{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95658",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:34:56.912472Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:35:08.313Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "WorkflowsController",
            "Workflows module execution"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/WorkflowsController.php",
            "app/View/Elements/Workflows/execute_module.ctp"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP\u0027s WorkflowsController exposed the moduleStatelessExecution action in the Security component\u0027s unlockedActions list. In CakePHP, listing an action in unlockedActions disables both the CSRF token check and the field hash validation for that action. Because moduleStatelessExecution executes a workflow module\u0027s exec() method with caller-supplied input and parameters, the absence of CSRF protection allowed an attacker to craft a cross-site form post (or equivalent cross-origin request) that, when submitted by an authenticated site administrator, would cause the administrator\u0027s browser to invoke the action on the MISP instance.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThe attacker could select any workflow module to execute, including action modules that write blocklist and warninglist entries, and supply arbitrary input and parameters of their choosing. This constitutes a cross-site request forgery (CSRF) vulnerability with high integrity impact on the MISP instance\u0027s security-related data.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThe vulnerability was identified during an internal security review and was not externally reported. The fix is included in MISP v2.5.47.\u003c/p\u003e"
            }
          ],
          "value": "MISP\u0027s WorkflowsController exposed the moduleStatelessExecution action in the Security component\u0027s unlockedActions list. In CakePHP, listing an action in unlockedActions disables both the CSRF token check and the field hash validation for that action. Because moduleStatelessExecution executes a workflow module\u0027s exec() method with caller-supplied input and parameters, the absence of CSRF protection allowed an attacker to craft a cross-site form post (or equivalent cross-origin request) that, when submitted by an authenticated site administrator, would cause the administrator\u0027s browser to invoke the action on the MISP instance.\u00a0\n\nThe attacker could select any workflow module to execute, including action modules that write blocklist and warninglist entries, and supply arbitrary input and parameters of their choosing. This constitutes a cross-site request forgery (CSRF) vulnerability with high integrity impact on the MISP instance\u0027s security-related data.\u00a0\n\nThe vulnerability was identified during an internal security review and was not externally reported. The fix is included in MISP v2.5.47."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-124",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-124 Cross-Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T12:31:23.222Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/f05e0d1c2"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe moduleStatelessExecution action is removed from the unlockedActions list, restoring the CSRF token check. A new mechanism (_csrfTokenHeaderOnly) is introduced that enforces the CSRF token while exempting only the field hash, which the legitimate caller (the module dialog) cannot produce because it posts a hand-built object. The module dialog\u0027s AJAX request is updated to send the CSRF token in the X-CSRF-Token header, satisfying the token check without requiring a field hash.\u003c/p\u003e"
            }
          ],
          "value": "The moduleStatelessExecution action is removed from the unlockedActions list, restoring the CSRF token check. A new mechanism (_csrfTokenHeaderOnly) is introduced that enforces the CSRF token while exempting only the field hash, which the legitimate caller (the module dialog) cannot produce because it posts a hand-built object. The module dialog\u0027s AJAX request is updated to send the CSRF token in the X-CSRF-Token header, satisfying the token check without requiring a field hash."
        }
      ],
      "title": "MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary metadata (v2.5.47, 6 commits after fix), implying the fix is included in v2.5.47 and prior versions are affected. The exact introduction version of the vulnerable code is unknown.",
                  "UI:A is used because the CSRF attack requires the victim to actively navigate to the attacker\u0027s page or click a link; a purely passive load (e.g., embedded iframe auto-submit) would map to UI:P, but the commit message describes a \u0027cross-site form post\u0027 which typically requires at least a page visit.",
                  "SI:N is chosen because the evidence only demonstrates integrity impact on MISP\u0027s own blocklist and warninglist data; no evidence supports impact on downstream or external systems.",
                  "The CAPEC-124 mapping is confident based on the explicit description of a cross-site form post in the commit message.",
                  "The commit message states the issue was \u0027found during the internal review, not externally reported,\u0027 but does not explicitly name a finder; therefore no finder credit is assigned.",
                  "The _csrfTokenHeaderOnly method is referenced in the patch but its implementation is not shown; it is assumed to enforce CSRF token validation while exempting the field hash, as described in the commit message."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-124",
                    "rationale": "The attack pattern described in the commit message is a cross-site form post that causes an authenticated site admin to execute a workflow module with attacker-chosen parameters. This maps directly to CAPEC-124, which describes an attacker exploiting the trust a web application places in a user\u0027s browser session to perform unauthorized actions. The mapping is confident because the commit message explicitly describes a cross-site form post bypassing CSRF protection."
                  }
                ],
                "commit": "f05e0d1c263b211108644fe6f1600ad7fde9b915",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The attack is delivered over the network via a malicious web page. AC:L: Crafting a cross-site form post is straightforward. AT:N: No special conditions or timing are required. PR:N: The attacker requires no account or privileges on the MISP instance. UI:A: The victim (a site admin) must actively visit the attacker-controlled page or click a link that triggers the form submission. VC:N: No confidentiality impact is evident. VI:H: The attacker can write arbitrary blocklist and warninglist entries, significantly compromising the integrity of MISP\u0027s security data. VA:N: No availability impact. SC/SI/SA:N: No evidence of impact on other systems beyond MISP itself.",
                "fixSummary": "The moduleStatelessExecution action is removed from the unlockedActions list, restoring the CSRF token check. A new mechanism (_csrfTokenHeaderOnly) is introduced that enforces the CSRF token while exempting only the field hash, which the legitimate caller (the module dialog) cannot produce because it posts a hand-built object. The module dialog\u0027s AJAX request is updated to send the CSRF token in the X-CSRF-Token header, satisfying the token check without requiring a field hash.",
                "generatedAt": "2026-09-22T12:15:58.553959Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 6,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "3f8a00ca29761ed6a3986633e60ec67a964e3bfc1dc1e2631a2c2d80df827d30",
                "patchSummary": "In WorkflowsController::beforeFilter(), the line adding \u0027moduleStatelessExecution\u0027 to $this-\u003eSecurity-\u003eunlockedActions is replaced with a call to $this-\u003e_csrfTokenHeaderOnly([\u0027moduleStatelessExecution\u0027]), which enforces CSRF token validation while waiving only the field hash requirement. In execute_module.ctp, the jQuery $.ajax() call is modified to include the header \u0027X-CSRF-Token\u0027 populated from window.csrfToken, so the legitimate client-side caller passes the token check via the header rather than a form field.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "f05e0d1c263b211108644fe6f1600ad7fde9b915",
                    "patchSha256": "3f8a00ca29761ed6a3986633e60ec67a964e3bfc1dc1e2631a2c2d80df827d30",
                    "source": "https://github.com/MISP/MISP/commit/f05e0d1c2.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/f05e0d1c2.patch",
                    "subject": "fix: [security] Keep the CSRF check on stateless workflow"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/f05e0d1c2.patch",
                "subject": "fix: [security] Keep the CSRF check on stateless workflow",
                "tagVersionBoundary": {
                  "commits_after_fix": 6,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-352",
                    "rationale": "The vulnerable action was placed in unlockedActions, which disabled the CSRF token check. This allowed a cross-site form post to trigger a state-changing action (workflow module execution) on behalf of an authenticated administrator, which is the textbook definition of CSRF."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20261"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-95658",
    "datePublished": "2026-09-22T12:31:23.222Z",
    "dateReserved": "2026-09-22T12:31:20.344Z",
    "dateUpdated": "2026-09-22T15:35:08.313Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95659",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:34:30.477077Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:34:41.995Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "AnalystDataController",
            "Overmind theme AnalystData thread element"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/AnalystDataController.php",
            "app/View/Themed/Overmind/Elements/AnalystData/thread.ctp"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Fable 5.1"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim\u0027s browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThe vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme\u0027s AnalystData thread element.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim\u0027s browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.\u00a0\n\nThe vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme\u0027s AnalystData thread element.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-127",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-127 Cross Site Scripting (Reflected)"
            }
          ]
        },
        {
          "capecId": "CAPEC-61",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-61 Cross Site Scripting"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116 Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T12:41:31.639Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/23b879073"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces two layers of defense. First, the viewForObject action now validates the object_type parameter against the AnalystData::valid_targets whitelist and rejects any value not in that list with a NotFoundException, preventing arbitrary strings from reaching the view layer. Second, the two output sinks in the Overmind thread.ctp template now apply the h() HTML-encoding function to the object type before interpolation into translated strings, ensuring that even if a valid type were to contain special characters, it would be rendered as inert text rather than executable markup.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces two layers of defense. First, the viewForObject action now validates the object_type parameter against the AnalystData::valid_targets whitelist and rejects any value not in that list with a NotFoundException, preventing arbitrary strings from reaching the view layer. Second, the two output sinks in the Overmind thread.ctp template now apply the h() HTML-encoding function to the object type before interpolation into translated strings, ensuring that even if a valid type were to contain special characters, it would be rendered as inert text rather than executable markup."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary metadata (v2.5.47 with 58 commits after the fix), suggesting the fix is included in v2.5.47. The exact first affected version is not specified in the patch.",
                  "PR:L assumes the AnalystData viewForObject action requires authentication, which is consistent with MISP\u0027s typical access model but not explicitly confirmed in the patch.",
                  "UI:A assumes the victim must actively navigate to a crafted URL (e.g., click a link). If the malicious URL could be loaded in an iframe or auto-redirected, UI:P might be more appropriate, but the evidence supports active navigation.",
                  "SC:L and SI:L reflect the typical impact of reflected XSS limited to the current page context; a more severe impact (SC:H, SI:H) is possible if the XSS can exfiltrate full session credentials or perform privileged actions, but the patch evidence does not confirm the scope of available data.",
                  "The CAPEC-61 mapping is a broader parent pattern included for completeness; CAPEC-127 is the primary and most precise match."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-127",
                    "rationale": "The vulnerability is a reflected XSS: attacker-controlled input from the URL is reflected into the HTML response without encoding. CAPEC-127 is the most specific and directly applicable attack pattern. No uncertainty in this mapping."
