluate to TRUE for all non-numeric string values, making the intended filter a no-op. This is a classic incorrect comparison due to type mismatch."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20010"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-91851",
    "datePublished": "2026-09-15T08:50:01.513Z",
    "dateReserved": "2026-09-15T08:49:59.734Z",
    "dateUpdated": "2026-09-15T13:29:55.108Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}