Find a vulnerability

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94404",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T14:34:58.261364Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T14:48:16.245Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "AttributesController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/AttributesController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user\u2019s browser without that user knowingly approving the change.\u003c/p\u003e\u003cp\u003eThe affected function did not properly enforce MISP\u2019s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.\u003c/p\u003e\u003cp\u003eIf successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.\u003c/p\u003e\u003cp\u003eThe attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.\u003c/p\u003e\u003cp\u003eThe main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.\u003c/p\u003eVersion affected: \u0026lt;2.5.47"
            }
          ],
          "value": "MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user\u2019s browser without that user knowingly approving the change.\n\nThe affected function did not properly enforce MISP\u2019s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.\n\nIf successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.\n\nThe attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.\n\nThe main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-124",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-124 Cross-Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T13:50:46.410Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/dfbae33f9"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token.\u003c/p\u003e"
            }
          ],
          "value": "The editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token."
        }
      ],
      "title": "MISP CSRF vulnerability allows unauthorized attribute modification",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary (v2.5.47 with 7 commits after the fix); no explicit \u0027affected\u0027 or \u0027fixed\u0027 version strings are provided in the metadata, so the exact version boundary is approximate.",
                  "UI:P (Passive) is assumed because the commit message describes a \u0027cross-site form post\u0027 that auto-submits when the victim\u0027s browser loads the attacker\u0027s page; if the attack requires the victim to explicitly click a link or submit a form, UI:A would be more appropriate.",
                  "PR:N is assumed because the attacker does not need their own MISP account; the victim\u0027s authenticated session cookie is sufficient. If MISP deployments require additional authentication factors (e.g., MFA) that would block a cross-site form post, the effective exploitability may be lower.",
                  "The CAPEC-124 mapping is the closest standard pattern for CSRF; no more specific CAPEC exists for the CakePHP unlockedActions bypass mechanism.",
                  "The Co-Authored-By AI tool is included as a \u0027tool\u0027 credit based on explicit commit metadata; it is not a human contributor."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-124",
                    "rationale": "The patch description explicitly states that a cross-site form post carrying the victim\u0027s session cookie could rewrite attribute fields. This is the canonical CSRF attack pattern: an attacker induces a victim\u0027s browser to send an authenticated request to a target application without the victim\u0027s knowledge or consent. CAPEC-124 is the most direct and specific match."
                  }
                ],
                "commit": "dfbae33f9a93bf127fae115bc6cd1a9e03d028e9",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The attack is delivered over the network via a malicious web page. AC:L: Crafting a CSRF form is straightforward and requires no race conditions or special timing. AT:N: The target MISP instance is not under the attacker\u0027s control. PR:N: The attacker needs no account on MISP; the victim\u0027s existing session is sufficient. UI:P: The victim must passively load the attacker\u0027s page (e.g., visit a link), which triggers the auto-submitting form; no explicit click or form submission by the victim is required. VC:N: The attack modifies data but does not disclose confidential information. VI:H: The attacker can alter attribute values, types, categories, distribution, and timestamps, corrupting threat-intelligence data for all users. VA:N: No denial-of-service impact is indicated. SC/SI/SA:N: No secondary impacts on other systems are evidenced.",
                "fixSummary": "The editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token.",
                "generatedAt": "2026-09-21T13:38:54.473662Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "beb65b8daaa1d2e649f1178cc7f2c774f4ba7e75a13cc000524eef566c4545c8",
                "patchSummary": "In app/Controller/AttributesController.php, the string \u0027editField\u0027 is added to the _csrfTokenHeaderOnly() call in beforeFilter(), enabling header-or-body CSRF token validation for that action. Simultaneously, the line adding \u0027editField\u0027 to $this-\u003eSecurity-\u003eunlockedActions[] is removed, so the action is no longer exempt from CSRF checks. A comment block is added explaining that both the Overmind index (token in X-CSRF-Token header) and legacy inline forms (token in body) already carry a valid token, so only the unsatisfiable field-hash check is dropped.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "dfbae33f9a93bf127fae115bc6cd1a9e03d028e9",
                    "patchSha256": "beb65b8daaa1d2e649f1178cc7f2c774f4ba7e75a13cc000524eef566c4545c8",
                    "source": "https://github.com/MISP/MISP/commit/dfbae33f9.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/dfbae33f9.patch",
                    "subject": "fix: [security] Keep the CSRF check on the inline attribute"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/dfbae33f9.patch",
                "subject": "fix: [security] Keep the CSRF check on the inline attribute",
                "tagVersionBoundary": {
                  "commits_after_fix": 7,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-352",
                    "rationale": "The editField action was placed in unlockedActions, which explicitly bypassed the CSRF token check. This allowed a cross-site form post to modify attribute data using only the victim\u0027s session cookie, a textbook CSRF weakness."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20043"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94404",
    "datePublished": "2026-09-21T13:50:46.410Z",
    "dateReserved": "2026-09-21T13:50:44.676Z",
    "dateUpdated": "2026-09-21T14:48:16.245Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94401",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T14:35:17.511576Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T14:48:16.804Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Model/Event.php (addMISPExportFile)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Event.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services.\u003c/p\u003e\u003cp\u003eWhen importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify data could upload a file containing a local file path or a web address instead.\u003c/p\u003e\u003cp\u003eIf a local file path was supplied, MISP could read that file from the server. If a URL was supplied, MISP could make a request to that address, including systems that may only be reachable from inside the organization\u2019s network.\u003c/p\u003e\u003cp\u003eThe vulnerability could therefore expose sensitive local files and allow unauthorized requests to internal services.\u003c/p\u003e\u003cp\u003eExploitation required a valid MISP account with modify permissions, but no additional user interaction was needed.\u003c/p\u003eVersion affected: \u0026lt;2.5.47"
            }
          ],
          "value": "MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services.\n\nWhen importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify data could upload a file containing a local file path or a web address instead.\n\nIf a local file path was supplied, MISP could read that file from the server. If a URL was supplied, MISP could make a request to that address, including systems that may only be reachable from inside the organization\u2019s network.\n\nThe vulnerability could therefore expose sensitive local files and allow unauthorized requests to internal services.\n\nExploitation required a valid MISP account with modify permissions, but no additional user interaction was needed.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Server Side Request Forgery"
            }
          ]
        },
        {
          "capecId": "CAPEC-2",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-2 Parameter Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73 External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T13:36:13.066Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/d5f247b91"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces two defensive measures in addMISPExportFile(): (1) a pre-parse validation that rejects any uploaded content not containing an XML document marker (the \u0027\u0026lt;\u0027 character), preventing path or URL strings from reaching the XML parser; and (2) an explicit readFile =\u0026gt; false option passed to Xml::build(), which disables the library\u0027s ability to interpret the input as a file path or URL to be read or fetched. Together these changes ensure that only genuine XML document content is parsed and that no server-side file access or network request is triggered by user-supplied data.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces two defensive measures in addMISPExportFile(): (1) a pre-parse validation that rejects any uploaded content not containing an XML document marker (the \u0027\u003c\u0027 character), preventing path or URL strings from reaching the XML parser; and (2) an explicit readFile =\u003e false option passed to Xml::build(), which disables the library\u0027s ability to interpret the input as a file path or URL to be read or fetched. Together these changes ensure that only genuine XML document content is parsed and that no server-side file access or network request is triggered by user-supplied data."
        }
      ],
      "title": "MISP Arbitrary Local File Read and SSRF via MISP Export Upload",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The commit message states the vulnerability was \u0027found during the internal review, not externally reported,\u0027 so no external finder or reporter credit is assigned. The internal reviewer\u0027s identity is not specified in the patch metadata.",
                  "The affected version range is inferred from the tag_version_boundary (v2.5.47 with 40 commits after the fix), but exact affected and fixed version numbers are not stated in the patch. The boundary is recorded as a reference point only.",
                  "PR:L assumes that perm_modify is a non-administrative, commonly granted role in MISP deployments. If perm_modify is equivalent to full administrative access in some configurations, PR could be elevated to PR:H.",
                  "The CAPEC-2 mapping is a broader, secondary pattern included for completeness; CAPEC-126 is the primary and most specific match. The uncertainty is noted in the CAPEC-2 rationale.",
                  "The commit message references an operator-precedence issue in Xml::build()\u0027s readFile guard not covering the https branch. This is taken as evidence from the commit message and patch comments; the actual Xml utility source is not included in the patch, so the exact mechanism of the https bypass is assumed rather than verified.",
                  "CVSS SC:H assumes the SSRF can reach internal services with sensitive data. If the deployment restricts outbound network access, SC could be reduced."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The patch explicitly describes the SSRF vector: an .xml upload containing a URL causes MISP to fetch that URL and import the result. CAPEC-126 describes an attacker manipulating a server-side application to make it issue requests to unintended targets, which is exactly the attack demonstrated here. The local-file-read aspect is a secondary manifestation of the same root cause (unvalidated input passed to a function that resolves locators) and is subsumed by the SSRF pattern in this context."
                  },
                  {
                    "capecId": "CAPEC-2",
                    "rationale": "The attacker manipulates the content parameter of the MISP export upload to supply a file path or URL instead of a valid XML document. CAPEC-2 covers the general technique of altering application parameters to trigger unintended behavior. This is a secondary mapping; CAPEC-126 is the more specific and primary pattern. The uncertainty is that CAPEC-2 is broader and less precise than CAPEC-126 for this specific vulnerability."
                  }
                ],
                "commit": "d5f247b91ad3e8ea86feaaa587bf0466c95ea996",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: exploitation occurs over the network via the MISP web interface. AC:L: the attack is deterministic; uploading a file with a path or URL as content reliably triggers the read/fetch. AT:N: no special target-side conditions are required. PR:L: the attacker needs an authenticated account with perm_modify (a non-privileged but authenticated role). UI:N: the attacker performs the upload autonomously; no victim interaction is needed. VC:H: arbitrary local file read exposes sensitive server data (credentials, configs, keys). VI:N: the imported data is stored as an event but does not corrupt application state or logic. VA:N: no denial-of-service impact is indicated. SC:H: the SSRF component allows the attacker to read responses from internal services (metadata endpoints, admin panels, etc.), impacting subsequent-component confidentiality. SI:N and SA:N: no evidence of integrity or availability impact on subsequent components from the patch evidence.",
                "fixSummary": "The fix introduces two defensive measures in addMISPExportFile(): (1) a pre-parse validation that rejects any uploaded content not containing an XML document marker (the \u0027\u003c\u0027 character), preventing path or URL strings from reaching the XML parser; and (2) an explicit readFile =\u003e false option passed to Xml::build(), which disables the library\u0027s ability to interpret the input as a file path or URL to be read or fetched. Together these changes ensure that only genuine XML document content is parsed and that no server-side file access or network request is triggered by user-supplied data.",
                "generatedAt": "2026-09-21T13:28:43.719596Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 6,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "004f65b4d416b8e01f8b713a982a9b4d808e454c40cd74cc94d36137eb1b2845",
                "patchSummary": "In app/Model/Event.php, the single line calling Xml::toArray(Xml::build($data)) is replaced with a guard clause that throws an Exception if strpos($data, \u0027\u003c\u0027) === false, followed by Xml::toArray(Xml::build($data, [\u0027readFile\u0027 =\u003e false])). Nine lines are added (including a four-line explanatory comment) and one line is removed. No other files are modified.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "d5f247b91ad3e8ea86feaaa587bf0466c95ea996",
                    "patchSha256": "004f65b4d416b8e01f8b713a982a9b4d808e454c40cd74cc94d36137eb1b2845",
                    "source": "https://github.com/MISP/MISP/commit/d5f247b91.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/d5f247b91.patch",
                    "subject": "fix: [security] Refuse a MISP export upload whose content is"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/d5f247b91.patch",
                "subject": "fix: [security] Refuse a MISP export upload whose content is",
                "tagVersionBoundary": {
                  "commits_after_fix": 40,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-918",
                    "rationale": "The primary and most severe impact is that an attacker-supplied URL in the uploaded file body causes the MISP server to issue an HTTP request to an arbitrary internal or external address and import the response. This is a textbook SSRF: user-controlled input is used as a network request target by the server."
                  },
                  {
                    "cweId": "CWE-73",
                    "rationale": "The secondary impact is that a user-supplied local file path in the uploaded file body is passed to Xml::build() which reads that file from the server\u0027s filesystem. The attacker controls the file path that the server reads, matching CWE-73. CWE-22 (Path Traversal) was considered but the input is not a relative traversal sequence; it is an absolute path chosen by the attacker, making CWE-73 the more precise mapping."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20056"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94401",
    "datePublished": "2026-09-21T13:36:13.066Z",
    "dateReserved": "2026-09-21T13:36:11.048Z",
    "dateUpdated": "2026-09-21T14:48:16.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94394",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T14:35:25.970564Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T14:48:16.963Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "ObjectReferencesController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/ObjectReferencesController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user.\u003cbr\u003e\u003cbr\u003e\u003cp\u003eBecause of this, someone who can view an event could potentially access attributes or objects inside that event that were meant to be restricted to a specific sharing group or distribution level.\u003c/p\u003eThe vulnerability affects authenticated users who are not site administrators and who already have access to an event containing more restricted data.\u003cbr\u003e\u003cbr\u003eThe main impact is that users may be able to view sensitive attribute values, object details, or related object data that they should not normally be allowed to see.\u003cbr\u003e"
            }
          ],
          "value": "When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user.\n\nBecause of this, someone who can view an event could potentially access attributes or objects inside that event that were meant to be restricted to a specific sharing group or distribution level.\n\nThe vulnerability affects authenticated users who are not site administrators and who already have access to an event containing more restricted data.\n\nThe main impact is that users may be able to view sensitive attribute values, object details, or related object data that they should not normally be allowed to see."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-109",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-109 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T13:25:40.360Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/f36634e57"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces granular authorization checks in the ObjectReferencesController add() method. For non-site-admin users, the query conditions for attributes, objects, and object attributes are now augmented with OR clauses that restrict results to: (1) entities belonging to the user\u0027s own event, (2) entities with unrestricted distribution levels (1, 2, 3, 5), or (3) entities with distribution level 4 whose sharing_group_id is in the user\u0027s authorized sharing group list. This ensures that only data the user is explicitly authorized to see under MISP\u0027s distribution and sharing-group model is included in the object reference operation.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces granular authorization checks in the ObjectReferencesController add() method. For non-site-admin users, the query conditions for attributes, objects, and object attributes are now augmented with OR clauses that restrict results to: (1) entities belonging to the user\u0027s own event, (2) entities with unrestricted distribution levels (1, 2, 3, 5), or (3) entities with distribution level 4 whose sharing_group_id is in the user\u0027s authorized sharing group list. This ensures that only data the user is explicitly authorized to see under MISP\u0027s distribution and sharing-group model is included in the object reference operation."
        }
      ],
      "title": "MISP ObjectReferencesController: Granular Distribution and Sharing Group Restrictions Bypassed When Adding Object References",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact affected and fixed version numbers are not specified in the patch metadata. The tag_version_boundary indicates the fix commit is 140 commits after v2.5.47, but the precise release version containing the fix is unknown.",
                  "The CAPEC-109 (Parameter Tampering) mapping is the closest available match but is not a perfect fit; the vulnerability is more precisely a missing granular authorization check rather than parameter manipulation. No CAPEC specifically models broken sub-entity access control.",
                  "The CVSS SC:H rating assumes that the exposed attribute/object data constitutes sensitive information (e.g., IOCs, malware indicators, threat intelligence) whose unauthorized disclosure is a significant confidentiality impact. If the data is considered low-sensitivity, SC:L may be more appropriate.",
                  "The vulnerability requires the attacker to already have event-level access; it does not grant access to events the user cannot see. The bypass is limited to granular restrictions within an already-accessible event.",
                  "The patch only addresses the add() method in ObjectReferencesController; other methods or controllers with similar patterns may or may not be affected, but no evidence of additional affected code paths is present in this patch."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-109",
                    "rationale": "The closest plausible CAPEC is Parameter Tampering. An authenticated user supplies an objectId parameter to the add() endpoint, and the application fails to enforce proper authorization on the sub-entities (attributes, objects, object attributes) associated with that object. The user effectively \u0027tampers\u0027 with the scope of accessible data by leveraging event-level access to reach restricted sub-entities. This is not a perfect match because the user is not modifying a parameter to an invalid value but rather exploiting the absence of a check on a valid parameter\u0027s sub-resources. No CAPEC specifically models \u0027broken granular access control\u0027 or \u0027insecure direct object reference at sub-entity level,\u0027 making CAPEC-109 the best available approximation."