                  },
                  {
                    "capecId": "CAPEC-61",
                    "rationale": "CAPEC-61 is the broader parent pattern for XSS attacks. It is included as a secondary mapping to cover the general class of the vulnerability. CAPEC-127 is the more precise match; CAPEC-61 is listed for completeness."
                  }
                ],
                "commit": "23b879073eefce37e1065295d180c4bea7cef95f",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Fable 5.1"
                  }
                ],
                "cvssRationale": "AV:N: The vulnerability is exploitable over the network via a crafted URL. AC:L: No race conditions or special environment conditions are required; the attacker simply crafts a URL with a malicious object_type value. AT:N: No manipulation of the attack target is needed. PR:L: The victim must be authenticated to MISP to reach the AnalystData view. UI:A: The victim must actively navigate to the attacker-supplied URL (e.g., click a link), which constitutes active user interaction. VC:N, VI:N, VA:N: The vulnerable MISP server itself is not directly compromised; the impact is on the victim\u0027s browser session. SC:L: The attacker can read data available in the victim\u0027s browser context (cookies, session tokens, page content) but impact is limited to the current page. SI:L: The attacker can modify the rendered page or submit forms on behalf of the victim within the session. SA:N: No broader security impact on other systems is expected from this reflected XSS.",
                "fixSummary": "The fix introduces two layers of defense. First, the viewForObject action now validates the object_type parameter against the AnalystData::valid_targets whitelist and rejects any value not in that list with a NotFoundException, preventing arbitrary strings from reaching the view layer. Second, the two output sinks in the Overmind thread.ctp template now apply the h() HTML-encoding function to the object type before interpolation into translated strings, ensuring that even if a valid type were to contain special characters, it would be rendered as inert text rather than executable markup.",
                "generatedAt": "2026-09-22T12:33:44.255419Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "4476bdd487c3b17c3cffff36a76763c107e8bf284095d61bd6860865ce8912e0",
                "patchSummary": "In AnalystDataController.php, the patch adds an import of the AnalystData model and inserts a guard clause at the top of viewForObject that checks the $object_type parameter against AnalystData::valid_targets using a strict in_array comparison; if the value is not in the list, a NotFoundException is thrown. In thread.ctp, two occurrences of strtolower($objectType) passed directly into __() translation calls are wrapped with h() to HTML-encode the value before it is embedded in the rendered HTML output.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "23b879073eefce37e1065295d180c4bea7cef95f",
                    "patchSha256": "4476bdd487c3b17c3cffff36a76763c107e8bf284095d61bd6860865ce8912e0",
                    "source": "https://github.com/MISP/MISP/commit/23b879073.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/23b879073.patch",
                    "subject": "fix: [security] Reflected XSS via the object type in the"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/23b879073.patch",
                "subject": "fix: [security] Reflected XSS via the object type in the",
                "tagVersionBoundary": {
                  "commits_after_fix": 58,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "The object_type URL parameter is reflected into HTML output without encoding, allowing script injection. This is a textbook reflected XSS."
                  },
                  {
                    "cweId": "CWE-116",
                    "rationale": "The view template interpolated the object type into translated strings without applying h() HTML encoding, which is the direct encoding failure that permits the XSS."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "The controller accepted any arbitrary string as the object_type parameter without validating it against the known set of valid analyst-data target types, allowing attacker-controlled data to reach the output layer."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20234"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-95659",
    "datePublished": "2026-09-22T12:40:38.097Z",
    "dateReserved": "2026-09-22T12:40:33.071Z",
    "dateUpdated": "2026-09-22T15:34:41.995Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95661",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:33:57.327364Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:34:06.853Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/View/Elements/histogram.ctp"
          ],
          "product": "MISP",
          "programFiles": [
            "app/View/Elements/histogram.ctp"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a reflected cross-site scripting (XSS) vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL path segment , was interpolated directly into a JavaScript array literal inside an onClick HTML attribute without any encoding or escaping. An attacker who can cause an authenticated MISP user to visit a crafted URL containing a malicious type value can execute arbitrary JavaScript in the victim\u0027s browser within the MISP application origin.\u003c/p\u003e\u003cp\u003eSuccessful exploitation allows the attacker to read session cookies, perform actions on behalf of the victim, or exfiltrate sensitive data accessible from the MISP interface.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThe vulnerability requires the victim to be authenticated and to actively navigate to the attacker-supplied URL.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a reflected cross-site scripting (XSS) vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL path segment , was interpolated directly into a JavaScript array literal inside an onClick HTML attribute without any encoding or escaping. An attacker who can cause an authenticated MISP user to visit a crafted URL containing a malicious type value can execute arbitrary JavaScript in the victim\u0027s browser within the MISP application origin.\n\nSuccessful exploitation allows the attacker to read session cookies, perform actions on behalf of the victim, or exfiltrate sensitive data accessible from the MISP interface.\u00a0\n\nThe vulnerability requires the victim to be authenticated and to actively navigate to the attacker-supplied URL."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Cross Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T12:54:46.496Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/95b8f21f6"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix replaces the unsafe raw PHP loop that concatenated type values into a JavaScript array literal with a call to json_encode() using the JSON_HEX_TAG, JSON_HEX_APOS, JSON_HEX_QUOT, and JSON_HEX_AMP flags. This ensures that all special characters (angle brackets, quotes, ampersands) in the type values are hex-encoded, preventing any value from breaking out of the JavaScript string/array context and injecting arbitrary script.\u003c/p\u003e"
            }
          ],
          "value": "The fix replaces the unsafe raw PHP loop that concatenated type values into a JavaScript array literal with a call to json_encode() using the JSON_HEX_TAG, JSON_HEX_APOS, JSON_HEX_QUOT, and JSON_HEX_AMP flags. This ensures that all special characters (angle brackets, quotes, ampersands) in the type values are hex-encoded, preventing any value from breaking out of the JavaScript string/array context and injecting arbitrary script."
        }
      ],
      "title": "MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.47 with 46 commits after the fix); the exact first affected version is not stated in the patch and is assumed to be all versions prior to the fix commit.",
                  "The UI:A (Active) rating assumes the victim must click a link or manually navigate to the crafted URL; if the URL could be triggered via an auto-redirect or embedded iframe, UI:P (Passive) might be more appropriate.",
                  "SC:L and SI:L are conservative ratings for the secondary-system impact; a full session hijack or data exfiltration could justify SC:H/SI:H, but the patch evidence does not specify the exact scope of exploitable data.",
                  "The CAPEC-1 mapping is the closest available pattern; no CAPEC sub-pattern specifically covers reflected XSS in inline JavaScript event handlers, so the general XSS pattern is used.",
                  "The commit message references \u0027any logged-in victim,\u0027 implying authentication is required; the exact role or permission level of the victim is not specified."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "CAPEC-1 is the canonical CAPEC pattern for cross-site scripting attacks, covering reflected, stored, and DOM-based variants. The patch evidence shows a reflected XSS where URL-supplied data is injected into an inline JavaScript event handler. CAPEC-1 is the closest and most direct match. No more specific CAPEC sub-pattern for reflected XSS in inline JS handlers exists in the CAPEC catalog, so CAPEC-1 is the best available mapping."
                  }
                ],
                "commit": "95b8f21f6be9e20323dd101e7d085fc34765c7b7",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  }
                ],
                "cvssRationale": "AV:N: The vulnerability is exploitable over the network via a crafted URL. AC:L: No race conditions or special environment conditions are required; the attacker simply crafts a URL with a malicious type value. AT:N: No manipulation of the attack target is needed. PR:N: The attacker requires no privileges on the MISP instance; the victim must be authenticated, but that is a precondition on the victim, not a privilege requirement on the attacker. UI:A: The victim must actively click a link or navigate to the attacker-supplied URL for the reflected payload to execute. VC:N, VI:N, VA:N: The MISP server itself is not directly compromised; the impact is confined to the victim\u0027s browser session. SC:L: The attacker can read session tokens or data visible in the MISP UI within the victim\u0027s browser. SI:L: The attacker can perform actions on behalf of the victim within the MISP application. SA:N: No availability impact on the victim\u0027s browser or the MISP server.",
                "fixSummary": "The fix replaces the unsafe raw PHP loop that concatenated type values into a JavaScript array literal with a call to json_encode() using the JSON_HEX_TAG, JSON_HEX_APOS, JSON_HEX_QUOT, and JSON_HEX_AMP flags. This ensures that all special characters (angle brackets, quotes, ampersands) in the type values are hex-encoded, preventing any value from breaking out of the JavaScript string/array context and injecting arbitrary script.",
                "generatedAt": "2026-09-22T12:45:39.951248Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "33d14587239572ed6af4ca5d122f4b92405dbce1ff0317a1ff1e6e026073dc8c",
                "patchSummary": "In app/View/Elements/histogram.ctp, the onClick attribute previously built a JS array by iterating over $selectedTypes and echoing each value between double quotes with no escaping: [\u003c?php foreach ($selectedTypes as $t) echo \u0027\"\u0027 . $t . \u0027\", \u0027 ?\u003e]. The patch replaces this with a single json_encode($selectedTypes, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP) call, producing a safely encoded JSON array literal that cannot be broken out of by any element value.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "95b8f21f6be9e20323dd101e7d085fc34765c7b7",
                    "patchSha256": "33d14587239572ed6af4ca5d122f4b92405dbce1ff0317a1ff1e6e026073dc8c",
                    "source": "https://github.com/MISP/MISP/commit/95b8f21f6.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/95b8f21f6.patch",
                    "subject": "fix: [security] Escape the selected types in the attribute"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/95b8f21f6.patch",
                "subject": "fix: [security] Escape the selected types in the attribute",
                "tagVersionBoundary": {
                  "commits_after_fix": 46,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "The patch directly addresses the reflection of untrusted, URL-supplied data into a JavaScript context within an HTML attribute without encoding. This is a textbook reflected XSS (CWE-79). The specific sub-type is reflected XSS in a JavaScript context (inline event handler), but CWE-79 is the standard and most precise mapping."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20161"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-95661",
    "datePublished": "2026-09-22T12:54:46.496Z",
    "dateReserved": "2026-09-22T12:54:43.824Z",
    "dateUpdated": "2026-09-22T15:34:06.853Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95665",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:32:57.787316Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:33:05.484Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "Events export confirmation form (app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp)",
            "Default theme",
            "UiBeta theme"
          ],
          "product": "MISP",
          "programFiles": [
            "app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Niels Teusink of Eye Security"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP\u0027s json_encode() without any hex-encoding flags. By default, json_encode() escapes double quotes and backslashes but does not escape single quotes. Because the JavaScript string is delimited by single quotes, an attacker can inject a single-quote character to terminate the string literal and execute arbitrary JavaScript in the victim\u0027s browser session.\u003c/p\u003e\u003cp\u003eThe vulnerability affects the Default and UiBeta themes, both of which render this view. The Overmind theme\u0027s own copy of the form already passed the value through an escaped data attribute and was not affected by this specific sink.\u003c/p\u003e\u003cp\u003ePreconditions: the victim must be an authenticated MISP user and must actively open or navigate to the attacker-crafted URL. The attacker does not require an account or any prior access to the MISP instance.\u003c/p\u003e\u003cp\u003eSecurity impact: successful exploitation allows execution of arbitrary JavaScript in the context of the MISP web application, potentially leading to session hijacking, unauthorized actions performed on behalf of the victim, exfiltration of sensitive data visible in the session, or further client-side attacks. The vulnerable component\u0027s own confidentiality, integrity, and availability are not directly compromised; the impact is on the underlying user session.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP\u0027s json_encode() without any hex-encoding flags. By default, json_encode() escapes double quotes and backslashes but does not escape single quotes. Because the JavaScript string is delimited by single quotes, an attacker can inject a single-quote character to terminate the string literal and execute arbitrary JavaScript in the victim\u0027s browser session.\n\nThe vulnerability affects the Default and UiBeta themes, both of which render this view. The Overmind theme\u0027s own copy of the form already passed the value through an escaped data attribute and was not affected by this specific sink.\n\nPreconditions: the victim must be an authenticated MISP user and must actively open or navigate to the attacker-crafted URL. The attacker does not require an account or any prior access to the MISP instance.\n\nSecurity impact: successful exploitation allows execution of arbitrary JavaScript in the context of the MISP web application, potentially leading to session hijacking, unauthorized actions performed on behalf of the victim, exfiltration of sensitive data visible in the session, or further client-side attacks. The vulnerable component\u0027s own confidentiality, integrity, and availability are not directly compromised; the impact is on the underlying user session."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Cross Site Scripting"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input in Web Page (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T13:01:45.225Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/ad4ff238d"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe vulnerability is remediated by adding the JSON_HEX_TAG, JSON_HEX_APOS, JSON_HEX_QUOT, and JSON_HEX_AMP flags to the json_encode() call at the rendering sink. These flags cause angle brackets, single quotes, double quotes, and ampersands to be hex-encoded (e.g., \u0027 becomes \\u0027), preventing any of these characters from breaking out of the single-quoted JavaScript string literal and thereby eliminating the script injection vector.\u003c/p\u003e"
            }
          ],
          "value": "The vulnerability is remediated by adding the JSON_HEX_TAG, JSON_HEX_APOS, JSON_HEX_QUOT, and JSON_HEX_AMP flags to the json_encode() call at the rendering sink. These flags cause angle brackets, single quotes, double quotes, and ampersands to be hex-encoded (e.g., \u0027 becomes \\u0027), preventing any of these characters from breaking out of the single-quoted JavaScript string literal and thereby eliminating the script injection vector."
        }
      ],
      "title": "MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The tag_version_boundary metadata indicates the fix commit is 44 commits after tag v2.5.47, suggesting versions up to and including 2.5.47 may be affected, but no explicit affected or fixed version range is stated in the patch or commit message. The version boundary is inferred from repository metadata and may not be precise.",
                  "The CVSS v4.0 AT (Attack Complexity) metric value \u0027N\u0027 is used as the neutral/none value; the exact valid value set for AT in CVSS v4.0 is not fully confirmed from the patch evidence alone.",
                  "The CAPEC-1 mapping is the closest general XSS pattern available; no CAPEC specifically covers script-context reflected XSS via unescaped JSON in a single-quoted JS string, so CAPEC-1 is the best available match.",
                  "The Overmind theme is assumed unaffected because the commit message states it already passed the value through an escaped data attribute; this is based solely on the commit message and was not independently verified.",
                  "PR:N is assigned because the attacker does not require authentication to craft the malicious URL; the requirement that the victim be logged in is captured in UI:A rather than PR."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "The attack pattern involves injecting a script fragment (a single quote followed by arbitrary JavaScript) into a web page via a URL parameter, which is then reflected into the page\u0027s JavaScript context without proper encoding. This matches CAPEC-1 (Cross Site Scripting) directly. The injection is reflected (not stored) and occurs in a script context rather than an HTML context, but CAPEC-1 is the closest and most general applicable pattern. No more specific CAPEC for script-context reflected XSS exists in the CAPEC catalog, so CAPEC-1 is the best available match."