                  }
                ],
                "commit": "f36634e57b93ad9daa3ab9530b76b9e5cba796e2",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The attack requires no special conditions beyond having a valid account with event-level access; no race conditions or complex setup needed. AT:N: No manipulation of a separate attack target is required. PR:L: The attacker needs a low-privilege authenticated account (any non-site-admin user with access to an event containing restricted attributes/objects). UI:N: No victim interaction is required; the attacker simply calls the API endpoint. VC:N/VI:N/VA:N: The MISP server itself (the vulnerable component) is not compromised in its own confidentiality, integrity, or availability. SC:H: The resource impact is high because restricted attribute values, object metadata, and object-attribute data that are explicitly gated by distribution levels and sharing groups are exposed to an unauthorized user. SI:N: No integrity impact on the data. SA:N: No safety impact.",
                "fixSummary": "The fix introduces granular authorization checks in the ObjectReferencesController add() method. For non-site-admin users, the query conditions for attributes, objects, and object attributes are now augmented with OR clauses that restrict results to: (1) entities belonging to the user\u0027s own event, (2) entities with unrestricted distribution levels (1, 2, 3, 5), or (3) entities with distribution level 4 whose sharing_group_id is in the user\u0027s authorized sharing group list. This ensures that only data the user is explicitly authorized to see under MISP\u0027s distribution and sharing-group model is included in the object reference operation.",
                "generatedAt": "2026-09-21T13:15:28.001598Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "2688fca1334e3016b8b885ce926749f8d47e49d7b657cf38f7b2edcd6eaf6cf0",
                "patchSummary": "In app/Controller/ObjectReferencesController.php, the add() method is modified to build dynamic condition arrays ($attributeConditions, $objectConditions, $objectAttributeConditions) that incorporate the current user\u0027s role and authorized sharing group IDs. For non-site-admin users, each condition array gains an OR clause filtering by event ownership, distribution levels (1,2,3,5), or distribution level 4 with a matching sharing_group_id from the user\u0027s authorized IDs. These condition arrays replace the previously hardcoded minimal conditions (deleted=0, object_id=0) in the Contain clauses for Attribute, Object, and nested Object.Attribute queries. The user\u0027s authorized sharing group IDs are obtained via SharingGroup-\u003eauthorizedIds($user).",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "f36634e57b93ad9daa3ab9530b76b9e5cba796e2",
                    "patchSha256": "2688fca1334e3016b8b885ce926749f8d47e49d7b657cf38f7b2edcd6eaf6cf0",
                    "source": "https://github.com/MISP/MISP/commit/f36634e57.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/f36634e57.patch",
                    "subject": "fix: [security] Extended event granular restrictions ignored"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/f36634e57.patch",
                "subject": "fix: [security] Extended event granular restrictions ignored",
                "tagVersionBoundary": {
                  "commits_after_fix": 140,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The ObjectReferencesController add() method was missing authorization checks for granular distribution-level and sharing-group restrictions on attributes, objects, and object attributes. Only event-level access was verified, while the sub-entity level access controls (distribution levels 1-5, sharing group membership) were entirely absent from the query conditions. This is a classic missing authorization check at a finer granularity than what was enforced."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20106"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94394",
    "datePublished": "2026-09-21T13:25:40.360Z",
    "dateReserved": "2026-09-21T13:25:38.483Z",
    "dateUpdated": "2026-09-21T14:48:16.963Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94393",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:18:01.147790Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T15:18:17.855Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Model/EventReport.php"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/EventReport.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "David Andr\u00e9"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003c/div\u003e\u003cp\u003eWhen a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event.\u003c/p\u003e\u003cp\u003eAs a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report\u2019s UUID. Once moved, they could view and change information that they were not originally allowed to access.\u003c/p\u003e\u003cp\u003eThe vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID.\u003c/p\u003e\u003cp\u003eThe main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP\u2019s normal access restrictions.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e\u003cdiv\u003e\u003c/div\u003e"
            }
          ],
          "value": "When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event.\n\nAs a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report\u2019s UUID. Once moved, they could view and change information that they were not originally allowed to access.\n\nThe vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID.\n\nThe main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP\u2019s normal access restrictions.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-174",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-174 Exploiting Incorrectly Handled Edge Cases"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T13:14:00.619Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/43665b9bb"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix adds an ownership check in editReport: before adopting an existing report found by UUID, the code now verifies that the report\u0027s event_id matches the event being edited. If the UUID resolves to a report belonging to a different event, the operation is rejected with an error message, preventing cross-event reparenting, unauthorized read, and unauthorized overwrite of reports.\u003c/p\u003e"
            }
          ],
          "value": "The fix adds an ownership check in editReport: before adopting an existing report found by UUID, the code now verifies that the report\u0027s event_id matches the event being edited. If the UUID resolves to a report belonging to a different event, the operation is rejected with an error message, preventing cross-event reparenting, unauthorized read, and unauthorized overwrite of reports."
        }
      ],
      "title": "MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary (v2.5.47, 56 commits after fix); the exact first affected and first fixed release versions are not stated in the patch and are marked unspecified.",
                  "PR:L assumes the attacker needs at minimum editor-level access to one event; the patch does not specify whether viewer-level access could also trigger the code path, but the commit message explicitly references \u0027an event editor\u0027.",
                  "CAPEC-174 is selected as the closest available attack pattern; no CAPEC entry specifically covers IDOR or broken object reference resolution, so the mapping is approximate.",
                  "The CVSS sub-component impact (SC:H, SI:H) assumes the event report data constitutes a distinct data asset whose confidentiality and integrity are the primary impact, rather than the MISP application\u0027s own state.",
                  "The commit date (2026-09-16) and tag boundary are taken at face value from the supplied metadata; no independent verification of release timing was performed."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-174",
                    "rationale": "The edge case of a UUID belonging to a different event was not handled: the code assumed any UUID found in the global table belonged to the current event. The attacker exploits this unhandled edge case to reparent a foreign report. This is the closest CAPEC; a more specific \u0027IDOR\u0027 or \u0027broken object reference\u0027 CAPEC does not exist in the CAPEC catalog, so CAPEC-174 is the best available match."
                  }
                ],
                "commit": "43665b9bb6bd39af0db1f38e608bdf2cb84b9dec",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  },
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "David Andr\u00e9"
                  },
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: the attacker only needs to supply a known/guessed UUID in a standard edit request; no race or complex condition. AT:N: no manipulation of the target environment is required. PR:L: the attacker must be an authenticated user with editor role on at least one event. UI:N: no victim interaction is needed. VC:N/VI:N/VA:N: the MISP application itself (its configuration, credentials, availability) is not directly impacted. SC:H: the attacker gains read access to private report data in events they cannot otherwise see. SI:H: the attacker can overwrite and modify report data belonging to other events. SA:N: no safety-system impact.",
                "fixSummary": "The fix adds an ownership check in editReport: before adopting an existing report found by UUID, the code now verifies that the report\u0027s event_id matches the event being edited. If the UUID resolves to a report belonging to a different event, the operation is rejected with an error message, preventing cross-event reparenting, unauthorized read, and unauthorized overwrite of reports.",
                "generatedAt": "2026-09-21T13:01:16.364280Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "2306bd95d16b9c00582997897aa9181253364082a09589640fce576a03beafb4",
                "patchSummary": "In app/Model/EventReport.php, the editReport method\u0027s else-branch (handling an existing report found by UUID) now includes an 11-line guard: it compares (string)$existingReport[\u0027EventReport\u0027][\u0027event_id\u0027] against (string)$eventId and, on mismatch, appends an error string and returns early, preventing the subsequent assignment of the foreign report\u0027s ID to the current event\u0027s report record.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "43665b9bb6bd39af0db1f38e608bdf2cb84b9dec",
                    "patchSha256": "2306bd95d16b9c00582997897aa9181253364082a09589640fce576a03beafb4",
                    "source": "https://github.com/MISP/MISP/commit/43665b9bb.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/43665b9bb.patch",
                    "subject": "fix: [security] Refuse to adopt an event report that belongs"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/43665b9bb.patch",
                "subject": "fix: [security] Refuse to adopt an event report that belongs",
                "tagVersionBoundary": {
                  "commits_after_fix": 56,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-639",
                    "rationale": "The report UUID is a user-controlled key resolved globally without scoping to the caller\u0027s event context. The system failed to verify that the referenced object (report) belongs to the event the caller is authorized to edit, allowing cross-event access."
                  },
                  {
                    "cweId": "CWE-284",
                    "rationale": "The broader category applies: MISP\u0027s per-event access control model was bypassed because the editReport path did not enforce that a report UUID maps to the same event the caller is operating on."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20057"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94393",
    "datePublished": "2026-09-21T13:14:00.619Z",
    "dateReserved": "2026-09-21T13:13:54.299Z",
    "dateUpdated": "2026-09-21T15:18:17.855Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94383",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T14:37:12.233579Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T14:48:17.369Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "WorkflowModules/action/Module_blocklist_action"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/WorkflowModules/action/Module_blocklist_action.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename() to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary extension that would be placed in the MISP export directory. If the underlying web server is configured to interpret and execute scripts from that directory, the resulting file could be invoked, leading to arbitrary code execution in the context of the web server process.\u003c/p\u003e\u003cp\u003eThe vulnerability requires the attacker to hold site-administrator privileges within MISP, as the blocklist workflow module is restricted to that role. No additional user interaction is required beyond triggering the workflow action with a crafted filename parameter. The impact is full compromise of the MISP server\u0027s confidentiality, integrity, and availability, as arbitrary script execution grants the attacker the same privileges as the web server user.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename() to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary extension that would be placed in the MISP export directory. If the underlying web server is configured to interpret and execute scripts from that directory, the resulting file could be invoked, leading to arbitrary code execution in the context of the web server process.\n\nThe vulnerability requires the attacker to hold site-administrator privileges within MISP, as the blocklist workflow module is restricted to that role. No additional user interaction is required beyond triggering the workflow action with a crafted filename parameter. The impact is full compromise of the MISP server\u0027s confidentiality, integrity, and availability, as arbitrary script execution grants the attacker the same privileges as the web server user.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-170",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-170 File Upload"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:52:03.355Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/e5a943178"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe vulnerability is remediated by enforcing a strict whitelist of allowed file extensions (txt, list, blocklist, csv) on the blocklist filename parameter before the file is processed. Any filename with an extension outside this whitelist is rejected with an error, preventing an attacker from placing files with executable or dangerous extensions (e.g., .php, .phtml) into the MISP export directory where they could be interpreted by the web server.\u003c/p\u003e"
            }
          ],
          "value": "The vulnerability is remediated by enforcing a strict whitelist of allowed file extensions (txt, list, blocklist, csv) on the blocklist filename parameter before the file is processed. Any filename with an extension outside this whitelist is rejected with an error, preventing an attacker from placing files with executable or dangerous extensions (e.g., .php, .phtml) into the MISP export directory where they could be interpreted by the web server."
        }
      ],
      "title": "MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The commit message states \u0027site admin only\u0027, which is taken as evidence that the vulnerable workflow module requires MISP site-administrator privileges. The exact privilege model and whether lower-privilege roles could reach this code path is not confirmed by the patch alone.",
                  "The assumption that the MISP export directory is web-accessible and that the web server is configured to execute scripts (e.g., PHP) from that directory is inferred from the commit subject \u0027arbitrary script execution\u0027. The patch does not include web server configuration evidence.",
                  "The affected version boundary (prior to v2.5.47) is inferred from the tag_version_boundary metadata showing v2.5.47 as the nearest tag with 142 commits after the fix. The exact first affected version is not stated in the patch.",
                  "CAPEC-170 (File Upload) is the closest available attack pattern, but the actual mechanism is a workflow parameter specifying a filename rather than a traditional file upload. This mapping is approximate.",
                  "The CVSS PR:H rating assumes that \u0027site admin\u0027 in MISP corresponds to a high-privilege role requiring authentication and elevated permissions, consistent with MISP\u0027s role model."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-170",
                    "rationale": "CAPEC-170 describes an attacker uploading or placing a file with a dangerous extension into a target directory where it can be executed. In this case, a site admin specifies a blocklist filename with a dangerous extension (e.g., .php) that is placed in the MISP export directory. The mechanism is not a traditional multipart upload but rather a workflow parameter that results in a file being written to a web-accessible location. CAPEC-170 is the closest available pattern; the uncertainty is that the file is not uploaded via a standard upload endpoint but is instead referenced by name in a workflow action, making the mapping approximate."
                  }
                ],
                "commit": "e5a9431784b4a78faddc0cc6efc2a287f2fd3d08",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The attack requires only specifying a filename with a dangerous extension in a workflow parameter; no race conditions or complex timing are needed. AT:N: No manipulation of the target system is required beyond the normal API call. PR:H: The commit message explicitly states \u0027site admin only\u0027, requiring high-privilege MISP access. UI:N: No victim interaction is needed; the workflow action is triggered by the admin themselves. VC:H, VI:H, VA:H: Arbitrary script execution on the MISP server compromises all three local security properties. SC:N, SI:N, SA:N: The impact is confined to the MISP server; no evidence of lateral impact on other systems is present in the patch.",
                "fixSummary": "The vulnerability is remediated by enforcing a strict whitelist of allowed file extensions (txt, list, blocklist, csv) on the blocklist filename parameter before the file is processed. Any filename with an extension outside this whitelist is rejected with an error, preventing an attacker from placing files with executable or dangerous extensions (e.g., .php, .phtml) into the MISP export directory where they could be interpreted by the web server.",
                "generatedAt": "2026-09-21T12:44:28.234229Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "9b7cc757cbbc8a4dd7491c6388e0ee12057c790bb6ca21e10b1d78209bbb7748",
                "patchSummary": "In app/Model/WorkflowModules/action/Module_blocklist_action.php, five lines are inserted after the existing basename() call. The added code defines an $allowedExtensions array containing \u0027txt\u0027, \u0027list\u0027, \u0027blocklist\u0027, and \u0027csv\u0027, extracts the file extension via pathinfo() with PATHINFO_EXTENSION, and performs a strict (===) in_array() check. If the extension is not in the whitelist, the method returns early with a failure message \u0027Blocklist filename has an invalid extension.\u0027 This check is placed before the existing empty/dot filename validation.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "e5a9431784b4a78faddc0cc6efc2a287f2fd3d08",
                    "patchSha256": "9b7cc757cbbc8a4dd7491c6388e0ee12057c790bb6ca21e10b1d78209bbb7748",
                    "source": "https://github.com/MISP/MISP/commit/e5a943178.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/e5a943178.patch",
                    "subject": "fix: [security] arbitrary script execution via insufficient"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/e5a943178.patch",
                "subject": "fix: [security] arbitrary script execution via insufficient",
                "tagVersionBoundary": {
                  "commits_after_fix": 142,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-434",
                    "rationale": "The blocklist filename parameter accepted arbitrary file extensions without restriction. A site admin could supply a filename with a dangerous extension (e.g., .php) that would be placed in a web-accessible export directory, enabling script execution. The fix restricts extensions to a safe whitelist, which is the canonical remediation for CWE-434."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "The filename parameter was not validated against a set of acceptable values (extensions). Only path stripping and empty-string checks were performed, leaving the extension entirely unvalidated. This is a general improper input validation weakness that enabled the more specific dangerous-file-type issue."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20009"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94383",
    "datePublished": "2026-09-21T12:52:03.355Z",
    "dateReserved": "2026-09-21T12:52:01.101Z",
    "dateUpdated": "2026-09-21T14:48:17.369Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94381",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T14:37:33.435781Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T14:48:17.524Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "UsersController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/UsersController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eMISP has a security issue that can let a user gain more access than their API key is supposed to allow.\u003c/p\u003e\u003cp\u003eA read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user\u2019s normal account permissions. This means someone with a read-only API key could potentially gain write, delete, or even administrator access if their underlying account has those permissions.\u003c/p\u003e\u003cp\u003eExploiting the issue requires a valid read-only API key and a single request to the affected function.\u003c/p\u003e\u003cp\u003eThe main impact is that MISP\u2019s API key restrictions can be bypassed, allowing actions that the API key was specifically meant to prevent.\u003c/p\u003e\u003cbr\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "MISP has a security issue that can let a user gain more access than their API key is supposed to allow.\n\nA read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user\u2019s normal account permissions. This means someone with a read-only API key could potentially gain write, delete, or even administrator access if their underlying account has those permissions.\n\nExploiting the issue requires a valid read-only API key and a single request to the affected function.\n\nThe main impact is that MISP\u2019s API key restrictions can be bypassed, allowing actions that the API key was specifically meant to prevent.\n\n\n\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-114 Exploiting Incorrectly Configured Privileges"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:42:53.242Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/fd27e592a"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix removes the call to User::getAuthUser() and Auth::login() from the updateLoginTime() method, which was re-authenticating the user with their full role permissions. It replaces this with a call to _refreshAuth(), which refreshes the authentication state while preserving the current (restricted) permission level associated with the API key, preventing privilege escalation.\u003c/p\u003e"
            }
          ],
          "value": "The fix removes the call to User::getAuthUser() and Auth::login() from the updateLoginTime() method, which was re-authenticating the user with their full role permissions. It replaces this with a call to _refreshAuth(), which refreshes the authentication state while preserving the current (restricted) permission level associated with the API key, preventing privilege escalation."
        }
      ],
      "title": "MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The tag_version_boundary indicates the fix commit is 141 commits before v2.5.47, implying v2.5.47 contains the fix; versions prior to v2.5.47 are assumed affected. No explicit version range is stated in the patch.",
                  "The _refreshAuth() method is assumed to preserve the current API-key-scoped permission level rather than re-fetching full role permissions; this is inferred from the commit subject and the removal of getAuthUser()/Auth::login().",
                  "The \u0027full role\u0027 referenced in the commit subject is assumed to be a higher-privilege role (e.g., admin or site admin) compared to the read-only API key scope.",
                  "CAPEC-114 is the closest available attack pattern; no CAPEC specifically models session privilege escalation via authentication refresh, so this mapping carries some uncertainty.",
                  "CVSS impact metrics (VC/VI/VA) assume the user\u0027s full role grants broad administrative access to the MISP instance; actual impact depends on the specific role assigned to the user."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-114",
                    "rationale": "The vulnerability arises because the updateLoginTime endpoint incorrectly reconfigures the user\u0027s privilege level during session refresh, upgrading from the API-key-scoped read-only permissions to the user\u0027s full role. The attacker exploits this misconfiguration by simply calling the endpoint. CAPEC-114 is the closest match as it covers scenarios where an application incorrectly assigns or maintains privilege levels. Uncertainty: no CAPEC specifically covers \u0027session privilege escalation via auth refresh,\u0027 so this is the best available approximation."
                  }
                ],
                "commit": "fd27e592a617f21934f4a2c424e0578287affb36",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N - the endpoint is accessible over the network via HTTP POST. AC:L - the attack requires only a single POST request to a known endpoint; no race conditions or complex timing. AT:N - no manipulation of the target system is needed beyond the API call. PR:L - the attacker must possess a valid read-only API key (authenticated user). UI:N - no user interaction is required. VC:H - the escalated user can read all data in the MISP instance that their full role permits. VI:H - the escalated user can create, modify, and delete threat intelligence data. VA:H - the escalated user can delete data, modify configurations, or disrupt the MISP service. SC/SI/SA:N - the impact is confined to the MISP instance itself; no cascading impact on other systems is evidenced.",
                "fixSummary": "The fix removes the call to User::getAuthUser() and Auth::login() from the updateLoginTime() method, which was re-authenticating the user with their full role permissions. It replaces this with a call to _refreshAuth(), which refreshes the authentication state while preserving the current (restricted) permission level associated with the API key, preventing privilege escalation.",
                "generatedAt": "2026-09-21T12:37:21.609779Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "d4143841f5f0d52a14d8538760872a7d91f78ba110384eafa3eedcad8e6480d3",
                "patchSummary": "In app/Controller/UsersController.php, the updateLoginTime() method is modified: the lines that fetched the user record via User::find(), called User::getAuthUser() to retrieve the full auth user, and called Auth::login() to re-establish the session are removed. These are replaced with a single call to $this-\u003e_refreshAuth(), which updates the authentication context without upgrading the permission scope. Net change: 1 insertion, 6 deletions.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "fd27e592a617f21934f4a2c424e0578287affb36",
                    "patchSha256": "d4143841f5f0d52a14d8538760872a7d91f78ba110384eafa3eedcad8e6480d3",
                    "source": "https://github.com/MISP/MISP/commit/fd27e592a.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/fd27e592a.patch",
                    "subject": "fix: [security] read only api keys can regain full role"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/fd27e592a.patch",
                "subject": "fix: [security] read only api keys can regain full role",
                "tagVersionBoundary": {
                  "commits_after_fix": 141,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-269",
                    "rationale": "The system fails to maintain the restricted privilege level (read-only) associated with the API key authentication. The updateLoginTime endpoint re-establishes the session with the user\u0027s full role permissions, effectively granting higher privileges than the authentication credential intended. This is a failure to properly manage and enforce the privilege boundary during session refresh."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20048"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94381",
    "datePublished": "2026-09-21T12:42:53.242Z",
    "dateReserved": "2026-09-21T12:42:51.237Z",
    "dateUpdated": "2026-09-21T14:48:17.524Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94379",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:20:43.610267Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T15:21:01.092Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "UsersController (login endpoint)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/UsersController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "unspecified",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe login() function in MISP\u0027s UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically:\u0026nbsp;\u003c/p\u003e\u2003-\u0026nbsp;the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked\u003cbr\u003e\u2003-\u0026nbsp; the email OTP two-factor authentication step was skipped, defeating the second factor of authentication\u003cbr\u003e\u003cdiv\u003e\u2003- login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cp\u003eThe security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance.\u003cbr\u003e\u003c/p\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "The login() function in MISP\u0027s UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically:\u00a0\n\n\u2003-\u00a0the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked\n\u2003-\u00a0 the email OTP two-factor authentication step was skipped, defeating the second factor of authentication\n\u2003- login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry.\n\n\n\n\nThe security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance.\n\n\n\n\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Improperly Controlled Modification of Authentication Logic"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:35:26.533Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/ef4dc19c6"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix replaces the allowlist-style HTTP method checks (is POST or PUT) with a denylist approach (is NOT GET) in all three security-critical branches of the login() function. This ensures that every non-GET HTTP method\u2014regardless of whether it is POST, PUT, PATCH, DELETE, HEAD, OPTIONS, or any other\u2014triggers the bruteforce protection, email OTP verification, and login-failure logging code paths, closing the method-based bypass.\u003c/p\u003e"
            }
          ],
          "value": "The fix replaces the allowlist-style HTTP method checks (is POST or PUT) with a denylist approach (is NOT GET) in all three security-critical branches of the login() function. This ensures that every non-GET HTTP method\u2014regardless of whether it is POST, PUT, PATCH, DELETE, HEAD, OPTIONS, or any other\u2014triggers the bruteforce protection, email OTP verification, and login-failure logging code paths, closing the method-based bypass."
        }
      ],
      "title": "MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact affected version range is not explicitly stated in the patch; the tag_version_boundary metadata indicates v2.5.47 with 143 commits after the fix, suggesting the fix landed shortly after 2.5.47, but the precise last-affected and first-fixed versions are not confirmed.",
                  "The CAPEC-1 mapping is the closest available pattern; the actual attack vector (HTTP method substitution) is a form of request parameter manipulation that does not have a dedicated CAPEC entry, so CAPEC-1 is used as the best approximation.",
                  "The CVSS vector assumes the MISP instance is exposed over a network and that the login endpoint is reachable without prior authentication, which is the standard deployment model for MISP.",
                  "The patch does not include a test case demonstrating the bypass; the analysis is based solely on the code diff and commit message.",
                  "It is assumed that the MISP framework (CakePHP) does not independently enforce HTTP method restrictions at a middleware layer that would have already blocked non-POST/PUT methods to this endpoint; the patch implies such enforcement was absent."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "The attacker modifies a parameter of the authentication request (the HTTP method) to alter which security checks are executed, effectively modifying the authentication logic at runtime. This is the closest CAPEC to the observed bypass. Uncertainty: CAPEC-1 typically refers to modifying authentication logic in a more direct sense (e.g., altering credential checks), whereas here the modification is via the HTTP method header. However, no other CAPEC more precisely captures the act of altering a request attribute to skip authentication security controls."
                  }
                ],
                "commit": "ef4dc19c6d4f029c3173e5fafea75a94c127f8b5",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N \u2013 the login endpoint is network-accessible. AC:L \u2013 the attack requires only changing the HTTP method in a request; no race conditions or complex setup. AT:N \u2013 no manipulation of the target system is needed. PR:N \u2013 the login endpoint is accessible without prior authentication. UI:N \u2013 no user interaction required. VC:L \u2013 bypass of bruteforce protection enables credential brute-forcing, potentially exposing user credentials. VI:L \u2013 bypass of email OTP (2FA) and failure logging compromises the integrity of the authentication process and audit trail. VA:N \u2013 no direct denial-of-service impact. SC/SI/SA:N \u2013 no secondary system impact is evidenced.",
                "fixSummary": "The fix replaces the allowlist-style HTTP method checks (is POST or PUT) with a denylist approach (is NOT GET) in all three security-critical branches of the login() function. This ensures that every non-GET HTTP method\u2014regardless of whether it is POST, PUT, PATCH, DELETE, HEAD, OPTIONS, or any other\u2014triggers the bruteforce protection, email OTP verification, and login-failure logging code paths, closing the method-based bypass.",
                "generatedAt": "2026-09-21T12:30:02.387878Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "ff6f133b194fcd5c913990fce421bd56de7a12e488291a2ec7422d92284e71d8",
                "patchSummary": "Three conditional expressions in UsersController::login() were changed. (1) The bruteforce-protection guard changed from $this-\u003erequest-\u003eis([\u0027post\u0027,\u0027put\u0027]) to !$this-\u003erequest-\u003eis([\u0027get\u0027]). (2) The email-OTP guard changed from $this-\u003erequest-\u003eis(\u0027post\u0027) to !$this-\u003erequest-\u003eis([\u0027get\u0027]). (3) The login-failure handling guard changed from $this-\u003erequest-\u003eis(\u0027post\u0027) || $this-\u003erequest-\u003eis(\u0027put\u0027) to !$this-\u003erequest-\u003eis(\u0027get\u0027). All three changes invert the logic from an explicit allowlist of methods to a denylist that excludes only GET, so that any other HTTP method is treated as a state-changing login attempt subject to all security controls.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "ef4dc19c6d4f029c3173e5fafea75a94c127f8b5",
                    "patchSha256": "ff6f133b194fcd5c913990fce421bd56de7a12e488291a2ec7422d92284e71d8",
                    "source": "https://github.com/MISP/MISP/commit/ef4dc19c6.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/ef4dc19c6.patch",
                    "subject": "fix: [security] insufficient check on http methods for the"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/ef4dc19c6.patch",
                "subject": "fix: [security] insufficient check on http methods for the",
                "tagVersionBoundary": {
                  "commits_after_fix": 143,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-20",
                    "rationale": "The root cause is that the application validated the HTTP method using an incomplete allowlist (POST, PUT) rather than rejecting all non-safe methods. This is a classic improper input validation flaw where the set of accepted values was not exhaustive, allowing unexpected methods to bypass security logic."
                  },
                  {
                    "cweId": "CWE-285",
                    "rationale": "The security controls (bruteforce protection, OTP enforcement, failure logging) are authorization/authentication enforcement mechanisms that were improperly applied only to a subset of HTTP methods, effectively allowing unauthorized bypass of these controls."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20013"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94379",
    "datePublished": "2026-09-21T12:35:26.533Z",
    "dateReserved": "2026-09-21T12:35:24.635Z",
    "dateUpdated": "2026-09-21T15:21:01.092Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94374",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:21:38.785106Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T15:21:57.870Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Model/Event.php (processModuleResultsData / handleModuleResults)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Event.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module results, the code iterates over EventReport entries supplied in the resolved data and saves each one. Unlike the adjacent attribute and object processing loops, the report loop did not unset the client-supplied \u0027id\u0027 field before calling save(). Because the MISP EventReport model\u0027s create() method does not strip the id field, an authenticated user with permission to submit module results could include an \u0027id\u0027 value referencing an existing report belonging to a different event. Upon save(), the ORM would update that existing row rather than insert a new one, allowing the attacker to\u0026nbsp;\u003c/p\u003e\u2003-\u0026nbsp;read the content of another event\u0027s report by reparenting it into their own event\u003cbr\u003e\u2003-\u0026nbsp;overwrite the report\u0027s fields with attacker-controlled data\u003cbr\u003e\u003cdiv\u003e\u2003-\u0026nbsp;change the report\u0027s event_id to redirect ownership.\u0026nbsp;\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cp\u003eThis constitutes an authorization bypass through a user-controlled key, enabling cross-event data disclosure and integrity compromise. The vulnerability requires an authenticated session with the ability to invoke module result processing on an event.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "MISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module results, the code iterates over EventReport entries supplied in the resolved data and saves each one. Unlike the adjacent attribute and object processing loops, the report loop did not unset the client-supplied \u0027id\u0027 field before calling save(). Because the MISP EventReport model\u0027s create() method does not strip the id field, an authenticated user with permission to submit module results could include an \u0027id\u0027 value referencing an existing report belonging to a different event. Upon save(), the ORM would update that existing row rather than insert a new one, allowing the attacker to\u00a0\n\n\u2003-\u00a0read the content of another event\u0027s report by reparenting it into their own event\n\u2003-\u00a0overwrite the report\u0027s fields with attacker-controlled data\n\u2003-\u00a0change the report\u0027s event_id to redirect ownership.\u00a0\n\n\n\n\nThis constitutes an authorization bypass through a user-controlled key, enabling cross-event data disclosure and integrity compromise. The vulnerability requires an authenticated session with the ability to invoke module result processing on an event.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-472",
              "description": "CWE-472 External Control of Assumed-Immutable Web Parameter",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:25:02.628Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/4c1a03b20"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix adds an unset($report[\u0027id\u0027]) call in the EventReport processing loop within processModuleResultsData, immediately before the event_id assignment and save() call. This ensures that any client-supplied id field is stripped from the report data, forcing the ORM to perform an insert (new report) rather than an update (existing report), consistent with the existing behavior of the attribute and object loops in the same method.\u003c/p\u003e"
            }
          ],
          "value": "The fix adds an unset($report[\u0027id\u0027]) call in the EventReport processing loop within processModuleResultsData, immediately before the event_id assignment and save() call. This ensures that any client-supplied id field is stripped from the report data, forcing the ORM to perform an insert (new report) rather than an update (existing report), consistent with the existing behavior of the attribute and object loops in the same method."
        }
      ],
      "title": "MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events\u0027 Reports",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact affected and fixed MISP version numbers are not stated in the patch metadata; the tag boundary (v2.5.47, 53 commits after fix) suggests the fix landed after v2.5.47 but the precise fixed release is unspecified.",
                  "PR:L assumes that submitting module results is available to any authenticated user with write access to an event; if MISP requires a more restrictive role (e.g., admin or org admin), PR should be raised to H.",
                  "VC:L assumes the attacker can read only the specific report they target by id; if the reparenting exposes additional data (e.g., related attributes), the confidentiality impact could be higher.",
                  "CAPEC-126 (Parameter Tampering) is the closest available CAPEC; the actual technique is more precisely a mass-assignment / IDOR via unsanitized primary key, for which no dedicated CAPEC entry exists.",
                  "The Co-Authored-By line references an AI assistant (Claude Opus 4.8); it is credited as a tool rather than a human remediation developer."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The attacker tampers with the module-results payload by injecting an \u0027id\u0027 parameter that the application does not expect or sanitize, redirecting the save operation to an arbitrary existing report row. This is the closest CAPEC to the observed attack: manipulating a request parameter to alter application behavior and access an unauthorized object. The mapping is approximate because CAPEC-126 typically describes in-transit tampering, whereas here the parameter is included in the initial request body; however, no more specific CAPEC for mass-assignment IDOR exists in the CAPEC catalog."
                  }
                ],
                "commit": "4c1a03b200fc75854879897c9cfc33a86b965d11",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  }
                ],
                "cvssRationale": "AV:N \u2013 MISP is a network-accessible web application. AC:L \u2013 the attack requires only including an \u0027id\u0027 field in a normal module-results submission; no race condition or complex bypass is needed. AT:N \u2013 no prior user interaction or attack preparation beyond crafting the payload. PR:L \u2013 requires an authenticated user with permission to submit module results on an event (a common MISP role). UI:N \u2013 no victim interaction required. VC:L \u2013 the attacker can read the content of one specific report they target by id. VI:H \u2013 the attacker can overwrite all fields of the targeted report and change its event_id, fully compromising its integrity. VA:N \u2013 no availability impact. SC/SI/SA \u2013 no impact on adjacent systems; SI:H reflects the integrity compromise of the shared report data store.",
                "fixSummary": "The fix adds an unset($report[\u0027id\u0027]) call in the EventReport processing loop within processModuleResultsData, immediately before the event_id assignment and save() call. This ensures that any client-supplied id field is stripped from the report data, forcing the ORM to perform an insert (new report) rather than an update (existing report), consistent with the existing behavior of the attribute and object loops in the same method.",
                "generatedAt": "2026-09-21T12:19:38.677403Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "1079aff9d4e4710ba6c4ea950bcbbe2597411bfe7065efbc1bc9a5587f87a6c9",
                "patchSummary": "In app/Model/Event.php, within the foreach loop over $resolved_data[\u0027EventReport\u0027] in processModuleResultsData, a single line unset($report[\u0027id\u0027]); is inserted after $this-\u003eEventReport-\u003ecreate() and before $report[\u0027event_id\u0027] = $id. A four-line comment is added explaining that module-result import only creates reports and that stripping the client id prevents redirecting save() onto another event\u0027s report row. No other files or logic are modified.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "4c1a03b200fc75854879897c9cfc33a86b965d11",
                    "patchSha256": "1079aff9d4e4710ba6c4ea950bcbbe2597411bfe7065efbc1bc9a5587f87a6c9",
                    "source": "https://github.com/MISP/MISP/commit/4c1a03b20.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/4c1a03b20.patch",
                    "subject": "fix: [security] Strip the client id from module-result event"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/4c1a03b20.patch",
                "subject": "fix: [security] Strip the client id from module-result event",
                "tagVersionBoundary": {
                  "commits_after_fix": 53,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-639",
                    "rationale": "The attacker supplies an \u0027id\u0027 value in the module-results payload that the application uses as the primary key for the save() operation, redirecting the write to an object (report row) belonging to a different event. The user-controlled key bypasses the intended create-only semantics and grants unauthorized read/write access to another event\u0027s report."
                  },
                  {
                    "cweId": "CWE-472",
                    "rationale": "The \u0027id\u0027 field is assumed to be server-generated and immutable for new records, but the application accepts a client-supplied value and passes it directly to the ORM save() call, allowing the attacker to control which database row is affected."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20022"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94374",
    "datePublished": "2026-09-21T12:25:02.628Z",
    "dateReserved": "2026-09-21T12:25:00.527Z",
    "dateUpdated": "2026-09-21T15:21:57.870Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94373",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:22:19.064596Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T15:22:31.730Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/webroot/js/contextual_menu.js"
          ],
          "product": "MISP",
          "programFiles": [
            "app/webroot/js/contextual_menu.js"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "David Andre"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML \u0026lt;option\u0026gt; elements by assigning user-controllable values to the innerHTML property. Because innerHTML parses and renders HTML markup, any untrusted string supplied as the option text (value.text or value) is interpreted as live DOM content rather than plain text. An attacker who can influence the data rendered in the contextual menu can inject arbitrary HTML or JavaScript that executes in the victim\u0027s browser within the MISP application origin. This may allow session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML \u003coption\u003e elements by assigning user-controllable values to the innerHTML property. Because innerHTML parses and renders HTML markup, any untrusted string supplied as the option text (value.text or value) is interpreted as live DOM content rather than plain text. An attacker who can influence the data rendered in the contextual menu can inject arbitrary HTML or JavaScript that executes in the victim\u0027s browser within the MISP application origin. This may allow session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-12",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-12 DOM-based XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:16:47.877Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/b062698f2"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe vulnerability is remediated by replacing the unsafe innerHTML property assignments with the safe textContent property when setting the display text of dynamically created \u0026lt;option\u0026gt; elements. textContent inserts the value as plain text without parsing HTML, thereby neutralizing any injected markup or script.\u003c/p\u003e"
            }
          ],
          "value": "The vulnerability is remediated by replacing the unsafe innerHTML property assignments with the safe textContent property when setting the display text of dynamically created \u003coption\u003e elements. textContent inserts the value as plain text without parsing HTML, thereby neutralizing any injected markup or script."