                  }
                ],
                "commit": "ad4ff238df978d459ac6efe0a58038748fa4a649",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Niels Teusink of Eye Security"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: the exploit is delivered over the network via a crafted URL. AC:L: the attack requires only crafting a URL with a single quote in the event ID list; no race conditions or special conditions are needed. AT:N: no additional attack complexity beyond what AC captures. PR:N: the attacker does not need any MISP account or privileges; the victim must be authenticated, but PR measures attacker privileges. UI:A: the victim must actively open or click the crafted link. VC/VI/VA:N: the MISP server\u0027s own confidentiality, integrity, and availability are not directly impacted. SC:L: the attacker can read session data, cookies, or other sensitive information in the victim\u0027s browser context. SI:L: the attacker can perform actions on behalf of the victim (e.g., submit forms, modify data via the API). SA:N: no impact on the availability of the underlying system.",
                "fixSummary": "The vulnerability is remediated by adding the JSON_HEX_TAG, JSON_HEX_APOS, JSON_HEX_QUOT, and JSON_HEX_AMP flags to the json_encode() call at the rendering sink. These flags cause angle brackets, single quotes, double quotes, and ampersands to be hex-encoded (e.g., \u0027 becomes \\u0027), preventing any of these characters from breaking out of the single-quoted JavaScript string literal and thereby eliminating the script injection vector.",
                "generatedAt": "2026-09-22T12:57:11.104186Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "b2c68a62411584c586558a3ab03529c380d9bdb0824ac292b26e7f8b3278fa01",
                "patchSummary": "A single-line change in app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp: the json_encode($idList) call is replaced with json_encode($idList, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP), ensuring that single quotes, double quotes, angle brackets, and ampersands in the event ID list are hex-escaped before being interpolated into the single-quoted JavaScript string literal in the redirectToExportResult() function.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "ad4ff238df978d459ac6efe0a58038748fa4a649",
                    "patchSha256": "b2c68a62411584c586558a3ab03529c380d9bdb0824ac292b26e7f8b3278fa01",
                    "source": "https://github.com/MISP/MISP/commit/ad4ff238d.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/ad4ff238d.patch",
                    "subject": "fix: [security] Escape the event id list in the export"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/ad4ff238d.patch",
                "subject": "fix: [security] Escape the event id list in the export",
                "tagVersionBoundary": {
                  "commits_after_fix": 44,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "The root cause is the failure to neutralize a single-quote character in user-controlled input (the URL-supplied event ID list) before embedding it in a single-quoted JavaScript string context. json_encode() without hex flags does not escape single quotes, allowing script injection. This is a textbook reflected XSS (CWE-79)."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20129"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-95665",
    "datePublished": "2026-09-22T13:01:45.225Z",
    "dateReserved": "2026-09-22T13:01:42.885Z",
    "dateUpdated": "2026-09-22T15:33:05.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95667",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:32:35.402501Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:32:43.415Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "Installer scripts (INSTALL/INSTALL.debian12.sh",
            "INSTALL/INSTALL.debian13.sh",
            "INSTALL/INSTALL.ubuntu2404.sh",
            "INSTALL/xINSTALL.rhel94.sh)"
          ],
          "product": "MISP",
          "programFiles": [
            "INSTALL/INSTALL.debian12.sh",
            "INSTALL/INSTALL.debian13.sh",
            "INSTALL/INSTALL.ubuntu2404.sh",
            "INSTALL/xINSTALL.rhel94.sh"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Niels Teusink of Eye Security"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password, database passwords, GPG passphrase, and supervisor password. However, the log file was created by the tee command under the system default umask, resulting in world-readable permissions (typically 0644). Similarly, the FIFO was created with mkfifo without an explicit mode, also inheriting the default umask and remaining world-readable during the window before it was unlinked.\u0026nbsp;\u003c/p\u003e\u003cp\u003eAny local unprivileged user on the system could read the log file or the FIFO to obtain these credentials.\u0026nbsp;\u003c/p\u003e\u003cp\u003eAdditionally, the log file was not removed before creation, meaning a pre-existing symlink in /var/log could have been used to redirect the write to an arbitrary location.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password, database passwords, GPG passphrase, and supervisor password. However, the log file was created by the tee command under the system default umask, resulting in world-readable permissions (typically 0644). Similarly, the FIFO was created with mkfifo without an explicit mode, also inheriting the default umask and remaining world-readable during the window before it was unlinked.\u00a0\n\nAny local unprivileged user on the system could read the log file or the FIFO to obtain these credentials.\u00a0\n\nAdditionally, the log file was not removed before creation, meaning a pre-existing symlink in /var/log could have been used to redirect the write to an arbitrary location.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-135",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-135 Exploiting Incorrectly Configured Security Permissions"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T13:11:44.277Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/d5d72ab38"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe installer scripts now explicitly create the log file with 0600 permissions using install -m 0600 and the FIFO with mkfifo -m 0600, ensuring both are root-readable/writable only from the moment of creation. The log file is also removed (rm -f) before creation to prevent a pre-existing symlink in /var/log from being used to redirect the write to an attacker-controlled path. This matches the existing 0600 treatment applied to /root/misp_settings.txt by the save_settings() function.\u003c/p\u003e"
            }
          ],
          "value": "The installer scripts now explicitly create the log file with 0600 permissions using install -m 0600 and the FIFO with mkfifo -m 0600, ensuring both are root-readable/writable only from the moment of creation. The log file is also removed (rm -f) before creation to prevent a pre-existing symlink in /var/log from being used to redirect the write to an attacker-controlled path. This matches the existing 0600 treatment applied to /root/misp_settings.txt by the save_settings() function."
        }
      ],
      "title": "MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary (v2.5.47 with 38 commits after fix); the exact first affected version is not specified in the patch metadata.",
                  "The vulnerability is transient in the sense that it only manifests during the installer execution window, but the log file persists on disk after installation and remains world-readable unless the administrator manually changes permissions or removes it.",
                  "The CVSS assumes the log file remains on disk after installation; if it is immediately removed by the installer, the exposure window is shorter but the file is still readable during the installation process.",
                  "CAPEC-135 is the closest available attack pattern; no CAPEC specifically covers \u0027reading a world-readable log file containing credentials,\u0027 so the general permission-misuse pattern is the best match.",
                  "The symlink attack vector (CWE-22) is a secondary concern addressed by the same patch; the primary vulnerability is the incorrect file permissions (CWE-732).",
                  "The installer is assumed to run as root (standard for system installation scripts), which is why 0600 permissions restrict access to root only."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-135",
                    "rationale": "The most direct attack pattern is a local unprivileged user simply reading the world-readable log file at /var/log/misp_install.log to harvest sensitive credentials. No complex exploitation is required beyond file read access. CAPEC-135 covers the general pattern of an attacker leveraging misconfigured file permissions to access sensitive data. The symlink variant (CWE-22) could also map to CAPEC-135 as a sub-technique of permission exploitation."
                  }
                ],
                "commit": "d5d72ab38eda4a6c343b784494a4ae9d0d94bd80",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Niels Teusink of Eye Security"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "Attack Vector is Local because the attacker must have a local account or shell access on the system where the MISP installer runs. Attack Complexity is Low because reading a world-readable file requires no special conditions. No Attack Target manipulation is needed. Privileges Required is None because the file is world-readable (0644) and any unprivileged local user can read it. No User Interaction is required. Confidentiality impact is High because the log contains the admin password, database passwords, GPG passphrase, and supervisor password, granting full compromise of the MISP deployment. Integrity and Availability impacts are None. Scope is Not Changed because the exposed credentials belong to the same MISP system. The vulnerability is transient (only during installation) but the log file persists after installation unless manually removed.",
                "fixSummary": "The installer scripts now explicitly create the log file with 0600 permissions using install -m 0600 and the FIFO with mkfifo -m 0600, ensuring both are root-readable/writable only from the moment of creation. The log file is also removed (rm -f) before creation to prevent a pre-existing symlink in /var/log from being used to redirect the write to an attacker-controlled path. This matches the existing 0600 treatment applied to /root/misp_settings.txt by the save_settings() function.",
                "generatedAt": "2026-09-22T13:03:07.672539Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 6,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "e0af51eb247c4727485796d1bd4fcc2c30cb34c2a733043a3371df7e94cb81f0",
                "patchSummary": "In all four installer scripts (INSTALL.debian12.sh, INSTALL.debian13.sh, INSTALL.ubuntu2404.sh, xINSTALL.rhel94.sh), the single line mkfifo ${logfile}.pipe is replaced with three lines: rm -f \"$logfile\" to remove any pre-existing file or symlink; install -m 0600 /dev/null \"$logfile\" to create the log file with root-only permissions; and mkfifo -m 0600 ${logfile}.pipe to create the FIFO with root-only permissions. The subsequent tee and exec redirection lines remain unchanged.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "d5d72ab38eda4a6c343b784494a4ae9d0d94bd80",
                    "patchSha256": "e0af51eb247c4727485796d1bd4fcc2c30cb34c2a733043a3371df7e94cb81f0",
                    "source": "https://github.com/MISP/MISP/commit/d5d72ab38.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/d5d72ab38.patch",
                    "subject": "fix: [security] Create the installer log and its FIFO"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/d5d72ab38.patch",
                "subject": "fix: [security] Create the installer log and its FIFO",
                "tagVersionBoundary": {
                  "commits_after_fix": 38,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-732",
                    "rationale": "The installer log file and FIFO were created under the default umask, resulting in world-readable permissions on a file containing sensitive credentials (admin password, database passwords, GPG passphrase, supervisor password). The fix explicitly sets 0600 permissions, confirming the root cause was incorrect permission assignment."