        }
      ],
      "title": "MISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary (v2.5.47 with 137 commits after the fix), suggesting the fix landed shortly after v2.5.47; no explicit affected/fixed version strings are provided in the metadata.",
                  "PR:L assumes the attacker must be an authenticated MISP user to inject data that reaches the contextual menu; if an unauthenticated injection path exists, PR could be N.",
                  "UI:P assumes the victim must actively open or interact with the contextual menu for the XSS to trigger; if the menu renders automatically on page load, UI could be N.",
                  "The CAPEC-12 mapping is high-confidence based on the innerHTML-to-textContent pattern, but the exact data flow (which upstream field feeds value.text) is not visible in the patch.",
                  "AT:N assumes the attacker does not need to target a specific user\u0027s session; if the payload must be tailored to a particular user\u0027s view, AT could be P."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-12",
                    "rationale": "The vulnerability is a textbook DOM-based XSS: attacker-controlled data is written into the DOM via the innerHTML property, causing the browser to parse and execute injected markup/script. CAPEC-12 (DOM-based XSS) is the most precise CAPEC pattern. The mapping is high-confidence because the patch explicitly targets innerHTML-to-textContent in a client-side JS file, which is the defining characteristic of DOM-based XSS."
                  }
                ],
                "commit": "b062698f269996ffe3ceb23de78612d768a3bfe2",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The injection is straightforward once attacker-controlled data reaches the menu options. AT:N: No special targeting of a specific session state is required beyond the data being rendered. PR:L: The attacker must be authenticated to MISP to inject data that will be rendered in the contextual menu. UI:P: The victim must interact with the contextual menu (e.g., open it) for the injected content to execute. VC/VI/VA:N: The MISP server itself is not directly compromised. SC:H/SI:H: The victim\u0027s browser (subsequent component) suffers high confidentiality and integrity impact via script execution in the MISP origin. SA:N: Availability of the browser is not impacted.",
                "draft": false,
                "fixSummary": "The vulnerability is remediated by replacing the unsafe innerHTML property assignments with the safe textContent property when setting the display text of dynamically created \u003coption\u003e elements. textContent inserts the value as plain text without parsing HTML, thereby neutralizing any injected markup or script.",
                "generatedAt": "2026-09-21T12:08:13.810140Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "843bc32d5dc337c115c79558f499550f4659a063b250fca808e32725cd586c9f",
                "patchSummary": "In app/webroot/js/contextual_menu.js, within the ContextualMenu class, two lines that set option.innerHTML (one for object-valued entries using value.text and one for scalar entries using value) are changed to option.textContent. No other logic, event handlers, or surrounding code is modified. The change is limited to the two assignment statements in the option-population loop.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "b062698f269996ffe3ceb23de78612d768a3bfe2",
                    "patchSha256": "843bc32d5dc337c115c79558f499550f4659a063b250fca808e32725cd586c9f",
                    "source": "https://github.com/MISP/MISP/commit/b062698f2.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/b062698f2.patch",
                    "subject": "fix: [xss] via JS innerHTML - as reported by David Andre and"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/b062698f2.patch",
                "subject": "fix: [xss] via JS innerHTML - as reported by David Andre and",
                "tagVersionBoundary": {
                  "commits_after_fix": 137,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "The patch replaces innerHTML with textContent to prevent HTML/JS injection into the DOM, which is the canonical remediation for DOM-based XSS (CWE-79). The specific sub-type is DOM-based XSS via unsafe DOM API usage (innerHTML), but CWE-79 is the narrowest standard identifier that covers this."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20033"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94373",
    "datePublished": "2026-09-21T12:16:47.877Z",
    "dateReserved": "2026-09-21T12:16:44.364Z",
    "dateUpdated": "2026-09-21T15:22:31.730Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94372",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:22:49.873477Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T15:23:04.003Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "Galaxies index (default theme)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/View/Galaxies/index.ctp"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a stored cross-site scripting (XSS) vulnerability in the default theme\u0027s Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the default theme, these sample tag names were inserted into the HTML output without HTML-entity encoding. A user with tag-editor privileges could craft a malicious misp-galaxy tag containing arbitrary script. When a site administrator subsequently viewed the Galaxies index page, the crafted tag content was interpreted as executable markup in the administrator\u0027s browser session, enabling the attacker to read session data, perform actions on behalf of the administrator, or otherwise compromise the administrator\u0027s browser context. The Overmind theme already applied HTML escaping to the same values and was not affected. The vulnerability requires the attacker to possess tag-editor-level access to create the crafted tag and requires the victim (a site administrator) to view the Galaxies index page in the default theme. The impact is limited to the administrator\u0027s browser session and does not directly compromise the MISP server process.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a stored cross-site scripting (XSS) vulnerability in the default theme\u0027s Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the default theme, these sample tag names were inserted into the HTML output without HTML-entity encoding. A user with tag-editor privileges could craft a malicious misp-galaxy tag containing arbitrary script. When a site administrator subsequently viewed the Galaxies index page, the crafted tag content was interpreted as executable markup in the administrator\u0027s browser session, enabling the attacker to read session data, perform actions on behalf of the administrator, or otherwise compromise the administrator\u0027s browser context. The Overmind theme already applied HTML escaping to the same values and was not affected. The vulnerability requires the attacker to possess tag-editor-level access to create the crafted tag and requires the victim (a site administrator) to view the Galaxies index page in the default theme. The impact is limited to the administrator\u0027s browser session and does not directly compromise the MISP server process.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Improper Neutralization of Input"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:02:17.104Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/ce10436ae"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix applies CakePHP\u0027s h() HTML-encoding function to each sample tag name before it is interpolated into the HTML notice. This ensures that any angle brackets, quotes, or ampersands contained in user-supplied tag names are rendered as inert HTML entities, preventing script execution in the administrator\u0027s browser.\u003c/p\u003e"
            }
          ],
          "value": "The fix applies CakePHP\u0027s h() HTML-encoding function to each sample tag name before it is interpolated into the HTML notice. This ensures that any angle brackets, quotes, or ampersands contained in user-supplied tag names are rendered as inert HTML entities, preventing script execution in the administrator\u0027s browser."
        }
      ],
      "title": "Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The tag_version_boundary (v2.5.47, 45 commits after fix) is interpreted as the fix landing after v2.5.47; exact affected version range is not explicitly stated in the patch and is marked as less_than 2.5.47 with status affected, but this is an inference.",
                  "The \u0027tag editor\u0027 role is assumed to be a lower-privilege role than site admin in MISP\u0027s RBAC model, justifying PR:L.",
                  "UI:P (Passive) is used because the victim only needs to load the Galaxies index page; no click or explicit interaction with the malicious content is required. The previous UI:R value was invalid in CVSS v4.0 (valid values: N, P, A).",
                  "CAPEC-1 is the closest available pattern; no CAPEC specifically names stored XSS, so the mapping is approximate.",
                  "The Overmind theme is stated in the commit message as already escaping these values; it is assumed unaffected but no patch evidence for it is provided.",
                  "The Co-Authored-By line for Claude Opus 4.8 is treated as a remediation developer credit per the supplied metadata; it is unclear whether this represents an AI-assisted contribution or a human developer using AI tooling."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "CAPEC-1 is the closest available pattern describing an attacker supplying malicious input that is not properly neutralized before being used in a context where it is interpreted (here, HTML). No dedicated CAPEC for stored XSS exists in the catalog; CAPEC-1 is the narrowest defensible match for an output-encoding failure. Uncertainty: the pattern is broad and does not specifically name XSS, but it is the best available mapping for an input-escaping deficiency."
                  }
                ],
                "commit": "ce10436ae989a4580a35ada1557ff9d9107f43ed",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  }
                ],
                "cvssRationale": "AV:N: exploited over the network via the web UI. AC:L: the attacker simply creates a tag with a script payload; no race or complex condition. AT:N: no attack-target manipulation required. PR:L: the attacker needs tag-editor privileges (lower than admin) to create the crafted misp-galaxy tag. UI:P: the victim (site admin) must passively view the Galaxies index page for the script to execute. VC/VI/VA:N: the MISP application process itself is not directly compromised; the impact is on the victim\u0027s browser session. SC:H: the attacker can read the admin\u0027s session cookies, tokens, and data visible in the browser. SI:H: the attacker can perform authenticated actions as the admin via the compromised session. SA:N: no meaningful availability impact on the scope component.",
                "draft": false,
                "fixSummary": "The fix applies CakePHP\u0027s h() HTML-encoding function to each sample tag name before it is interpolated into the HTML notice. This ensures that any angle brackets, quotes, or ampersands contained in user-supplied tag names are rendered as inert HTML entities, preventing script execution in the administrator\u0027s browser.",
                "generatedAt": "2026-09-21T11:56:43.983892Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 6,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 4
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "c629d71fb493dcf9ae82dd54bd424cd4335e7638f3db46ec4c0ae90695abb535",
                "patchSummary": "In app/View/Galaxies/index.ctp, two lines that built $tagSampleHTML via sprintf and implode over the unknownCustomClustersSamples and unknownDefaultClustersSamples arrays were modified to wrap each array with array_map(\u0027h\u0027, ...) before the implode. This causes every element to pass through CakePHP\u0027s h() helper (HTML entity encoding) prior to concatenation into the \u003cli\u003e list markup. No other logic, routing, or authorization changes were made.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "ce10436ae989a4580a35ada1557ff9d9107f43ed",
                    "patchSha256": "c629d71fb493dcf9ae82dd54bd424cd4335e7638f3db46ec4c0ae90695abb535",
                    "source": "https://github.com/MISP/MISP/commit/ce10436ae.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/ce10436ae.patch",
                    "subject": "fix: [security] Escape unknown-cluster samples in the"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/ce10436ae.patch",
                "subject": "fix: [security] Escape unknown-cluster samples in the",
                "tagVersionBoundary": {
                  "commits_after_fix": 45,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "User-controlled tag names (misp-galaxy tags created by a tag editor) are inserted into an HTML page without output encoding, allowing script injection. This is a classic stored XSS (CWE-79) where the dangerous data is persisted in the database and rendered unsafely in a server-side template."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20002"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94372",
    "datePublished": "2026-09-21T12:02:17.104Z",
    "dateReserved": "2026-09-21T12:02:13.614Z",
    "dateUpdated": "2026-09-21T15:23:04.003Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94277",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T11:15:58.920644Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T11:16:10.434Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/View/Users/statistics_galaxymatrix.ctp"
          ],
          "product": "MISP",
          "programFiles": [
            "app/View/Users/statistics_galaxymatrix.ctp"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP\u0027s galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the perm_galaxy_editor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup. Because the value is interpolated verbatim into the page, any user who subsequently opens the galaxy matrix statistics page will have the embedded script executed in their browser context. This enables session hijacking, credential theft, data exfiltration, or the performance of arbitrary actions on behalf of the victim within the MISP application.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "MISP\u0027s galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the perm_galaxy_editor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup. Because the value is interpolated verbatim into the page, any user who subsequently opens the galaxy matrix statistics page will have the embedded script executed in their browser context. This enables session hijacking, credential theft, data exfiltration, or the performance of arbitrary actions on behalf of the victim within the MISP application.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63 Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T09:25:04.966Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/6b7637bf4"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix applies CakePHP\u0027s h() HTML-encoding function to the $galaxyName variable before it is passed to sprintf() for HTML output, ensuring that any special characters (angle brackets, quotes, etc.) in the galaxy name are percent-encoded and rendered as inert text rather than executable markup.\u003c/p\u003e"
            }
          ],
          "value": "The fix applies CakePHP\u0027s h() HTML-encoding function to the $galaxyName variable before it is passed to sprintf() for HTML output, ensuring that any special characters (angle brackets, quotes, etc.) in the galaxy name are percent-encoded and rendered as inert text rather than executable markup."
        }
      ],
      "title": "Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "perm_galaxy_editor is treated as a low-privilege role (PR:L); if it requires elevated clearance the PR metric should be raised to H.",
                  "The affected version boundary is inferred from the tag v2.5.47 (47 commits after the fix commit); no explicit \u0027fixed in\u0027 version is stated in the patch.",
                  "UI:P assumes the victim voluntarily navigates to the statistics page as part of normal workflow rather than being lured by a crafted link (which would be UI:A)."
                ],
                "commit": "6b7637bf46633e880d8fb9900fa69986eabfc82e",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  }
                ],
                "cvssRationale": "AV:N: The attack is delivered over the network via the MISP web interface. AC:L: Creating a galaxy with a script-bearing name requires no special timing or race condition. AT:N: No additional attack complexity beyond normal application use. PR:L: The attacker needs an authenticated account with perm_galaxy_editor, a low-privilege role. UI:P: The victim must visit the galaxy matrix statistics page, a legitimate page they may open during normal work; no specific tricked action (click, download) is required. VC/VI/VA:N: The MISP server itself suffers no direct confidentiality, integrity, or availability loss; the payload executes client-side. SC:H: The victim\u0027s browser session is fully compromised (cookies, tokens, in-page data). SI:H: The attacker can perform arbitrary actions in the victim\u0027s authenticated session. SA:N: No denial-of-service impact on the victim\u0027s browser. Assumption: perm_galaxy_editor is a low-privilege role (PR:L); if it requires higher clearance, PR could be H.",
                "draft": false,
                "fixSummary": "The fix applies CakePHP\u0027s h() HTML-encoding function to the $galaxyName variable before it is passed to sprintf() for HTML output, ensuring that any special characters (angle brackets, quotes, etc.) in the galaxy name are percent-encoded and rendered as inert text rather than executable markup.",
                "generatedAt": "2026-09-21T08:45:23.903680Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 3,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 8
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "c87b2f367c3cb449d92ad781865f48beeed01298a6c2a91d9f5234e67ab2930d",
                "patchSummary": "In app/View/Users/statistics_galaxymatrix.ctp, the single line echo sprintf(__(\u0027A heatmap showing the usage of %s.\u0027), $galaxyName) was changed to echo sprintf(__(\u0027A heatmap showing the usage of %s.\u0027), h($galaxyName)), wrapping the user-controlled variable with CakePHP\u0027s HTML-encoding helper before interpolation into the HTML document.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "6b7637bf46633e880d8fb9900fa69986eabfc82e",
                    "patchSha256": "c87b2f367c3cb449d92ad781865f48beeed01298a6c2a91d9f5234e67ab2930d",
                    "source": "https://github.com/MISP/MISP/commit/6b7637bf4.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/6b7637bf4.patch",
                    "subject": "fix: [security] Escape the galaxy name in the statistics"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/6b7637bf4.patch",
                "subject": "fix: [security] Escape the galaxy name in the statistics",
                "tagVersionBoundary": {
                  "commits_after_fix": 47,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "The root cause is the direct interpolation of a user-controlled string (galaxy name) into an HTML context without output encoding, allowing script injection. This is a textbook stored XSS (CWE-79)."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20155"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94277",
    "datePublished": "2026-09-21T09:25:04.966Z",
    "dateReserved": "2026-09-21T09:25:02.306Z",
    "dateUpdated": "2026-09-21T11:16:10.434Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93296",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T18:06:22.658218Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T18:06:37.608Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Overmind theme - Events View (event_general.ctp)",
            "Overmind theme - Servers View (preview_general.ctp)"
          ],
          "product": "misp",
          "programFiles": [
            "app/View/Themed/Overmind/Elements/Events/View/event_general.ctp",
            "app/View/Themed/Overmind/Elements/Servers/View/preview_general.ctp"
          ],
          "repo": "https://github.com/MISP/misp",
          "vendor": "misp",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "unspecified",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme\u0027s statistics views. The event General card and the server/feed preview card constructed donut chart legend labels by directly concatenating object name or category keys into an innerHTML string without HTML-encoding. Because MISP object names are user-controllable by any authenticated user with sufficient permissions to create or modify such objects, an attacker could craft a name containing malicious markup. When any other user viewed the affected Overmind dashboard, the injected markup would be interpreted as live HTML/JavaScript in the victim\u0027s browser, executing in the context of the MISP application origin. This could allow session hijacking, data exfiltration, or arbitrary actions performed on behalf of the victim.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThe vulnerability requires the attacker to have low-level authenticated access to create or rename an object whose name is rendered in the legend, and the victim to view the Overmind event or server preview page. No special browser conditions or race conditions are required.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme\u0027s statistics views. The event General card and the server/feed preview card constructed donut chart legend labels by directly concatenating object name or category keys into an innerHTML string without HTML-encoding. Because MISP object names are user-controllable by any authenticated user with sufficient permissions to create or modify such objects, an attacker could craft a name containing malicious markup. When any other user viewed the affected Overmind dashboard, the injected markup would be interpreted as live HTML/JavaScript in the victim\u0027s browser, executing in the context of the MISP application origin. This could allow session hijacking, data exfiltration, or arbitrary actions performed on behalf of the victim.\u00a0\n\nThe vulnerability requires the attacker to have low-level authenticated access to create or rename an object whose name is rendered in the legend, and the victim to view the Overmind event or server preview page. No special browser conditions or race conditions are required."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Cross Site Scripting"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T07:36:53.603Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/misp/commit/382188d2f"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix applies HTML output encoding to the user-controlled label variable (lbl) before it is interpolated into the innerHTML string in both affected view templates. By wrapping the label with escapeHtml(), any HTML metacharacters in object names are neutralized, preventing injected markup from being interpreted as executable HTML or JavaScript in the viewer\u0027s browser.\u003c/p\u003e"
            }
          ],
          "value": "The fix applies HTML output encoding to the user-controlled label variable (lbl) before it is interpolated into the innerHTML string in both affected view templates. By wrapping the label with escapeHtml(), any HTML metacharacters in object names are neutralized, preventing injected markup from being interpreted as executable HTML or JavaScript in the viewer\u0027s browser."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact affected version range is not explicitly stated in the patch; the tag_version_boundary indicates the fix commit is 55 commits after v2.5.47, suggesting versions up to (but not including) the release containing this commit are affected. The precise fixed version is unspecified.",
                  "PR:L assumes the attacker needs at least low-level authenticated access to create or rename a MISP object whose name appears in the Overmind legend. If unauthenticated object creation is possible in some deployment, PR could be N.",
                  "UI:P assumes the victim simply views the Overmind dashboard page (passive interaction). If the page requires a specific navigation action beyond normal browsing, UI could be A.",
                  "SC:H and SI:H assume the XSS grants full access to the victim\u0027s MISP session (cookies, API tokens, in-page data). A more conservative assessment could rate these L if the Overmind view exposes limited data.",
                  "The CAPEC-1 mapping is direct and unambiguous for this stored XSS; no uncertainty is noted beyond the standard CAPEC granularity."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "The attack pattern involves injecting client-side script into a web application via user-controllable data (object names) that is rendered without encoding in an HTML context. CAPEC-1 is the canonical XSS attack pattern and directly matches the mechanism: attacker-controlled data flows into an innerHTML sink. No uncertainty in this mapping; the patch explicitly describes the innerHTML concatenation of unescaped labels."