                  },
                  {
                    "cweId": "CWE-22",
                    "rationale": "The log file was not removed before creation, allowing a pre-existing symlink in /var/log to redirect the write to an arbitrary file. The fix adds rm -f before creation to mitigate this symlink-following risk. This is a secondary weakness addressed by the same patch."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20100"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-95667",
    "datePublished": "2026-09-22T13:11:44.277Z",
    "dateReserved": "2026-09-22T13:11:36.849Z",
    "dateUpdated": "2026-09-22T15:32:43.415Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95671",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:32:15.165861Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:32:21.567Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "CollectionsController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/CollectionsController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add() method persists data on both POST and PUT requests. As a result, an authenticated user could issue a PUT request to the collections/add endpoint, bypassing the sharing-group authorization check entirely. This allowed the creation of a collection with distribution=4 (shared with a specific sharing group) targeting a sharing group that the user was not authorized to use. The bypassed check would normally verify that the current user has access to the specified sharing group before allowing the collection to be associated with it.\u003c/p\u003e\u003cp\u003eThe security impact is that an authenticated user can place collection data into a sharing group context they do not have legitimate access to, potentially exposing that data to all members of the unauthorized sharing group and violating the intended access-control boundaries of the MISP instance.\u003c/p\u003e\u003cp\u003eThe vulnerability requires an authenticated session and knowledge of a valid sharing group identifier; no user interaction or special tooling is needed beyond sending a PUT request instead of a POST request to the same endpoint.\u003c/p\u003e"
            }
          ],
          "value": "In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add() method persists data on both POST and PUT requests. As a result, an authenticated user could issue a PUT request to the collections/add endpoint, bypassing the sharing-group authorization check entirely. This allowed the creation of a collection with distribution=4 (shared with a specific sharing group) targeting a sharing group that the user was not authorized to use. The bypassed check would normally verify that the current user has access to the specified sharing group before allowing the collection to be associated with it.\n\nThe security impact is that an authenticated user can place collection data into a sharing group context they do not have legitimate access to, potentially exposing that data to all members of the unauthorized sharing group and violating the intended access-control boundaries of the MISP instance.\n\nThe vulnerability requires an authenticated session and knowledge of a valid sharing group identifier; no user interaction or special tooling is needed beyond sending a PUT request instead of a POST request to the same endpoint."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-114 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T13:20:25.683Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/c20f5a836"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe authorization guard in CollectionsController::add() was extended to cover PUT requests in addition to POST requests. The sharing-group usability check (which validates that the current user can use the target sharing group) and the element capture logic now execute regardless of whether the request arrives as POST or PUT, ensuring that CRUDComponent::add() cannot persist a collection with an unauthorized sharing group via either HTTP verb.\u003c/p\u003e"
            }
          ],
          "value": "The authorization guard in CollectionsController::add() was extended to cover PUT requests in addition to POST requests. The sharing-group usability check (which validates that the current user can use the target sharing group) and the element capture logic now execute regardless of whether the request arrives as POST or PUT, ensuring that CRUDComponent::add() cannot persist a collection with an unauthorized sharing group via either HTTP verb."
        }
      ],
      "title": "MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.47 with 54 commits after fix); the exact last affected version and first fixed version are not explicitly stated in the patch and may differ.",
                  "The CVSS assumes the primary impact is integrity (unauthorized placement of data in a sharing group) rather than confidentiality, since the data in the collection is user-created. If the collection grants read access to other data in the sharing group, the confidentiality impact could be higher.",
                  "CAPEC-114 (Parameter Tampering) is the closest available CAPEC for bypassing an authorization check by altering the HTTP method; no CAPEC specifically models HTTP-verb-based authorization bypass.",
                  "The patch does not include version tags or release notes; affected version ranges are approximate.",
                  "The Co-Authored-By line references an AI assistant (Claude Opus 4.8); it is credited as a tool rather than a human remediation developer."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-114",
                    "rationale": "The attacker manipulates the HTTP method parameter (changing POST to PUT) to bypass the authorization check that is keyed on the method. The HTTP method acts as a routing parameter that the application uses to decide whether to enforce authorization; tampering with it causes the check to be skipped. This is the closest CAPEC to the observed bypass technique, though the pattern is more specifically an authorization bypass via method selection rather than classic parameter tampering. Uncertainty: no CAPEC specifically covers \u0027bypassing authorization by altering the HTTP verb\u0027; CAPEC-114 is the best available match."
                  }
                ],
                "commit": "c20f5a83621de6c534847e1728a1f5af843079b7",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  }
                ],
                "cvssRationale": "AV:N - MISP is a web application accessible over the network. AC:L - The attack requires only changing the HTTP method from POST to PUT; no race conditions, complex payloads, or special conditions are needed. AT:N - No attack target manipulation is required. PR:L - An authenticated MISP user is required; the vulnerability is in the authorization layer, not authentication. UI:N - No victim interaction is needed. VC:N - The primary data in the collection is user-created; the vulnerability does not directly expose other users\u0027 data to the attacker. VI:L - The attacker can create a collection in a sharing group they are not authorized to use, violating the integrity of the sharing-group access model. VA:N - No availability impact. SC:N - No secondary confidentiality impact identified. SI:L - Secondary integrity impact: data is placed in an unauthorized sharing-group context, potentially visible to that group\u0027s members. SA:N - No secondary availability impact.",
                "fixSummary": "The authorization guard in CollectionsController::add() was extended to cover PUT requests in addition to POST requests. The sharing-group usability check (which validates that the current user can use the target sharing group) and the element capture logic now execute regardless of whether the request arrives as POST or PUT, ensuring that CRUDComponent::add() cannot persist a collection with an unauthorized sharing group via either HTTP verb.",
                "generatedAt": "2026-09-22T13:13:03.522587Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "a49bc540d4465370f1ecbf71f09c9aa51e3a77f3c196f60ddea7210f17f8b1a7",
                "patchSummary": "In app/Controller/CollectionsController.php, the condition guarding the sharing-group authorization check and element capture was changed from \u0027if ($this-\u003erequest-\u003eis(\u0027post\u0027))\u0027 to \u0027if ($this-\u003erequest-\u003eis(\u0027post\u0027) || $this-\u003erequest-\u003eis(\u0027put\u0027))\u0027. A comment was added explaining that CRUDComponent::add() persists on either verb, so the guard must cover both. Four lines inserted, one line deleted in total.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "c20f5a83621de6c534847e1728a1f5af843079b7",
                    "patchSha256": "a49bc540d4465370f1ecbf71f09c9aa51e3a77f3c196f60ddea7210f17f8b1a7",
                    "source": "https://github.com/MISP/MISP/commit/c20f5a836.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/c20f5a836.patch",
                    "subject": "fix: [security] Authorise the collection sharing group on PUT"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/c20f5a836.patch",
                "subject": "fix: [security] Authorise the collection sharing group on PUT",
                "tagVersionBoundary": {
                  "commits_after_fix": 54,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The sharing-group usability authorization check was present for POST but entirely absent for PUT requests to the same endpoint. The authorization logic was not missing in design; it was simply not applied to one of the HTTP methods that triggers the same persistence path, resulting in a missing authorization enforcement for PUT."
                  },
                  {
                    "cweId": "CWE-285",
                    "rationale": "The application performed an authorization check (sharing-group usability) but applied it conditionally based on the HTTP method, allowing an attacker to bypass the check by selecting a different method. This is an improper authorization implementation where the check is not consistently enforced across all code paths that lead to the sensitive operation."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20271"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-95671",
    "datePublished": "2026-09-22T13:20:25.683Z",
    "dateReserved": "2026-09-22T13:20:20.466Z",
    "dateUpdated": "2026-09-22T15:32:21.567Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95674",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:31:46.531365Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:31:52.088Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Controller/EventsController.php"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/EventsController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters (format set to \u0027simplified\u0027 and no module-specific configuration applied) rather than rejecting the request. This allowed an authenticated user to trigger enrichment or analysis processing through a module that was not explicitly enabled or available on the instance, bypassing the intended module availability controls. The lack of validation meant that module names outside the enabled set were not rejected, potentially exposing functionality or data processing paths that the administrator had not authorized for use.\u003c/p\u003e"
            }
          ],
          "value": "In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters (format set to \u0027simplified\u0027 and no module-specific configuration applied) rather than rejecting the request. This allowed an authenticated user to trigger enrichment or analysis processing through a module that was not explicitly enabled or available on the instance, bypassing the intended module availability controls. The lack of validation meant that module names outside the enabled set were not rejected, potentially exposing functionality or data processing paths that the administrator had not authorized for use."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-124",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-124 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T13:44:33.427Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/7dfcc4d32"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix adds a moduleFound flag that is set only when the requested module name matches an entry in the enabled modules list. After the lookup loop completes, if the flag remains false, the method throws a MethodNotAllowedException with the message \u0027Module not found or not available,\u0027 effectively rejecting any query that references a module not present in the enabled set.\u003c/p\u003e"
            }
          ],
          "value": "The fix adds a moduleFound flag that is set only when the requested module name matches an entry in the enabled modules list. After the lookup loop completes, if the flag remains false, the method throws a MethodNotAllowedException with the message \u0027Module not found or not available,\u0027 effectively rejecting any query that references a module not present in the enabled set."
        }
      ],
      "title": "MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary (v2.5.47 with 138 commits after fix); the exact last affected version and first fixed version are not explicitly stated in the patch metadata.",
                  "The security impact is assessed as low confidentiality impact based on the limited evidence; the actual data exposure depends on what legacy modules would process, which is not detailed in the patch.",
                  "CAPEC-124 (Parameter Tampering) is the closest available attack pattern; the actual scenario is a server-side input validation gap rather than an active tampering attack, so the mapping is approximate.",
                  "The patch does not specify whether the legacy module query could lead to code execution, data exfiltration, or other higher-impact consequences; the CVSS impact metrics are conservatively set to reflect only the evidenced behavior.",
                  "Authentication is assumed to be required (PR:L) based on MISP being an authenticated web application; the patch does not explicitly state authentication requirements."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-124",
                    "rationale": "The closest plausible attack pattern is parameter tampering: an authenticated user supplies a module name in the queryEnrichment request that is not in the enabled modules list (e.g., a legacy or disabled module). The server previously accepted this parameter value and processed the request with defaults. The uncertainty is that the patch does not explicitly describe an active tampering scenario; it is a server-side validation gap. CAPEC-124 is selected as the best available match because the core mechanism is the manipulation of a request parameter to reference an unauthorized resource."
                  }
                ],
                "commit": "7dfcc4d32970d553e8c39827dac04889e44f94e0",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "The vulnerability is exploitable over the network (AV:N) via the MISP web interface with low complexity (AC:L) and no attack target manipulation (AT:N). It requires a low-privilege authenticated user (PR:L) and no user interaction (UI:N). The primary impact is a low confidentiality impact (VC:L) because an authenticated user could trigger processing through a module not in the enabled set, potentially exposing data or processing results not intended to be available. No integrity or availability impact is evidenced (VI:N, VA:N). No secondary impacts are indicated (SC:N, SI:N, SA:N). The low impact reflects that the user already has authenticated access to the event and the exposure is limited to an additional module processing path.",
                "fixSummary": "The fix adds a moduleFound flag that is set only when the requested module name matches an entry in the enabled modules list. After the lookup loop completes, if the flag remains false, the method throws a MethodNotAllowedException with the message \u0027Module not found or not available,\u0027 effectively rejecting any query that references a module not present in the enabled set.",
                "generatedAt": "2026-09-22T13:21:49.468745Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "799bc5310fbd5bb6079992d5f7713a2d41ce3fbe45aa200523937e921f713cf4",
                "patchSummary": "In app/Controller/EventsController.php, the queryEnrichment method is modified: a boolean variable $moduleFound is initialized to false before the foreach loop over $enabledModules[\u0027modules\u0027]. Inside the loop, when a module name matches, $moduleFound is set to true. After the loop, a new conditional block checks if $moduleFound is still false and throws a MethodNotAllowedException, preventing further processing with an unavailable module.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "7dfcc4d32970d553e8c39827dac04889e44f94e0",
                    "patchSha256": "799bc5310fbd5bb6079992d5f7713a2d41ce3fbe45aa200523937e921f713cf4",
                    "source": "https://github.com/MISP/MISP/commit/7dfcc4d32.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/7dfcc4d32.patch",
                    "subject": "fix: [security] Harden misp modules module choice"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/7dfcc4d32.patch",
                "subject": "fix: [security] Harden misp modules module choice",
                "tagVersionBoundary": {
                  "commits_after_fix": 138,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-20",
                    "rationale": "The module name parameter supplied to queryEnrichment was not validated against the set of enabled/available modules. The code accepted any module name and, when no match was found, proceeded with default parameters instead of rejecting the input. The fix adds an explicit validation check that rejects the request when the module is not in the enabled list."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20127"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-95674",
    "datePublished": "2026-09-22T13:44:33.427Z",
    "dateReserved": "2026-09-22T13:44:31.610Z",
    "dateUpdated": "2026-09-22T15:31:52.088Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95679",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:36:14.509188Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:37:46.734Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Controller/AppController.php"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/AppController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Niels Teusink of Eye Security"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP\u0027s RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build() library contains a logic error in its readFile guard condition (readFile \u0026amp;\u0026amp; http || https), where PHP operator precedence causes the https branch to bypass the readFile check entirely. As a result, a request body containing a bare HTTPS URL is treated as a locator and fetched by the server. Because the cspReport endpoint accepts XML content type and is unauthenticated by design, an unauthenticated remote attacker can send a POST request with a crafted XML body to cause the MISP server to issue an outbound HTTPS request to an arbitrary target reachable from the server.\u003c/p\u003e\u003cp\u003eThe attacker does not receive the response body, but can use the vulnerability to probe internal services, trigger actions on internal HTTPS endpoints, or perform timing-based reconnaissance of the server\u0027s network environment.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThe vulnerability affects any MISP deployment where the cspReport endpoint is reachable and the server has network access to internal or external HTTPS services.\u003c/p\u003e"
            }
          ],
          "value": "MISP\u0027s RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build() library contains a logic error in its readFile guard condition (readFile \u0026\u0026 http || https), where PHP operator precedence causes the https branch to bypass the readFile check entirely. As a result, a request body containing a bare HTTPS URL is treated as a locator and fetched by the server. Because the cspReport endpoint accepts XML content type and is unauthenticated by design, an unauthenticated remote attacker can send a POST request with a crafted XML body to cause the MISP server to issue an outbound HTTPS request to an arbitrary target reachable from the server.\n\nThe attacker does not receive the response body, but can use the vulnerability to probe internal services, trigger actions on internal HTTPS endpoints, or perform timing-based reconnaissance of the server\u0027s network environment.\u00a0\n\nThe vulnerability affects any MISP deployment where the cspReport endpoint is reachable and the server has network access to internal or external HTTPS services."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-12",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-12 Exploiting Unsafe Default Behavior"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T13:50:48.696Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/716fc49d3"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces a custom XML input type handler in AppController::beforeFilter() that validates the request body contains an XML document marker (the \u0026lt; character) before passing it to the XML decoder. If the body does not contain \u0026lt;, it returns an empty array, preventing the Xml::build() locator/fetch code path from being reached regardless of the vendored library\u0027s internal guard logic. This ensures only actual XML documents are processed, eliminating the SSRF vector.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces a custom XML input type handler in AppController::beforeFilter() that validates the request body contains an XML document marker (the \u003c character) before passing it to the XML decoder. If the body does not contain \u003c, it returns an empty array, preventing the Xml::build() locator/fetch code path from being reached regardless of the vendored library\u0027s internal guard logic. This ensures only actual XML documents are processed, eliminating the SSRF vector."