                  }
                ],
                "commit": "382188d2f27004118592cf32f970313b31abcb52",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  }
                ],
                "cvssRationale": "AV:N: The vulnerability is exploitable over the network via a web browser. AC:L: Exploitation requires only creating an object with a crafted name; no race or special conditions. AT:N: The attack targets the same MISP instance. PR:L: The attacker needs low-level authenticated access to create or rename an MISP object. UI:P: The victim passively interacts by viewing the Overmind dashboard page; no click or explicit action is needed beyond normal page rendering. VC/VI/VA:N: No direct impact on the MISP server\u0027s confidentiality, integrity, or availability. SC:H/SI:H: The injected script executes in the victim\u0027s browser within the MISP origin, enabling full session compromise (cookie theft, data exfiltration, arbitrary actions). SA:N: No availability impact on the victim\u0027s browser.",
                "fixSummary": "The fix applies HTML output encoding to the user-controlled label variable (lbl) before it is interpolated into the innerHTML string in both affected view templates. By wrapping the label with escapeHtml(), any HTML metacharacters in object names are neutralized, preventing injected markup from being interpreted as executable HTML or JavaScript in the viewer\u0027s browser.",
                "generatedAt": "2026-09-17T16:28:27.480704Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "3c6f0376c712f90fde19eba1ca80cd16433ad02587b8237862fd64b60607d8bf",
                "patchSummary": "Two one-line changes in the Overmind theme view templates. In app/View/Themed/Overmind/Elements/Events/View/event_general.ctp (line 607) and app/View/Themed/Overmind/Elements/Servers/View/preview_general.ctp (line 323), the raw lbl variable used in the title attribute and inner text of the legend span element is replaced with escapeHtml(lbl). No other logic, routing, or configuration changes are made.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "382188d2f27004118592cf32f970313b31abcb52",
                    "patchSha256": "3c6f0376c712f90fde19eba1ca80cd16433ad02587b8237862fd64b60607d8bf",
                    "source": "https://github.com/MISP/misp/commit/382188d2f.patch",
                    "sourceUrl": "https://github.com/MISP/misp/commit/382188d2f.patch",
                    "subject": "fix: [security] Escape object names in the Overmind"
                  }
                ],
                "source": "https://github.com/MISP/misp/commit/382188d2f.patch",
                "subject": "fix: [security] Escape object names in the Overmind",
                "tagVersionBoundary": {
                  "commits_after_fix": 55,
                  "repository": "https://github.com/MISP/misp",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "User-controlled object names are concatenated directly into an innerHTML string without HTML encoding, allowing injected markup to execute in the victim\u0027s browser. This is a textbook stored XSS via missing output encoding at an HTML sink."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20206"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-93296",
    "datePublished": "2026-09-17T16:29:19.457Z",
    "dateReserved": "2026-09-17T16:29:16.587Z",
    "dateUpdated": "2026-09-22T07:36:53.603Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93295",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T18:09:12.355251Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T18:09:27.142Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "app/Controller/EventsController.php",
            "app/Lib/Tools/BackgroundJobsTool.php"
          ],
          "product": "misp",
          "repo": "https://github.com/MISP/misp",
          "vendor": "misp",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "\u003c 2.5.47",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Niels Teusink of Eye Security"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP\u0027s ShellDispatcher::_parsePaths() scans the entire argv for path switches (-app, --app, -working, --working, -root, --root, -webroot, --webroot) and uses the following element as the application root. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. An attacker who can submit the contact form can set the person field to a reserved switch and the message field to a phar:// URI pointing to a malicious archive. The CakePHP bootstrap then includes Config/core.php from within that archive, executing attacker-controlled PHP code with the privileges of the web user.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThe vulnerability requires the ability to submit the events/contact form (or any other endpoint that forwards user input into background job arguments). No special timing or race condition is required; the attack is deterministic once the crafted parameters are accepted. The impact is full remote code execution in the context of the MISP web server process, allowing data exfiltration, persistence, and lateral movement within the host.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP\u0027s ShellDispatcher::_parsePaths() scans the entire argv for path switches (-app, --app, -working, --working, -root, --root, -webroot, --webroot) and uses the following element as the application root. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. An attacker who can submit the contact form can set the person field to a reserved switch and the message field to a phar:// URI pointing to a malicious archive. The CakePHP bootstrap then includes Config/core.php from within that archive, executing attacker-controlled PHP code with the privileges of the web user.\u00a0\n\nThe vulnerability requires the ability to submit the events/contact form (or any other endpoint that forwards user input into background job arguments). No special timing or race condition is required; the attack is deterministic once the crafted parameters are accepted. The impact is full remote code execution in the context of the MISP web server process, allowing data exfiltration, persistence, and lateral movement within the host."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-14",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-14 Parameter Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T07:42:13.496Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/misp/commit/120813344"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces a validation layer in BackgroundJobsTool::enqueue() that rejects any job argument matching a reserved CakePHP console path switch (-app, --app, -working, --working, -root, --root, -webroot, --webroot), throwing an InvalidArgumentException before the job is queued. Additionally, the EventsController::contact() method now casts the person field to a boolean, preventing it from ever forming a switch/value pair with the adjacent message field. Together, these changes ensure that user-supplied data can never be interpreted as a console path directive by the worker process.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces a validation layer in BackgroundJobsTool::enqueue() that rejects any job argument matching a reserved CakePHP console path switch (-app, --app, -working, --working, -root, --root, -webroot, --webroot), throwing an InvalidArgumentException before the job is queued. Additionally, the EventsController::contact() method now casts the person field to a boolean, preventing it from ever forming a switch/value pair with the adjacent message field. Together, these changes ensure that user-supplied data can never be interpreted as a console path directive by the worker process."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.47, 43 commits after fix); the exact first fixed release is not explicitly stated in the patch and may differ.",
                  "PR:L assumes the events/contact endpoint requires at least a low-privilege authenticated session; if the endpoint is accessible without authentication in some MISP configurations, PR should be U (Unprivileged).",
                  "The CAPEC-14 mapping is the closest available pattern; the attack is more specifically an argument injection into a framework dispatcher rather than generic parameter manipulation, but no CAPEC entry precisely describes this mechanism.",
                  "The phar:// exploitation path assumes the target PHP process has the phar stream wrapper enabled and that the attacker can place or reference a crafted archive accessible via the phar:// URI; the patch does not explicitly confirm the phar wrapper is enabled by default.",
                  "The commit date (17 Sep 2026) is in the future relative to typical CVE timelines; this is taken at face value from the patch metadata."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-14",
                    "rationale": "The attacker manipulates the person and message parameters of the events/contact form to inject CakePHP console path switches into the background job argv. The parameters are modified so that the downstream console dispatcher interprets them as directives (setting the application root) rather than as data. This is the closest CAPEC pattern; the attack does not involve classic OS command injection (CAPEC-88) but rather argument injection into a framework-level dispatcher, making CAPEC-14 the best available match."
                  }
                ],
                "commit": "120813344f36b8fad15cd917e97b09fa3497156b",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Niels Teusink of Eye Security"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The contact endpoint is reachable over the network via HTTP. AC:L: The attack requires only crafting two form fields with a known switch string and a phar:// path; no race conditions or special timing. AT:N: No specific target configuration or state is required beyond a standard MISP installation. PR:L: The attacker needs a low-privilege authenticated MISP account with access to the event contact action. UI:N: No victim interaction is needed beyond the attacker\u0027s own form submission. VC:H, VI:H, VA:H: Successful exploitation results in arbitrary PHP code execution as the web user, giving full control over the MISP server\u0027s data, processes, and availability. SC:N, SI:N, SA:N: The impact is confined to the MISP server itself; no evidence of lateral impact on other systems.",
                "fixSummary": "The fix introduces a validation layer in BackgroundJobsTool::enqueue() that rejects any job argument matching a reserved CakePHP console path switch (-app, --app, -working, --working, -root, --root, -webroot, --webroot), throwing an InvalidArgumentException before the job is queued. Additionally, the EventsController::contact() method now casts the person field to a boolean, preventing it from ever forming a switch/value pair with the adjacent message field. Together, these changes ensure that user-supplied data can never be interpreted as a console path directive by the worker process.",
                "generatedAt": "2026-09-17T16:22:44.930762Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "8e176aa69e4b6c13f3909225292a96c127076f333a6a49c1824599a79533de77",
                "patchSummary": "Three files are modified. In BackgroundJobsTool.php, a new RESERVED_ARGUMENTS constant lists the eight console path switches, and a new private validateArgs() method iterates over job arguments and throws InvalidArgumentException if any string argument exactly matches a reserved switch. The enqueue() method calls validateArgs() before dispatching. In EventsController.php, the person field assignment in contact() is changed from a raw value to (bool) cast. A new test file BackgroundJobsToolArgumentsTest.php verifies that ordinary arguments pass, free text merely containing a switch substring passes, every reserved switch is refused, and non-string arguments are unaffected.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "120813344f36b8fad15cd917e97b09fa3497156b",
                    "patchSha256": "8e176aa69e4b6c13f3909225292a96c127076f333a6a49c1824599a79533de77",
                    "source": "https://github.com/MISP/misp/commit/120813344.patch",
                    "sourceUrl": "https://github.com/MISP/misp/commit/120813344.patch",
                    "subject": "fix: [security] Refuse console path switches in background"
                  }
                ],
                "source": "https://github.com/MISP/misp/commit/120813344.patch",
                "subject": "fix: [security] Refuse console path switches in background",
                "tagVersionBoundary": {
                  "commits_after_fix": 43,
                  "repository": "https://github.com/MISP/misp",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-74",
                    "rationale": "User-controlled form fields (person, message) are passed as arguments to a downstream component (the CakePHP console dispatcher) where special elements (path switches like -app, -root) are interpreted as directives rather than data. The lack of neutralization of these special elements in the job argument vector is the root cause."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "The background job enqueue path accepted arbitrary string arguments without validating them against the set of values that the downstream console dispatcher interprets as control switches. The fix adds explicit validation to reject reserved argument values."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20153"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-93295",
    "datePublished": "2026-09-17T16:25:40.730Z",
    "dateReserved": "2026-09-17T16:25:37.686Z",
    "dateUpdated": "2026-09-22T07:42:13.496Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92932",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T18:29:40.334689Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T18:30:42.720Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "lib/Cake/Utility/Xml.php"
          ],
          "product": "sachertortephp",
          "programFiles": [
            "lib/Cake/Utility/Xml.php"
          ],
          "repo": "https://github.com/MISP/sachertortephp",
          "vendor": "misp",
          "versions": [
            {
              "lessThan": "1c2da20cbe3f1e2a91458fe9a017823b7273fdac",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "iglocska"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options[\u0027readFile\u0027] \u0026amp;\u0026amp; strpos($input, \u0027http://\u0027) === 0 || strpos($input, \u0027https://\u0027) === 0. Because PHP\u0027s \u0026amp;\u0026amp; operator has higher precedence than ||, the expression is evaluated as ($options[\u0027readFile\u0027] \u0026amp;\u0026amp; strpos($input, \u0027http://\u0027) === 0) || strpos($input, \u0027https://\u0027) === 0. As a result, when a caller explicitly sets the readFile option to false to disable file and URL reading, an input string beginning with https:// still satisfies the condition and triggers a network fetch via HttpSocket (configured to follow up to 10 redirects). The http:// branch is correctly gated by the readFile flag, but the https:// branch is not. An attacker who can influence the $input parameter passed to Xml::build() can therefore force the application to issue an outbound HTTPS request to an attacker-controlled or internal URL, even though the caller intended to suppress all remote reads. The fetched response is parsed as XML and may be returned to the caller, enabling information disclosure from internal services or external targets. This constitutes a Server-Side Request Forgery (SSRF) weakness with an information-disclosure impact. The vulnerability requires that the code path in Xml::build() be reachable with attacker-controlled input and that the readFile option be set to false (or the caller expects it to be false).\u003c/p\u003e"
            }
          ],
          "value": "In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options[\u0027readFile\u0027] \u0026\u0026 strpos($input, \u0027http://\u0027) === 0 || strpos($input, \u0027https://\u0027) === 0. Because PHP\u0027s \u0026\u0026 operator has higher precedence than ||, the expression is evaluated as ($options[\u0027readFile\u0027] \u0026\u0026 strpos($input, \u0027http://\u0027) === 0) || strpos($input, \u0027https://\u0027) === 0. As a result, when a caller explicitly sets the readFile option to false to disable file and URL reading, an input string beginning with https:// still satisfies the condition and triggers a network fetch via HttpSocket (configured to follow up to 10 redirects). The http:// branch is correctly gated by the readFile flag, but the https:// branch is not. An attacker who can influence the $input parameter passed to Xml::build() can therefore force the application to issue an outbound HTTPS request to an attacker-controlled or internal URL, even though the caller intended to suppress all remote reads. The fetched response is parsed as XML and may be returned to the caller, enabling information disclosure from internal services or external targets. This constitutes a Server-Side Request Forgery (SSRF) weakness with an information-disclosure impact. The vulnerability requires that the code path in Xml::build() be reachable with attacker-controlled input and that the readFile option be set to false (or the caller expects it to be false)."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 Server Side Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-670",
              "description": "CWE-670 Always-Incorrect Control Flow Implementation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T12:42:02.501Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix corrects the operator-precedence error by adding parentheses around the scheme check so that both the http:// and https:// branches are gated by the $options[\u0027readFile\u0027] flag. After the fix, when readFile is false, neither scheme triggers a network fetch, restoring the caller\u0027s intended control over remote reads and eliminating the SSRF vector.\u003c/p\u003e"
            }
          ],
          "value": "The fix corrects the operator-precedence error by adding parentheses around the scheme check so that both the http:// and https:// branches are gated by the $options[\u0027readFile\u0027] flag. After the fix, when readFile is false, neither scheme triggers a network fetch, restoring the caller\u0027s intended control over remote reads and eliminating the SSRF vector."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "PR:N is assumed; if the calling application requires authentication to reach Xml::build() with attacker-controlled input, the PR metric should be raised to PR:L or higher.",
                  "The affected version range is unspecified because the patch metadata does not include version tags or release boundaries.",
                  "The CAPEC-66 mapping is the closest available pattern; the exact exploitation context (which MISP endpoint or API exposes Xml::build() input) is not specified in the patch.",
                  "The HttpSocket redirect-following (up to 10 redirects) amplifies the SSRF surface but is not separately scored; it is subsumed under the SC:L impact.",
                  "The vulnerability requires the readFile option to be set to false; if all callers use the default (presumably true), the practical exploitability may be reduced, but the code still contains the logic defect."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-66",
                    "rationale": "The closest CAPEC is SSRF: an attacker supplies a URL (https://...) as input to a server-side function, and the server fetches it over the network. The patch confirms the code path performs an HttpSocket GET with redirect-following. The uncertainty is that the exact attack vector depends on how the calling application exposes Xml::build() input; the CAPEC mapping is based on the confirmed code behavior of fetching a caller-supplied URL."