        }
      ],
      "title": "MISP Unauthenticated Blind SSRF via XML Body Processing",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The cspReport endpoint is unauthenticated by design, as stated in the commit message.",
                  "The SSRF is limited to HTTPS targets because the operator precedence bug only ungates the https branch of the readFile guard.",
                  "The SSRF is blind: the fetched response is not returned to the attacker, limiting direct data exfiltration.",
                  "The exact affected version range before 2.5.47 is not precisely determined; the tag boundary indicates the fix is included in v2.5.47.",
                  "CAPEC-12 is the closest available mapping; the attack is more specifically about exploiting a logic error in input validation within an automatic content-type handler rather than a purely misconfigured default.",
                  "CVSS impact metrics are set to None based on the blind nature of the SSRF; if the server processes the fetched response in a way that leaks data or triggers actions on internal services, the impact could be higher.",
                  "The vendored Xml::build() library\u0027s behavior with a locator (fetching the URL) is taken from the commit message description; the actual library code was not included in the patch."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-12",
                    "rationale": "The framework\u0027s default behavior is to automatically decode any XML-typed request body through Xml::build() without validating that the body is actually an XML document. This unsafe default, combined with a logic error in the vendored library\u0027s guard condition, allows an attacker to exploit the default processing path to trigger an outbound request. CAPEC-12 is the closest available mapping; the attack is more specifically about exploiting a logic error in input validation within the default processing pipeline rather than a purely misconfigured default. No CAPEC entry more precisely describes SSRF via unvalidated input in an automatic content-type handler."
                  }
                ],
                "commit": "716fc49d3816dd17d8aeeee074a12f430edc2a55",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Niels Teusink of Eye Security"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The cspReport endpoint is network-accessible. AC:L: The attack requires only a POST request with a specific Content-Type and a URL as the body; no race conditions or complex setup. AT:N: No attack target manipulation is required. PR:N: The cspReport endpoint is unauthenticated by design. UI:N: No user interaction is needed. VC/VI/VA:N: The SSRF is blind; the response is not returned to the attacker, and there is no direct impact on MISP\u0027s confidentiality, integrity, or availability. SC/SI/SA:N: The blind nature means no data from secondary systems is exfiltrated to the attacker, and no confirmed integrity or availability impact on secondary systems is evidenced. Note: if the server processes the fetched response in a way that leaks data or triggers side effects on internal services, the secondary impact metrics could be higher; this is not confirmed by the available evidence.",
                "fixSummary": "The fix introduces a custom XML input type handler in AppController::beforeFilter() that validates the request body contains an XML document marker (the \u003c character) before passing it to the XML decoder. If the body does not contain \u003c, it returns an empty array, preventing the Xml::build() locator/fetch code path from being reached regardless of the vendored library\u0027s internal guard logic. This ensures only actual XML documents are processed, eliminating the SSRF vector.",
                "generatedAt": "2026-09-22T13:46:08.714767Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 7,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 3
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "99e7ef2fbd5abebda159b377fe3bb3f75026c9966eb556d2d713642448af9d60",
                "patchSummary": "Adds 15 lines to app/Controller/AppController.php in the beforeFilter() method. Registers a custom XML input type via RequestHandler-\u003eaddInputType(\u0027xml\u0027, ...) with a closure that checks whether the body is a string containing the \u003c character. If not, it returns an empty array (no decoding). If yes, it delegates to RequestHandler-\u003econvertXml(). This ensures only actual XML documents are processed, preventing bare URLs from being interpreted as fetch locators by the vendored Xml::build() library.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "716fc49d3816dd17d8aeeee074a12f430edc2a55",
                    "patchSha256": "99e7ef2fbd5abebda159b377fe3bb3f75026c9966eb556d2d713642448af9d60",
                    "source": "https://github.com/MISP/MISP/commit/716fc49d3.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/716fc49d3.patch",
                    "subject": "fix: [security] Decode only an XML body that is actually a"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/716fc49d3.patch",
                "subject": "fix: [security] Decode only an XML body that is actually a",
                "tagVersionBoundary": {
                  "commits_after_fix": 41,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-918",
                    "rationale": "The vulnerability allows an unauthenticated attacker to cause the MISP server to issue outbound HTTPS requests to arbitrary attacker-specified URLs by sending a crafted XML body to the cspReport endpoint. The server fetches the URL as if it were an XML document locator, constituting a blind SSRF."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "The root cause is that the XML request body is not validated to confirm it is an actual XML document before being passed to Xml::build(). The framework\u0027s default behavior treats any XML content-type body as a document without checking for document structure, allowing a bare URL to be interpreted as a fetch locator."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20205"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-95679",
    "datePublished": "2026-09-22T13:50:48.696Z",
    "dateReserved": "2026-09-22T13:50:46.243Z",
    "dateUpdated": "2026-09-22T15:37:46.734Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95682",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:31:00.583552Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:31:09.389Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/View/Users/admin_email.ctp"
          ],
          "product": "MISP",
          "programFiles": [
            "app/View/Users/admin_email.ctp"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "unspecified",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = \"\u0026lt;?php echo $org;?\u0026gt;\";. Because the value was placed inside a double-quoted JavaScript string without any encoding, an organization name containing a double-quote character (or a backslash) could terminate the string literal and inject arbitrary JavaScript into the page. The injected script would execute in the context of any authenticated user who subsequently loads the admin email page, potentially allowing session hijacking, data exfiltration, or privileged actions performed on behalf of the victim.\u003c/p\u003e\u003cp\u003eExploitation requires the ability to set or modify the MISP.org organization name and a second authenticated user visiting the affected admin email view.\u003c/p\u003e\u003cp\u003eThe vulnerability is a classic instance of insufficient output encoding in a JavaScript context.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = \"\u003c?php echo $org;?\u003e\";. Because the value was placed inside a double-quoted JavaScript string without any encoding, an organization name containing a double-quote character (or a backslash) could terminate the string literal and inject arbitrary JavaScript into the page. The injected script would execute in the context of any authenticated user who subsequently loads the admin email page, potentially allowing session hijacking, data exfiltration, or privileged actions performed on behalf of the victim.\n\nExploitation requires the ability to set or modify the MISP.org organization name and a second authenticated user visiting the affected admin email view.\n\nThe vulnerability is a classic instance of insufficient output encoding in a JavaScript context."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Cross Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T13:56:51.445Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/5d6ace65e"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix replaces the raw PHP echo of the organization name with a json_encode() call using the flags JSON_HEX_TAG, JSON_HEX_AMP, JSON_HEX_APOS, and JSON_HEX_QUOT. This produces a properly escaped JavaScript string literal that neutralizes quotes, angle brackets, ampersands, and other metacharacters, preventing breakout from the string context and subsequent script injection.\u003c/p\u003e"
            }
          ],
          "value": "The fix replaces the raw PHP echo of the organization name with a json_encode() call using the flags JSON_HEX_TAG, JSON_HEX_AMP, JSON_HEX_APOS, and JSON_HEX_QUOT. This produces a properly escaped JavaScript string literal that neutralizes quotes, angle brackets, ampersands, and other metacharacters, preventing breakout from the string context and subsequent script injection."
        }
      ],
      "title": "MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "PR:H assumes that setting the MISP.org organization name requires administrative privileges; if a lower-privileged role can modify this setting, PR should be lowered.",
                  "The exact fixed version is not stated in the patch; the tag boundary (v2.5.47, 52 commits after fix) suggests the fix lands in a release after v2.5.47, but the precise version number is unconfirmed.",
                  "UI:P assumes the victim merely navigates to the admin email page (passive interaction); no click or form submission is required to trigger the stored script.",
                  "The CAPEC-1 mapping is direct; no uncertainty is noted because the commit message and diff unambiguously describe a stored XSS via unescaped output in a JavaScript context.",
                  "Impact metrics (VC:L, VI:L, SC:L, SI:L) assume the XSS is confined to the MISP application context and does not enable cross-origin data theft beyond what the victim\u0027s browser session already exposes."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "The patch demonstrates a stored XSS where attacker-controlled data (the MISP.org name) is reflected into a JavaScript context without encoding. CAPEC-1 is the canonical attack pattern for cross-site scripting. The mapping is direct and unambiguous given the commit message explicitly describes quote-breakout script injection."