                  }
                ],
                "commit": "1c2da20cbe3f1e2a91458fe9a017823b7273fdac",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N: the vulnerable function is a library utility reachable through network-facing application code. AC:L: the attacker only needs to supply an input string starting with https://; no race or complex condition is required. AT:N: no need to bypass security controls. PR:N: assumed no authentication is required to reach the code path (assumption; if the calling application requires auth, PR should be raised). UI:N: no user interaction needed. VC/VI/VA:N: the local application\u0027s own confidentiality, integrity, and availability are not directly compromised. SC:L: the attacker can read the HTTP response body from the fetched URL (information disclosure from the SSRF target), which is a limited impact on the target system\u0027s confidentiality. SI/SA:N: no integrity or availability impact on the target. The vector reflects a low-complexity SSRF with limited confidentiality impact on the remote target.",
                "fixSummary": "The fix corrects the operator-precedence error by adding parentheses around the scheme check so that both the http:// and https:// branches are gated by the $options[\u0027readFile\u0027] flag. After the fix, when readFile is false, neither scheme triggers a network fetch, restoring the caller\u0027s intended control over remote reads and eliminating the SSRF vector.",
                "generatedAt": "2026-09-17T12:27:24.482336Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "a5f13eb5fbceae218145d722667feb055f471f151ea64de8acd0257358816af6",
                "patchSummary": "In lib/Cake/Utility/Xml.php, line 110, the condition $options[\u0027readFile\u0027] \u0026\u0026 strpos($input, \u0027http://\u0027) === 0 || strpos($input, \u0027https://\u0027) === 0 is changed to $options[\u0027readFile\u0027] \u0026\u0026 (strpos($input, \u0027http://\u0027) === 0 || strpos($input, \u0027https://\u0027) === 0). A single pair of parentheses is added around the two strpos comparisons so that the || is evaluated before the \u0026\u0026, ensuring the readFile flag gates both URL schemes. One line changed: 1 insertion, 1 deletion.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "1c2da20cbe3f1e2a91458fe9a017823b7273fdac",
                    "patchSha256": "a5f13eb5fbceae218145d722667feb055f471f151ea64de8acd0257358816af6",
                    "source": "https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac.patch",
                    "sourceUrl": "https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac.patch",
                    "subject": "fix: [security] Gate the https branch of Xml::build() on"
                  }
                ],
                "source": "https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac.patch",
                "subject": "fix: [security] Gate the https branch of Xml::build() on",
                "weaknessRationale": [
                  {
                    "cweId": "CWE-918",
                    "rationale": "The primary security impact is that the application issues an outbound HTTPS request to an attacker-influenced URL when the caller intended to disable remote reads. The HttpSocket follows up to 10 redirects, amplifying the SSRF surface. The response is parsed and potentially returned, enabling information disclosure from internal or external targets."
                  },
                  {
                    "cweId": "CWE-670",
                    "rationale": "The root cause is a logic error: the conditional expression does not implement the intended control flow because of PHP operator precedence. The readFile gate is bypassed for the https:// branch, making the guard ineffective for that scheme. This is the underlying defect that produces the SSRF."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20250"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-92932",
    "datePublished": "2026-09-17T12:33:44.852Z",
    "dateReserved": "2026-09-17T12:33:35.124Z",
    "dateUpdated": "2026-09-17T18:30:42.720Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92003",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T12:31:54.934768Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T12:32:06.515Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Controller/AppController.php"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/AppController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAffected versions of MISP do not consistently apply the existing authentication-failure logging throttle.\u003c/p\u003e\n\u003cp\u003eTwo API authentication failure branches wrote directly to the \u003ccode\u003eLog\u003c/code\u003e model:\u003c/p\u003e\u2003- API requests with \u003cstrong\u003eno authentication key\u003c/strong\u003e;\u003cbr\u003e\u003cdiv\u003e\u2003- requests supplying an API key with an \u003cstrong\u003eincorrect length\u003c/strong\u003e\u003c/div\u003e\u003cdiv\u003e\u003cstrong\u003e\u003cbr\u003e\u003c/strong\u003e\u003c/div\u003e\u003cp\u003eUnlike other authentication failures, these paths bypassed \u003ccode\u003e_shouldLog()\u003c/code\u003e, so every request could create another durable \u003ccode\u003eauth_fail\u003c/code\u003e entry.\u003c/p\u003eVersion affected: \u22642.5.45\u003cbr\u003e"
            }
          ],
          "value": "Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle.\n\n\nTwo API authentication failure branches wrote directly to the Log model:\n\n\u2003- API requests with no authentication key;\n\u2003- requests supplying an API key with an incorrect length\n\n\n\n\nUnlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry.\n\nVersion affected: \u22642.5.45"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-125",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-125 Flooding"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T11:43:19.403Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/2bf887433"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix applies the existing hourly per-key log throttle to the two previously unguarded authentication-failure log writes. The throttle key is now derived from the client\u0027s source IP address rather than from caller-supplied input, preventing an attacker from generating unbounded Redis throttle entries. A per-request memo (stored in Configure::read(\u0027CurrentRequestAuthFailKeys\u0027)) is added to _shouldLog() to prevent duplicate log entries when beforeFilter() executes a second time via CakeErrorController on an exception, ensuring one request produces at most one log entry per key regardless of the operator\u0027s log_each_individual_auth_fail setting.\u003c/p\u003e"
            }
          ],
          "value": "The fix applies the existing hourly per-key log throttle to the two previously unguarded authentication-failure log writes. The throttle key is now derived from the client\u0027s source IP address rather than from caller-supplied input, preventing an attacker from generating unbounded Redis throttle entries. A per-request memo (stored in Configure::read(\u0027CurrentRequestAuthFailKeys\u0027)) is added to _shouldLog() to prevent duplicate log entries when beforeFilter() executes a second time via CakeErrorController on an exception, ensuring one request produces at most one log entry per key regardless of the operator\u0027s log_each_individual_auth_fail setting."
        }
      ],
      "title": "MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The tag_version_boundary (v2.5.46, 188 commits after fix) is used as an approximate upper bound for affected versions; the exact fixed release tag is not stated in the patch metadata.",
                  "The log entries are written to a relational database (MySQL/PostgreSQL) via MISP\u0027s Log model, based on the createLogEntry() call pattern; the specific backend is not confirmed in the patch.",
                  "The Redis instance used for throttling is assumed to be co-located with the MISP application; a Redis outage degrades to logging everything (fail-open), which is a design choice documented in the patch comments.",
                  "CVSS VA:H assumes that sustained unthrottled log writes can exhaust storage or I/O capacity sufficient to degrade or halt the MISP service; actual impact depends on deployment sizing and disk capacity."
                ],
                "commit": "2bf8874336518d8c5ef6a42e51e78900ec242630",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "The vulnerable paths are reachable over the network (AV:N) with no authentication (PR:N) and no user interaction (UI:N). The attack complexity is low (AC:L): an attacker simply sends repeated HTTP requests to the MISP API without an API key or with a key of the wrong length. No attack target is required (AT:N). There is no impact on confidentiality (VC:N, SC:N) or integrity (VI:N, SI:N). The availability impact is high (VA:H) because unbounded log writes can exhaust database storage, degrade query performance, and ultimately make the MISP instance unavailable. No secondary availability impact (SA:N) is evident from the patch.",
                "draft": false,
                "fixSummary": "The fix applies the existing hourly per-key log throttle to the two previously unguarded authentication-failure log writes. The throttle key is now derived from the client\u0027s source IP address rather than from caller-supplied input, preventing an attacker from generating unbounded Redis throttle entries. A per-request memo (stored in Configure::read(\u0027CurrentRequestAuthFailKeys\u0027)) is added to _shouldLog() to prevent duplicate log entries when beforeFilter() executes a second time via CakeErrorController on an exception, ensuring one request produces at most one log entry per key regardless of the operator\u0027s log_each_individual_auth_fail setting.",
                "generatedAt": "2026-09-15T11:37:41.625192Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 4,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "db6f78e69079c91d4ba1dac46c4ed5b8ff1ca617c00cd6733bff926c0925a2e3",
                "patchSummary": "In app/Controller/AppController.php: (1) The \u0027no authkey\u0027 branch in beforeFilter() now calls _shouldLog(\u0027noauthkey:\u0027 . $this-\u003eUser-\u003e_remoteIp()) before writing the log entry. (2) The \u0027incorrect length\u0027 branch in __loginByAuthKey() now calls _shouldLog(\u0027badauthkeylength:\u0027 . $this-\u003eUser-\u003e_remoteIp()) before writing the log entry. (3) _shouldLog() is refactored to first check a per-request memo array (Configure \u0027CurrentRequestAuthFailKeys\u0027) to suppress duplicate logging across the double beforeFilter() invocation, then evaluate the log_each_individual_auth_fail setting, then fall through to the Redis EXISTS/SETEX 3600-second throttle, and finally record the key in the memo. The Redis-unavailable fallback (log everything) is preserved.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "2bf8874336518d8c5ef6a42e51e78900ec242630",
                    "patchSha256": "db6f78e69079c91d4ba1dac46c4ed5b8ff1ca617c00cd6733bff926c0925a2e3",
                    "source": "https://github.com/MISP/MISP/commit/2bf887433.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/2bf887433.patch",
                    "subject": "fix: [logging] Throttle the two unguarded auth_fail writes"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/2bf887433.patch",
                "subject": "fix: [logging] Throttle the two unguarded auth_fail writes",
                "tagVersionBoundary": {
                  "commits_after_fix": 188,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-770",
                    "rationale": "Two authentication-failure log write paths lacked any rate-limiting or throttling mechanism, allowing an unauthenticated remote attacker to generate an unbounded number of database log entries and exhaust storage or I/O resources. The fix adds the missing hourly per-key throttle."
                  },
                  {
                    "cweId": "CWE-400",
                    "rationale": "The unthrottled log writes constitute uncontrolled consumption of database write capacity and disk storage, enabling a denial-of-service condition. CWE-770 is the more specific primary weakness; CWE-400 captures the broader resource-exhaustion impact."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20158"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-92003",
    "datePublished": "2026-09-15T11:43:19.403Z",
    "dateReserved": "2026-09-15T11:43:17.522Z",
    "dateUpdated": "2026-09-15T12:32:06.515Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92002",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T12:00:12.607042Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T12:09:48.540Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Controller/AppController.php"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/AppController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity.\u003c/p\u003e\n\u003cp\u003eHowever, \u003ccode\u003eUser-\u0026gt;setupRedis()\u003c/code\u003e returns false when Redis cannot be reached. The vulnerable \u003ccode\u003e_shouldLog()\u003c/code\u003e logic only returned true when a Redis instance existed and no throttle key was present. Therefore, when Redis was unavailable, the function did not allow the log write at all, effectively silencing authentication-failure logging for the duration of the outage.\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity.\n\n\nHowever, User-\u003esetupRedis() returns false when Redis cannot be reached. The vulnerable _shouldLog() logic only returned true when a Redis instance existed and no throttle key was present. Therefore, when Redis was unavailable, the function did not allow the log write at all, effectively silencing authentication-failure logging for the duration of the outage.\n\nVersion affected: \u22642.5.45"
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-778",
              "description": "CWE-778 Insufficient Logging",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T11:24:21.354Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/a39b25d2f"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe _shouldLog() method now explicitly checks whether the Redis connection is available before attempting to use it. If setupRedis() returns false, the method immediately returns true, causing every authentication-failure event to be logged. This converts the previous fail-closed behavior (silence on dependency failure) into a fail-open behavior for security logging (log everything when the throttle state is unavailable), ensuring that a Redis outage cannot be used to suppress the audit trail of failed authentication attempts.\u003c/p\u003e"
            }
          ],
          "value": "The _shouldLog() method now explicitly checks whether the Redis connection is available before attempting to use it. If setupRedis() returns false, the method immediately returns true, causing every authentication-failure event to be logged. This converts the previous fail-closed behavior (silence on dependency failure) into a fail-open behavior for security logging (log everything when the throttle state is unavailable), ensuring that a Redis outage cannot be used to suppress the audit trail of failed authentication attempts."
        }
      ],
      "title": "MISP: Authentication failure logging suppressed during Redis unavailability",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary metadata (v2.5.46 with 189 commits after the fix), suggesting the fix landed before the v2.5.46 release; exact affected version boundaries are not explicitly stated in the patch.",
                  "The CVSS availability impact (VA:L) reflects the loss of the security-logging function rather than a denial of service against the MISP application itself.",
                  "The patch does not indicate whether the Redis throttle was the sole mechanism for auth-failure logging or whether a fallback file-based logger existed; the analysis assumes the Redis-gated path was the primary logging path for auth failures.",
                  "The commit date (2 Sep 2026) is taken at face value from the patch metadata."
                ],
                "commit": "a39b25d2f141dde954a2f00feed5c6eb9e3989b5",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "The vulnerability is reachable over the network (AV:N) because MISP is a web application. Attack complexity is High (AC:H) because exploitation requires the Redis instance to be specifically unavailable at the time authentication failures occur; it is not a simple request. No attack target is required (AT:N). No privileges are needed (PR:N) because the suppressed logs pertain to unauthenticated authentication-failure events. No user interaction is required (UI:N). There is no direct confidentiality or integrity impact on the MISP data store (VC:N, VI:N). The availability impact is Low (VA:L) because the security-logging/audit function is unavailable during the Redis outage, impairing detection and forensic capabilities, but the core MISP service remains operational. No cross-scope impacts (SC:N, SI:N, SA:N).",
                "draft": false,
                "fixSummary": "The _shouldLog() method now explicitly checks whether the Redis connection is available before attempting to use it. If setupRedis() returns false, the method immediately returns true, causing every authentication-failure event to be logged. This converts the previous fail-closed behavior (silence on dependency failure) into a fail-open behavior for security logging (log everything when the throttle state is unavailable), ensuring that a Redis outage cannot be used to suppress the audit trail of failed authentication attempts.",
                "generatedAt": "2026-09-15T09:34:28.852379Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 4,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "ab1b5a5a68cf32cfb514f541d5db607932836ebf557634a44adfa822631afe9c",
                "patchSummary": "In app/Controller/AppController.php, the _shouldLog() method was restructured: a new early-return guard \"if (!$redis) { return true; }\" was inserted immediately after the setupRedis() call, so that an unavailable Redis connection causes all auth-failure events to be logged. The subsequent throttle check was simplified to \"if (!$redis-\u003eexists(...))\" since the null case is already handled. Additionally, a block of commented-out Redis throttle code in the afterFilter() method (lines referencing misp:auth_fail_throttling) was removed as dead code.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "a39b25d2f141dde954a2f00feed5c6eb9e3989b5",
                    "patchSha256": "ab1b5a5a68cf32cfb514f541d5db607932836ebf557634a44adfa822631afe9c",
                    "source": "https://github.com/MISP/MISP/commit/a39b25d2f.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/a39b25d2f.patch",
                    "subject": "fix: [logging] Log auth failures when the throttle cannot"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/a39b25d2f.patch",
                "subject": "fix: [logging] Log auth failures when the throttle cannot",
                "tagVersionBoundary": {
                  "commits_after_fix": 189,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-778",
                    "rationale": "The system fails to record security-relevant events (authentication failures) when a supporting dependency (Redis) is unavailable. The logging path silently drops all audit entries under a specific operational condition, which is a textbook case of insufficient logging of security events."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20172"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-92002",
    "datePublished": "2026-09-15T11:24:21.354Z",
    "dateReserved": "2026-09-15T11:24:19.778Z",
    "dateUpdated": "2026-09-15T12:09:48.540Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91859",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T13:04:57.329720Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T13:05:17.132Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Model/AccessLog.php"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/AccessLog.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP can record incorrect access-log data for requests that terminate in an exception.\u003c/p\u003e\n\u003cp\u003eBecause \u003ccode\u003eCakeErrorController\u003c/code\u003e extends \u003ccode\u003eAppController\u003c/code\u003e, exception rendering runs the application startup path a second time. As a result, \u003ccode\u003e__accessMonitor()\u003c/code\u003e calls \u003ccode\u003eAccessLog::logRequest()\u003c/code\u003e twice for one HTTP request. The second deferred writer measures the error-controller execution instead of the original request and can overwrite the row created by the first pass. The corrupted fields include request duration, SQL query count, memory usage, and potentially the recorded query log.\u003c/p\u003e\n\u003cp\u003eThe bug was masked because the same model instance retained the ID of the first saved row, causing the later save to issue an \u003ccode\u003eUPDATE\u003c/code\u003e rather than insert an obvious duplicate row.\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception.\n\n\nBecause CakeErrorController extends AppController, exception rendering runs the application startup path a second time. As a result, __accessMonitor() calls AccessLog::logRequest() twice for one HTTP request. The second deferred writer measures the error-controller execution instead of the original request and can overwrite the row created by the first pass. The corrupted fields include request duration, SQL query count, memory usage, and potentially the recorded query log.\n\n\nThe bug was masked because the same model instance retained the ID of the first saved row, causing the later save to issue an UPDATE rather than insert an obvious duplicate row.\n\nVersion affected: \u22642.5.45"
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-778",
              "description": "CWE-778 Insufficient Logging",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-223",
              "description": "CWE-223 Omission of Security-relevant Information in Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T09:26:35.198Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/0dae5c072"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces a per-instance boolean guard ($deferredWriterRegistered) in the AccessLog model so that logRequest() returns early on the second beforeFilter pass, preventing the error controller from overwriting the original request\u0027s log entry. Additionally, a $this-\u0026gt;create() call is added before $this-\u0026gt;save() in saveOnShutdown() to ensure each save issues an INSERT rather than an UPDATE, providing defense-in-depth against accidental row mutation.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces a per-instance boolean guard ($deferredWriterRegistered) in the AccessLog model so that logRequest() returns early on the second beforeFilter pass, preventing the error controller from overwriting the original request\u0027s log entry. Additionally, a $this-\u003ecreate() call is added before $this-\u003esave() in saveOnShutdown() to ensure each save issues an INSERT rather than an UPDATE, providing defense-in-depth against accidental row mutation."
        }
      ],
      "title": "MISP Access Log Entry Overwritten by Error Controller\u0027s Second beforeFilter Pass",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "MISP requires authentication for the operations that produce access-log entries; PR:L assumes a low-privilege authenticated user can trigger an unhandled exception.",
                  "The affected version range is inferred from the tag_version_boundary (v2.5.46, 190 commits after fix); the exact first-affected and last-affected versions are not stated in the patch metadata.",
                  "The security impact is limited to log-integrity degradation; no direct data exfiltration, privilege escalation, or denial-of-service is evidenced by the patch.",
                  "The double beforeFilter invocation is a CakePHP framework behavior (ExceptionRenderer::_getController calling startupProcess on CakeErrorController) and is not itself a MISP vulnerability, but MISP\u0027s AccessLog model did not guard against it."