                  }
                ],
                "commit": "5d6ace65e1d523dcbf04ce405a2f3a833cd353b2",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  }
                ],
                "cvssRationale": "AV:N: exploited over the network via a web application. AC:L: no race conditions or special timing; a single quote in the org name suffices. AT:N: no manipulation of the attack target required. PR:H: the attacker must have sufficient privileges to set the MISP.org organization name (assumed to be an admin-level capability). UI:P: the victim passively triggers the payload by navigating to the admin email page. VC:L / VI:L: the injected script can read page data, cookies, and perform actions in the victim\u0027s session, but is scoped to the MISP application. VA:N: no denial-of-service impact. SC:L / SI:L: limited sub-system impact via the victim\u0027s browser session. SA:N: no availability impact on the sub-system.",
                "fixSummary": "The fix replaces the raw PHP echo of the organization name with a json_encode() call using the flags JSON_HEX_TAG, JSON_HEX_AMP, JSON_HEX_APOS, and JSON_HEX_QUOT. This produces a properly escaped JavaScript string literal that neutralizes quotes, angle brackets, ampersands, and other metacharacters, preventing breakout from the string context and subsequent script injection.",
                "generatedAt": "2026-09-22T13:52:55.463303Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "9891167be879e4192e2ddd15347138945efa2bb402c49e7304af1b67f02a054b",
                "patchSummary": "In app/View/Users/admin_email.ctp, line 72, the expression var org = \"\u003c?php echo $org;?\u003e\"; is replaced with var org = \u003c?php echo json_encode($org, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT); ?\u003e;. The surrounding double quotes are removed because json_encode already emits a quoted string literal. The four JSON_HEX_* flags ensure that \u003c, \u003e, \u0026, \u0027, and \" are hex-escaped, making the output safe for embedding in both HTML and JavaScript contexts.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "5d6ace65e1d523dcbf04ce405a2f3a833cd353b2",
                    "patchSha256": "9891167be879e4192e2ddd15347138945efa2bb402c49e7304af1b67f02a054b",
                    "source": "https://github.com/MISP/MISP/commit/5d6ace65e.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/5d6ace65e.patch",
                    "subject": "fix: [ui] Escape MISP.org when it is echoed into the admin"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/5d6ace65e.patch",
                "subject": "fix: [ui] Escape MISP.org when it is echoed into the admin",
                "tagVersionBoundary": {
                  "commits_after_fix": 52,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "The organization name (attacker-influenced data) is written into a JavaScript string literal in an HTML page without context-appropriate encoding, allowing script breakout. This is a textbook stored XSS in a JavaScript context, which maps directly to CWE-79."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20214"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-95682",
    "datePublished": "2026-09-22T13:56:51.445Z",
    "dateReserved": "2026-09-22T13:56:48.812Z",
    "dateUpdated": "2026-09-22T15:31:09.389Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95683",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:27:57.869012Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:28:07.198Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "EventsController (Overmind event view / __enrichEvent)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/EventsController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Fable 5.1"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report\u0027s own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event\u0027s distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed.\u003c/p\u003e\u003cp\u003eThe result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report\u0027s own access-control policy.\u003c/p\u003e\u003cp\u003eThe vulnerability requires an authenticated MISP user with at least read access to the affected event.\u003c/p\u003e"
            }
          ],
          "value": "In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report\u0027s own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event\u0027s distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed.\n\nThe result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report\u0027s own access-control policy.\n\nThe vulnerability requires an authenticated MISP user with at least read access to the affected event."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Exploiting Incorrectly Configured Access Controls"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T14:06:59.969Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/6932aace8"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe report fetch in the Overmind event enrichment now applies the caller\u0027s ACL via EventReport::buildACLConditions($user), enforcing the report\u0027s own distribution policy in addition to the event-level access. A condition on EventReport.deleted = 0 is also added to exclude soft-deleted reports. The query is further hardened with recursive = -1 and an explicit contain clause to limit the data retrieved.\u003c/p\u003e"
            }
          ],
          "value": "The report fetch in the Overmind event enrichment now applies the caller\u0027s ACL via EventReport::buildACLConditions($user), enforcing the report\u0027s own distribution policy in addition to the event-level access. A condition on EventReport.deleted = 0 is also added to exclude soft-deleted reports. The query is further hardened with recursive = -1 and an explicit contain clause to limit the data retrieved."
        }
      ],
      "title": "MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "none",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The tag_version_boundary (v2.5.47, 57 commits after fix) is used as the nearest known version boundary; the exact first fixed release is not explicitly stated in the patch metadata, so the affected range is marked as less_than 2.5.47 with \u0027unspecified\u0027 version.",
                  "CVSS PR:L assumes the attacker needs only a standard authenticated MISP account with read access to the event; the specific role/permission level required is not detailed in the patch.",
                  "CVSS VC:H assumes the report content constitutes sensitive threat-intelligence data; the actual sensitivity depends on the report\u0027s content and the organization\u0027s data classification.",
                  "CAPEC-126 is selected as the closest match; the flaw is more precisely a missing authorization check (CWE-862) rather than a misconfiguration of an existing control, but no CAPEC entry specifically covers \u0027missing authorization on a sub-resource\u0027 more precisely.",
                  "The patch does not include test cases or reproduction steps; exploitability assessment is based solely on the code diff and commit message.",
                  "The \u0027Overmind\u0027 feature is assumed to be a MISP UI component for event viewing; its exact configuration and deployment context are not specified in the patch."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The access control for the EventReport resource was incorrectly configured (or absent) in the Overmind event-view code path: the report\u0027s distribution ACL was not applied, effectively leaving the resource accessible to any user who could see the parent event. This is the closest CAPEC to a missing/incomplete authorization check on a specific resource. The mapping is slightly uncertain because the flaw is a missing check rather than a misconfiguration of an existing check, but CAPEC-126 is the best available match for an access-control enforcement gap on a specific object."
                  }
                ],
                "commit": "6932aace844520526819253ea285def97e48189e",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Fable 5.1"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: An authenticated user with read access to any event simply views it in the Overmind interface; no race conditions, special timing, or complex manipulation are required. AT:N: No attack-target manipulation is needed. PR:L: The attacker must be an authenticated MISP user with at least read permission on the event; no administrative privileges are required. UI:N: No victim interaction beyond the attacker\u0027s own viewing action. VC:H: Sensitive threat-intelligence report content (IOCs, analysis, context) is disclosed to a user the report\u0027s distribution explicitly excludes. VI:N, VA:N: No integrity or availability impact. SC:N, SI:N, SA:N: The impact is confined to the MISP instance\u0027s own data; no cross-system impact is evidenced.",
                "fixSummary": "The report fetch in the Overmind event enrichment now applies the caller\u0027s ACL via EventReport::buildACLConditions($user), enforcing the report\u0027s own distribution policy in addition to the event-level access. A condition on EventReport.deleted = 0 is also added to exclude soft-deleted reports. The query is further hardened with recursive = -1 and an explicit contain clause to limit the data retrieved.",
                "generatedAt": "2026-09-22T13:58:09.551694Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 6,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 4
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "d3472acf034e415d9322bc1f5f399efb811afbb547bc230fe69d2e83c2975dd2",
                "patchSummary": "In app/Controller/EventsController.php, the __enrichEvent() method\u0027s report lookup is changed from a simple event_id condition to a composite condition built from EventReport::buildACLConditions($user) combined with EventReport.event_id and EventReport.deleted = 0. The find() call is updated to use the new $reportConditions array, adds \u0027contain\u0027 =\u003e EventReport::DEFAULT_CONTAIN, and sets \u0027recursive\u0027 =\u003e -1 to prevent unnecessary eager-loading of associated models.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "6932aace844520526819253ea285def97e48189e",
                    "patchSha256": "d3472acf034e415d9322bc1f5f399efb811afbb547bc230fe69d2e83c2975dd2",
                    "source": "https://github.com/MISP/MISP/commit/6932aace8.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/6932aace8.patch",
                    "subject": "fix: [security] Apply the caller\u0027s ACL to the event view\u0027s"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/6932aace8.patch",
                "subject": "fix: [security] Apply the caller\u0027s ACL to the event view\u0027s",
                "tagVersionBoundary": {
                  "commits_after_fix": 57,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The report\u0027s own ACL/distribution check was entirely absent from the Overmind event-view enrichment path. The code fetched the report by event ID without invoking buildACLConditions(), so the report-level authorization policy was never enforced for this code path."
                  },
                  {
                    "cweId": "CWE-639",
                    "rationale": "The event ID, which is a user-controllable identifier in the request, was used as the sole key to retrieve a report resource whose access should be independently governed by the report\u0027s distribution. This allowed bypass of the report\u0027s authorization by leveraging the event-level access."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20285"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-95683",
    "datePublished": "2026-09-22T14:06:59.969Z",
    "dateReserved": "2026-09-22T14:06:57.011Z",
    "dateUpdated": "2026-09-22T15:28:07.198Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}