                ],
                "commit": "0dae5c072d86e62140c385cf507135f196415fa6",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "The vulnerability is exploitable over the network (AV:N) with low complexity (AC:L) by any authenticated user who can trigger an unhandled exception (e.g., via a malformed request). No attack target manipulation is required (AT:N). Low privileges are sufficient (PR:L) as any authenticated MISP user can cause an error. No user interaction is needed (UI:N). There is no direct confidentiality or availability impact on MISP itself (VC:N, VA:N). The integrity impact is low (VI:L) because the access-log row is overwritten with incorrect metrics rather than deleted, and only requests that trigger exceptions are affected. No secondary impacts are identified (SC:N, SI:N, SA:N). The overall severity is low, reflecting a logging-integrity weakness that degrades audit reliability but does not directly expose data or disrupt service.",
                "draft": false,
                "fixSummary": "The fix introduces a per-instance boolean guard ($deferredWriterRegistered) in the AccessLog model so that logRequest() returns early on the second beforeFilter pass, preventing the error controller from overwriting the original request\u0027s log entry. Additionally, a $this-\u003ecreate() call is added before $this-\u003esave() in saveOnShutdown() to ensure each save issues an INSERT rather than an UPDATE, providing defense-in-depth against accidental row mutation.",
                "generatedAt": "2026-09-15T09:22:08.485154Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 4,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "4eeecd38b5b824e3c5c1ae20886e62534ebed473410f59bea7276f83b32d4051",
                "patchSummary": "In app/Model/AccessLog.php: (1) Added a private $deferredWriterRegistered property (default false). (2) At the top of logRequest(), added an early-return guard: if $this-\u003edeferredWriterRegistered is true, return true immediately. (3) Set $this-\u003edeferredWriterRegistered = true immediately before register_shutdown_function() so the flag is latched on the first pass. (4) In saveOnShutdown(), added $this-\u003ecreate() before $this-\u003esave() to force a new-row INSERT and prevent the model from issuing an UPDATE against a previously saved id. (5) Added explanatory doc-comments describing the double-beforeFilter mechanism and the ClassRegistry single-instance behavior.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "0dae5c072d86e62140c385cf507135f196415fa6",
                    "patchSha256": "4eeecd38b5b824e3c5c1ae20886e62534ebed473410f59bea7276f83b32d4051",
                    "source": "https://github.com/MISP/MISP/commit/0dae5c072.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/0dae5c072.patch",
                    "subject": "fix: [logging] Stop the error controller overwriting the"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/0dae5c072.patch",
                "subject": "fix: [logging] Stop the error controller overwriting the",
                "tagVersionBoundary": {
                  "commits_after_fix": 190,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-778",
                    "rationale": "The access-log mechanism fails to preserve accurate, immutable records of each request. The second beforeFilter pass overwrites the first pass\u0027s data, so the log does not faithfully reflect the actual request\u0027s duration, query count, memory usage, or SQL activity. This constitutes insufficient logging because the security-relevant audit data is corrupted rather than simply missing."
                  },
                  {
                    "cweId": "CWE-223",
                    "rationale": "The genuine request metrics (duration, query count, memory, query log) are replaced by the error controller\u0027s metrics, effectively omitting the security-relevant information that the original request produced. This is a secondary mapping; CWE-778 is the primary weakness."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20138"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-91859",
    "datePublished": "2026-09-15T09:26:35.198Z",
    "dateReserved": "2026-09-15T09:26:32.260Z",
    "dateUpdated": "2026-09-15T13:05:17.132Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91857",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T13:10:25.729586Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T13:19:25.134Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "EventReportsController",
            "NoticelistsController",
            "ServersController",
            "WorkflowsController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/EventReportsController.php",
            "app/Controller/NoticelistsController.php",
            "app/Controller/ServersController.php",
            "app/Controller/WorkflowsController.php",
            "app/View/EventReports/managed_imported_pictures.ctp"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP expose several state-changing controller actions without restricting them to POST.\u003c/p\u003e\n\u003cp\u003eThe affected actions are:\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003ccode\u003e\u2003-\u0026nbsp;EventReportsController::purgeUnusedPictures()\u003c/code\u003e\n\u003cbr\u003e\u003ccode\u003e\u2003-\u0026nbsp;NoticelistsController::enableNoticelist()\u003c/code\u003e\n\u003cbr\u003e\u003ccode\u003e\u2003-\u0026nbsp;ServersController::removeOrphanedCorrelations()\u003c/code\u003e\n\u003cbr\u003e\u003cdiv\u003e\u003ccode\u003e\u2003- WorkflowsController::rebuildRedis()\u003c/code\u003e\u003c/div\u003e\u003cdiv\u003e\u003ccode\u003e\u003cbr\u003e\u003c/code\u003e\u003c/div\u003e\u003cp\u003e\u003ccode\u003e\u003c/code\u003e\u003c/p\u003e\u003cp\u003eThe patch adds \u003ccode\u003eallowMethod([\u0027post\u0027])\u003c/code\u003e to each action, preventing them from being triggered through ordinary GET requests.\u003c/p\u003e\n\u003cp\u003eFor \u003ccode\u003epurgeUnusedPictures()\u003c/code\u003e, the corresponding UI previously used \u003ccode\u003e$.get()\u003c/code\u003e. The fix converts that request to POST and supplies \u003ccode\u003eX-CSRF-Token\u003c/code\u003e, while the controller enables header-only CSRF validation for that AJAX action.\u003c/p\u003e\n\u003cp\u003eBecause GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim\u0027s session.\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP expose several state-changing controller actions without restricting them to POST.\n\n\nThe affected actions are:\n\n\n\n\u2003-\u00a0EventReportsController::purgeUnusedPictures()\n\n\u2003-\u00a0NoticelistsController::enableNoticelist()\n\n\u2003-\u00a0ServersController::removeOrphanedCorrelations()\n\n\u2003- WorkflowsController::rebuildRedis()\n\n\n\n\n\n\nThe patch adds allowMethod([\u0027post\u0027]) to each action, preventing them from being triggered through ordinary GET requests.\n\n\nFor purgeUnusedPictures(), the corresponding UI previously used $.get(). The fix converts that request to POST and supplies X-CSRF-Token, while the controller enables header-only CSRF validation for that AJAX action.\n\n\nBecause GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim\u0027s session.\n\nVersion affected: \u22642.5.45"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T09:14:43.722Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/b4a5486b5"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe vulnerability is remediated by restricting all four state-changing actions to accept only POST requests via the CakePHP allowMethod() guard. Additionally, the client-side JavaScript for purgeUnusedPictures is updated to issue a POST request with the page\u0027s CSRF token in the X-CSRF-Token header, and a beforeFilter() hook is added to EventReportsController to configure header-only CSRF token validation for that specific action, since it is invoked via hand-built AJAX rather than a rendered form.\u003c/p\u003e"
            }
          ],
          "value": "The vulnerability is remediated by restricting all four state-changing actions to accept only POST requests via the CakePHP allowMethod() guard. Additionally, the client-side JavaScript for purgeUnusedPictures is updated to issue a POST request with the page\u0027s CSRF token in the X-CSRF-Token header, and a beforeFilter() hook is added to EventReportsController to configure header-only CSRF token validation for that specific action, since it is invoked via hand-built AJAX rather than a rendered form."
        }
      ],
      "title": "MISP: State-changing actions accessible via GET request enabling CSRF",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The fix commit is 196 commits before the v2.5.46 tag, implying the vulnerability existed in versions prior to v2.5.46; exact affected version range is not explicitly stated in the patch.",
                  "MISP requires user authentication to access the affected endpoints; the PR:L assumption is based on MISP\u0027s standard authentication model.",
                  "The CSRF token mechanism in CakePHP (the framework used by MISP) is assumed to protect POST requests but not GET requests, consistent with the patch\u0027s own comments.",
                  "The vulnerability was found during internal review and was not externally reported, per the commit message."
                ],
                "commit": "b4a5486b5ddd078dc11248cbd7f21725fb1f43cf",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The attack is delivered over the network (e.g., a malicious link or page). AC:L: No special race conditions or complex setup are required; a simple GET URL suffices. AT:N: No prior compromise or manipulation of the target system is needed. PR:L: The attacker requires the victim to be an authenticated MISP user; the attacker themselves need not be authenticated. UI:A: The victim must actively interact (click a link or navigate to a crafted page) to trigger the forged request. VC:N: No confidential data is exposed by the affected actions. VI:L: Integrity impact is low; the actions cause limited state changes (deleting unused pictures, toggling a noticelist, removing orphaned correlations, rebuilding a cache) rather than corrupting critical data. VA:N: No meaningful availability impact; the actions do not cause denial of service. SC/SI/SA:N: No impact on subsequent systems.",
                "draft": false,
                "fixSummary": "The vulnerability is remediated by restricting all four state-changing actions to accept only POST requests via the CakePHP allowMethod() guard. Additionally, the client-side JavaScript for purgeUnusedPictures is updated to issue a POST request with the page\u0027s CSRF token in the X-CSRF-Token header, and a beforeFilter() hook is added to EventReportsController to configure header-only CSRF token validation for that specific action, since it is invoked via hand-built AJAX rather than a rendered form.",
                "generatedAt": "2026-09-15T09:10:36.581856Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 4,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "adc31514b96a99a411ca1ed5a31abf99642d19de3a09f536e62310b298d2552b",
                "patchSummary": "Adds $this-\u003erequest-\u003eallowMethod([\u0027post\u0027]) to purgeUnusedPictures, enableNoticelist, removeOrphanedCorrelations, and rebuildRedis. Adds a beforeFilter() method to EventReportsController calling _csrfTokenHeaderOnly([\u0027purgeUnusedPictures\u0027]) to permit CSRF token validation via the X-CSRF-Token header. Updates the managed_imported_pictures.ctp view to replace $.get() with $.ajax() using type \u0027post\u0027 and the X-CSRF-Token header. Adds REST response handling and flash/redirect logic to rebuildRedis for consistency with other actions.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "b4a5486b5ddd078dc11248cbd7f21725fb1f43cf",
                    "patchSha256": "adc31514b96a99a411ca1ed5a31abf99642d19de3a09f536e62310b298d2552b",
                    "source": "https://github.com/MISP/MISP/commit/b4a5486b5.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/b4a5486b5.patch",
                    "subject": "fix: [security] Require POST for four remaining"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/b4a5486b5.patch",
                "subject": "fix: [security] Require POST for four remaining",
                "tagVersionBoundary": {
                  "commits_after_fix": 196,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-352",
                    "rationale": "The root cause is that state-changing endpoints accept GET requests, which are not protected by the framework\u0027s CSRF token mechanism. This allows an attacker to forge requests on behalf of an authenticated user via links, auto-loading resources, or other passive/active user interactions, which is the defining characteristic of CSRF."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20242"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-91857",
    "datePublished": "2026-09-15T09:14:43.722Z",
    "dateReserved": "2026-09-15T09:14:39.778Z",
    "dateUpdated": "2026-09-15T13:19:25.134Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91851",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T13:29:22.086413Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T13:29:55.108Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "DashboardsController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/DashboardsController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eDashboardsController::listTemplates()\u003c/code\u003e allowed a template when either:\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e\u2003-\u0026nbsp;its \u003ccode\u003erestrict_to_permission_flag\u003c/code\u003e matched one of the current user\u2019s permission flags, or\u003c/div\u003e\u003cdiv\u003e\u2003-\u0026nbsp;\u003ccode\u003erestrict_to_permission_flag\u003c/code\u003e equaled integer \u003ccode\u003e0\u003c/code\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003ccode\u003e\u003c/code\u003e\u003c/div\u003e\u003cp\u003e\u003ccode\u003e\u003c/code\u003e\u003c/p\u003e\u003cp\u003eHowever, \u003ccode\u003erestrict_to_permission_flag\u003c/code\u003e is a \u003ccode\u003evarchar\u003c/code\u003e. MySQL therefore performed numeric coercion when comparing the column against integer \u003ccode\u003e0\u003c/code\u003e. Strings such as \u003ccode\u003eperm_site_admin\u003c/code\u003e convert numerically to zero, making expressions such as \u003ccode\u003eperm_site_admin = 0\u003c/code\u003e evaluate true and causing the \u201cunrestricted\u201d branch to match permission-restricted templates as well.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag.\n\n\nDashboardsController::listTemplates() allowed a template when either:\n\n\n\n\u2003-\u00a0its restrict_to_permission_flag matched one of the current user\u2019s permission flags, or\n\n\u2003-\u00a0restrict_to_permission_flag equaled integer 0\n\n\n\n\n\n\nHowever, restrict_to_permission_flag is a varchar. MySQL therefore performed numeric coercion when comparing the column against integer 0. Strings such as perm_site_admin convert numerically to zero, making expressions such as perm_site_admin = 0 evaluate true and causing the \u201cunrestricted\u201d branch to match permission-restricted templates as well.\n\n\n\nVersion affected: \u22642.5.45"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-697",
              "description": "CWE-697 Incorrect Comparison",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T08:50:01.513Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/245b8d63a"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix corrects the type mismatch in the permission flag comparison by replacing the integer literal 0 with the explicit string values \u0027\u0027 and \u00270\u0027, which are the actual database values representing an unrestricted dashboard template. This ensures MySQL performs a proper string-to-string comparison, so only rows genuinely marked as unrestricted are returned, restoring the intended per-permission-level access control on dashboard templates.\u003c/p\u003e"
            }
          ],
          "value": "The fix corrects the type mismatch in the permission flag comparison by replacing the integer literal 0 with the explicit string values \u0027\u0027 and \u00270\u0027, which are the actual database values representing an unrestricted dashboard template. This ensures MySQL performs a proper string-to-string comparison, so only rows genuinely marked as unrestricted are returned, restoring the intended per-permission-level access control on dashboard templates."
        }
      ],
      "title": "MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary (v2.5.46 with 200 commits after fix); no explicit affected or fixed version is stated in the patch metadata.",
                  "The vulnerability requires an authenticated MISP user with any role; the exact minimum privilege level needed to access the listTemplates endpoint is not specified in the patch.",
                  "The impact is assessed as Low confidentiality because the disclosed data is dashboard template definitions (layout, widget configuration) rather than raw threat intelligence or user credentials.",
                  "The MySQL type-coercion behavior described in the commit message and code comments is assumed to be accurate for the MySQL versions supported by MISP."
                ],
                "commit": "245b8d63a3794d048fb88275512fa0d32981f0b8",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "The vulnerability is exploitable over the network (AV:N) via the MISP web interface with low attack complexity (AC:L) and no attack target manipulation (AT:N). It requires a low-privilege authenticated user (PR:L) and no user interaction (UI:N). The impact is limited to confidentiality (VC:L) as restricted dashboard template definitions are disclosed to unauthorized users; there is no integrity or availability impact (VI:N, VA:N) and no secondary effects (SC:N, SI:N, SA:N). The severity is moderate because the disclosed data is dashboard template metadata rather than raw threat intelligence, but it still represents a breach of the intended access control boundary.",
                "draft": false,
                "fixSummary": "The fix corrects the type mismatch in the permission flag comparison by replacing the integer literal 0 with the explicit string values \u0027\u0027 and \u00270\u0027, which are the actual database values representing an unrestricted dashboard template. This ensures MySQL performs a proper string-to-string comparison, so only rows genuinely marked as unrestricted are returned, restoring the intended per-permission-level access control on dashboard templates.",
                "generatedAt": "2026-09-15T08:40:44.690048Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 4,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "ac03cd1103d5fb0998c2406836df41d3449e5a5d6a0a5d2ffc77685eba48e188",
                "patchSummary": "In app/Controller/DashboardsController.php, the listTemplates() method\u0027s query condition was changed from [\u0027Dashboard.restrict_to_permission_flag\u0027 =\u003e 0] to [\u0027Dashboard.restrict_to_permission_flag\u0027 =\u003e [\u0027\u0027, \u00270\u0027]]. A multi-line comment was added explaining that restrict_to_permission_flag is a VARCHAR column and that comparing it to integer 0 causes MySQL to coerce the column, making the clause a no-op. The two values that actually represent unrestricted access are the empty string (column default) and the string \u00270\u0027 (posted by the save form).",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "245b8d63a3794d048fb88275512fa0d32981f0b8",
                    "patchSha256": "ac03cd1103d5fb0998c2406836df41d3449e5a5d6a0a5d2ffc77685eba48e188",
                    "source": "https://github.com/MISP/MISP/commit/245b8d63a.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/245b8d63a.patch",
                    "subject": "fix: [acl] Compare the dashboard template permission flag as"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/245b8d63a.patch",
                "subject": "fix: [acl] Compare the dashboard template permission flag as",
                "tagVersionBoundary": {
                  "commits_after_fix": 200,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-863",
                    "rationale": "The permission-based filter on dashboard templates was effectively bypassed because the type-coerced comparison matched all rows, allowing any authenticated user to access templates restricted to higher-privilege roles. The authorization check was present in code but did not function correctly."
                  },
                  {
                    "cweId": "CWE-697",
                    "rationale": "The root cause is a comparison between a VARCHAR column and an integer literal. MySQL\u0027s implicit type coercion caused the comparison to evaluate to TRUE for all non-numeric string values, making the intended filter a no-op. This is a classic incorrect comparison due to type mismatch."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20010"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-91851",
    "datePublished": "2026-09-15T08:50:01.513Z",
    "dateReserved": "2026-09-15T08:49:59.734Z",
    "dateUpdated": "2026-09-15T13:29:55.108Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91846",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T13:41:15.313807Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T13:50:14.847Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "CollectionElementsController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/CollectionElementsController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object.\u003c/p\u003e\n\u003cp\u003eThe commit explains that collection elements themselves only store UUIDs, while the collection view later resolves those UUIDs into their underlying objects. Before this fix, the generic \u003ccode\u003eadd()\u003c/code\u003e path could therefore persist a UUID for an Event or Galaxy Cluster that the caller could not normally read. The patch explicitly notes that this made collections a way to reference another organisation\u2019s private data and had caused disclosure of organisation-only events in the beta collection view.\u003c/p\u003e\n\u003cp\u003eThe fix centralizes authorization in \u003ccode\u003e__assertCanUseElements()\u003c/code\u003e. Event UUIDs are validated through \u003ccode\u003eEvent::fetchSimpleEvent()\u003c/code\u003e under the current user\u2019s ACL, while Galaxy Cluster UUIDs are checked through \u003ccode\u003eGalaxyCluster::fetchGalaxyClusters()\u003c/code\u003e. The check is applied both to the CRUD \u003ccode\u003eadd()\u003c/code\u003e path and to \u003ccode\u003eaddElementToCollection()\u003c/code\u003e.\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object.\n\n\nThe commit explains that collection elements themselves only store UUIDs, while the collection view later resolves those UUIDs into their underlying objects. Before this fix, the generic add() path could therefore persist a UUID for an Event or Galaxy Cluster that the caller could not normally read. The patch explicitly notes that this made collections a way to reference another organisation\u2019s private data and had caused disclosure of organisation-only events in the beta collection view.\n\n\nThe fix centralizes authorization in __assertCanUseElements(). Event UUIDs are validated through Event::fetchSimpleEvent() under the current user\u2019s ACL, while Galaxy Cluster UUIDs are checked through GalaxyCluster::fetchGalaxyClusters(). The check is applied both to the CRUD add() path and to addElementToCollection().\n\nVersion affected: \u22642.5.45"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T08:36:22.825Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/334d53709"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces a dedicated __assertCanUseElements() authorization guard that is invoked in the beforeSave callback of the add() CRUD path (covering both form and REST submission) and in addElementToCollection(). For each element UUID, the method resolves the element type (deducing it if the caller omitted the field, preventing bypass by omission) and performs an ACL-aware lookup: for Events it calls fetchSimpleEvent() scoped to the current user, and for GalaxyClusters it calls fetchGalaxyClusters() with the user context. If the object does not exist or the caller lacks access, a NotFoundException is raised and the save is aborted. This ensures that no collection element can reference an object the caller is not authorized to read.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces a dedicated __assertCanUseElements() authorization guard that is invoked in the beforeSave callback of the add() CRUD path (covering both form and REST submission) and in addElementToCollection(). For each element UUID, the method resolves the element type (deducing it if the caller omitted the field, preventing bypass by omission) and performs an ACL-aware lookup: for Events it calls fetchSimpleEvent() scoped to the current user, and for GalaxyClusters it calls fetchGalaxyClusters() with the user context. If the object does not exist or the caller lacks access, a NotFoundException is raised and the save is aborted. This ensures that no collection element can reference an object the caller is not authorized to read."
        }
      ],
      "title": "MISP Collection Element Add Missing Authorization on Referenced Object UUID",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is not explicitly stated in the patch; the tag boundary indicates the fix is 204 commits after v2.5.46, but the exact fixed release version is unconfirmed.",
                  "PR:L assumes the attacker needs only a basic authenticated MISP account with collection-element management rights; if a higher privilege level is required, PR should be raised.",
                  "The commit message references \u0027V17\u0027 as a related disclosure scenario; this is treated as internal context and not used to expand the affected scope.",
                  "The deduceType() fallback path is assumed to be reachable by an attacker omitting the element_type field, which the patch explicitly guards against."
                ],
                "commit": "334d537095971df4855a4a4d9d9da0d6fd93d0df",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The attacker simply submits a UUID to the existing add endpoint; no race condition or complex bypass is needed. AT:N: No prior compromise or user interaction is required. PR:L: An authenticated MISP user with permission to manage collection elements is required. UI:N: No victim interaction is needed; the disclosure occurs when the attacker views their own collection. VC:L: The attacker gains read access to Events or GalaxyClusters belonging to other organizations or restricted scopes. VI:L: Unauthorized references are persisted in the collection, altering data integrity. VA:N: No availability impact. SC/SI/SA:N: No impact on adjacent systems.",
                "draft": false,
                "fixSummary": "The fix introduces a dedicated __assertCanUseElements() authorization guard that is invoked in the beforeSave callback of the add() CRUD path (covering both form and REST submission) and in addElementToCollection(). For each element UUID, the method resolves the element type (deducing it if the caller omitted the field, preventing bypass by omission) and performs an ACL-aware lookup: for Events it calls fetchSimpleEvent() scoped to the current user, and for GalaxyClusters it calls fetchGalaxyClusters() with the user context. If the object does not exist or the caller lacks access, a NotFoundException is raised and the save is aborted. This ensures that no collection element can reference an object the caller is not authorized to read.",
                "generatedAt": "2026-09-15T08:32:37.109406Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 4,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "259d46cb772765da8e97cb71e005610ab690f9f92b29e58b0a95aabe71fb0bdf",
                "patchSummary": "In app/Controller/CollectionElementsController.php, a new private method __assertCanUseElements() is added (approximately 45 lines) that iterates over normalized element UUIDs, deduces the element type when not explicitly supplied, and performs an ACL-scoped existence check via Event::fetchSimpleEvent() or GalaxyCluster::fetchGalaxyClusters(). The add() method\u0027s beforeSave closure is modified to call this guard before persisting the row. The addElementToCollection() method is refactored to replace its inline Event-only check with a call to the same __assertCanUseElements() helper, gaining GalaxyCluster coverage. Net change: 53 insertions, 12 deletions in one file.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "334d537095971df4855a4a4d9d9da0d6fd93d0df",
                    "patchSha256": "259d46cb772765da8e97cb71e005610ab690f9f92b29e58b0a95aabe71fb0bdf",
                    "source": "https://github.com/MISP/MISP/commit/334d53709.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/334d53709.patch",
                    "subject": "fix: [acl] Authorise the object a collection element points"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/334d53709.patch",
                "subject": "fix: [acl] Authorise the object a collection element points",
                "tagVersionBoundary": {
                  "commits_after_fix": 204,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The add() method stored collection element UUIDs without performing any authorization check on the referenced object. The fix adds an explicit ACL verification step before persistence, confirming the original code lacked the required authorization control."
                  },
                  {
                    "cweId": "CWE-639",
                    "rationale": "The attacker-supplied UUID (a user-controlled key) was accepted and stored without verifying that the caller held a valid access grant for that specific object, allowing reference to objects outside the caller\u0027s authorized scope."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20267"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-91846",
    "datePublished": "2026-09-15T08:36:22.825Z",
    "dateReserved": "2026-09-15T08:36:20.997Z",
    "dateUpdated": "2026-09-15T13:50:14.847Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91825",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T13:59:42.790533Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T14:19:38.987Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "EventsController (edit action)",
            "Event model (_edit method)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/EventsController.php",
            "app/Model/Event.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path.\u003c/p\u003e\n\u003cp\u003eThe vulnerable logic checked whether the acting user could use a \u003ccode\u003esharing_group_id\u003c/code\u003e only when the request explicitly supplied \u003ccode\u003edistribution = 4\u003c/code\u003e. If the attacker instead omitted \u003ccode\u003edistribution\u003c/code\u003e but supplied a different \u003ccode\u003esharing_group_id\u003c/code\u003e, that authorization branch was skipped. Later, MISP\u2019s field-recovery logic restored the existing event distribution from storage. For events already configured with sharing-group distribution, the unauthorized sharing-group ID could therefore be saved.\u003c/p\u003e\n\u003cp\u003eThe fix adds authorization checks in both the controller and \u003ccode\u003eEvent::_edit()\u003c/code\u003e whenever a non-empty \u003ccode\u003esharing_group_id\u003c/code\u003e is supplied without \u003ccode\u003edistribution\u003c/code\u003e. The model now calls \u003ccode\u003eSharingGroup::checkIfAuthorised()\u003c/code\u003e before persisting the change.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path.\n\n\nThe vulnerable logic checked whether the acting user could use a sharing_group_id only when the request explicitly supplied distribution = 4. If the attacker instead omitted distribution but supplied a different sharing_group_id, that authorization branch was skipped. Later, MISP\u2019s field-recovery logic restored the existing event distribution from storage. For events already configured with sharing-group distribution, the unauthorized sharing-group ID could therefore be saved.\n\n\nThe fix adds authorization checks in both the controller and Event::_edit() whenever a non-empty sharing_group_id is supplied without distribution. The model now calls SharingGroup::checkIfAuthorised() before persisting the change.\n\n\n\nVersion affected: \u22642.5.45"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T08:06:32.511Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/cf3ee4026"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix adds an explicit authorization check for the sharing_group_id in the code path where the distribution field is omitted from the edit request. In the controller, if no distribution is submitted but a sharing_group_id is present and differs from the stored value, the user\u0027s access to that sharing group is verified via checkIfCanBeUsed before the edit proceeds. In the model\u0027s _edit method, a parallel check via checkIfAuthorised is added for the same condition, returning an error if the user is not authorized for the submitted sharing group. This closes the gap where omitting the distribution field bypassed the existing authorization gate.\u003c/p\u003e"
            }
          ],
          "value": "The fix adds an explicit authorization check for the sharing_group_id in the code path where the distribution field is omitted from the edit request. In the controller, if no distribution is submitted but a sharing_group_id is present and differs from the stored value, the user\u0027s access to that sharing group is verified via checkIfCanBeUsed before the edit proceeds. In the model\u0027s _edit method, a parallel check via checkIfAuthorised is added for the same condition, returning an error if the user is not authorized for the submitted sharing group. This closes the gap where omitting the distribution field bypassed the existing authorization gate."
        }
      ],
      "title": "MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary (v2.5.46 with 216 commits after fix); no explicit fixed version tag is provided in the metadata, so the boundary is approximate.",
                  "The attacker must already possess authenticated edit access to at least one event in MISP; the vulnerability does not grant access to users without any event edit permission.",
                  "The impact assessment assumes the unauthorized sharing group contains other users who would gain visibility into the event data; if the target group is empty, the confidentiality impact is reduced.",
                  "The patch was found during internal review per the commit message; no external reporter or finder is identified in the metadata."
                ],
                "commit": "cf3ee40265ee102f28dae9ec313abe4162aff8e3",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The attack requires only omitting a field from a standard edit request; no race condition or complex manipulation is needed. AT:N: No prior user interaction or attack preparation is required. PR:L: The attacker must be an authenticated user with edit access to at least one event. UI:N: No victim interaction is needed. VC:L: Event data may be exposed to members of the unauthorized sharing group. VI:H: The event\u0027s sharing group assignment is modified without authorization, directly compromising data integrity. VA:N: No availability impact. SC/SI/SA: No secondary system impact is evidenced; the impact is confined to the MISP instance\u0027s data integrity and the confidentiality of the affected event record.",
                "draft": false,
                "fixSummary": "The fix adds an explicit authorization check for the sharing_group_id in the code path where the distribution field is omitted from the edit request. In the controller, if no distribution is submitted but a sharing_group_id is present and differs from the stored value, the user\u0027s access to that sharing group is verified via checkIfCanBeUsed before the edit proceeds. In the model\u0027s _edit method, a parallel check via checkIfAuthorised is added for the same condition, returning an error if the user is not authorized for the submitted sharing group. This closes the gap where omitting the distribution field bypassed the existing authorization gate.",
                "generatedAt": "2026-09-15T07:50:41.743787Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 4,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "5229e7ba08a4a77a41d8205ce51428ae17242c7dc7873bc4c087fb828631869e",
                "patchSummary": "Two files are modified with 25 lines of insertions. In EventsController.php (edit method), a new else-if branch is added after the existing distribution-handling logic: when distribution is not set, sharing_group_id is non-empty, and it differs from the stored value, the code calls SharingGroup-\u003echeckIfCanBeUsed() and throws MethodNotAllowedException on failure. In Event.php (_edit method), a new elseif branch is added for the case where distribution is not set in the submitted data but sharing_group_id is present; it calls SharingGroup-\u003echeckIfAuthorised() and returns an error array if the user lacks access. Both additions are narrowly scoped to the omitted-distribution path and do not alter behavior for explicitly stated non-4 distribution values.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "cf3ee40265ee102f28dae9ec313abe4162aff8e3",
                    "patchSha256": "5229e7ba08a4a77a41d8205ce51428ae17242c7dc7873bc4c087fb828631869e",
                    "source": "https://github.com/MISP/MISP/commit/cf3ee4026.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/cf3ee4026.patch",
                    "subject": "fix: [security] Authorise the event sharing group when"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/cf3ee4026.patch",
                "subject": "fix: [security] Authorise the event sharing group when",
                "tagVersionBoundary": {
                  "commits_after_fix": 216,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The authorization check for the sharing_group_id was conditionally executed only when the distribution field was explicitly set to 4. By omitting the distribution field, an attacker bypassed the authorization gate entirely, allowing an unauthorized sharing group assignment to be persisted. The check existed but was not applied to all code paths that could result in the sharing group being saved."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20122"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-91825",
    "datePublished": "2026-09-15T08:06:32.511Z",
    "dateReserved": "2026-09-15T08:06:29.530Z",
    "dateUpdated": "2026-09-15T14:19:38.987Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91819",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T14:33:06.680786Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T14:37:05.161Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Controller/Component/BetterSecurityComponent.php"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/Component/BetterSecurityComponent.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation.\u003c/p\u003e\u003cp\u003eCakePHP honors a \u003ccode\u003e_method\u003c/code\u003e field or \u003ccode\u003eX-HTTP-Method-Override\u003c/code\u003e header by rewriting the effective request method. For override values outside the normal write verbs \u003ccode\u003ePOST\u003c/code\u003e, \u003ccode\u003ePUT\u003c/code\u003e, \u003ccode\u003ePATCH\u003c/code\u003e, and \u003ccode\u003eDELETE\u003c/code\u003e, CakePHP also clears the parsed request body. MISP\u2019s security component then determines whether to perform \u003ccode\u003e_validatePost()\u003c/code\u003e and \u003ccode\u003e_validateCsrf()\u003c/code\u003e based on whether request data remains. With a value such as:\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003e_method=GET\u003c/code\u003e\u003c/p\u003e\u003cp\u003ethe body becomes empty before those checks run, so both protections are skipped. A cross-site form containing only that override can therefore reach actions whose parameters are taken from the URL rather than the request body\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation.\n\nCakePHP honors a _method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs POST, PUT, PATCH, and DELETE, CakePHP also clears the parsed request body. MISP\u2019s security component then determines whether to perform _validatePost() and _validateCsrf() based on whether request data remains. With a value such as:\n\n\n_method=GET\n\nthe body becomes empty before those checks run, so both protections are skipped. A cross-site form containing only that override can therefore reach actions whose parameters are taken from the URL rather than the request body\n\nVersion affected: \u22642.5.45"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T07:41:37.131Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/29af008c4"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces a __rejectUnsafeMethodOverride() check in BetterSecurityComponent::startup() that executes before the parent SecurityComponent::startup() computes $hasData. It inspects both the _method POST field and the X-HTTP-Method-Override header (mirroring CakePHP\u0027s precedence) and rejects any value that is not a string in the allowed set {POST, PUT, PATCH, DELETE}. Non-string values (e.g., array payloads like _method[]=GET) are also refused. A BadRequestException is thrown and the event is logged, preventing the request from ever reaching the parent security logic with an emptied body.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces a __rejectUnsafeMethodOverride() check in BetterSecurityComponent::startup() that executes before the parent SecurityComponent::startup() computes $hasData. It inspects both the _method POST field and the X-HTTP-Method-Override header (mirroring CakePHP\u0027s precedence) and rejects any value that is not a string in the allowed set {POST, PUT, PATCH, DELETE}. Non-string values (e.g., array payloads like _method[]=GET) are also refused. A BadRequestException is thrown and the event is logged, preventing the request from ever reaching the parent security logic with an emptied body."
        }
      ],
      "title": "MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The fix is included in MISP v2.5.46 based on the tag_version_boundary metadata (228 commits after the fix commit at that tag); the exact affected version range prior to the fix is not explicitly stated in the patch.",
                  "PR:L assumes the victim must be an authenticated MISP user; the patch does not explicitly state authentication requirements, but MISP is an authenticated threat-intelligence platform and the example endpoint (/feeds/enable/2) implies an authenticated context.",
                  "UI:P assumes the typical CSRF delivery mechanism (auto-submitting form on a malicious page) where the victim\u0027s interaction is limited to loading the page; if a manual form submission is required, UI:A would be more appropriate.",
                  "The vulnerability was found during internal review and was not externally reported, per the commit message."
                ],
                "commit": "29af008c47d2cc021b6183a0f119b36c8eabfe65",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The attack is delivered over the network via a crafted HTML form or HTTP header. AC:L: Exploitation requires only crafting a form with a _method field; no race conditions or complex timing are needed. AT:N: No manipulation of the target\u0027s data or state is required prior to the attack. PR:L: The victim must be an authenticated MISP user; no administrative privileges are needed. UI:P: The victim passively interacts with the attack (e.g., visiting a page with an auto-submitting form); no deliberate action beyond page load is required. VC:N: No confidentiality impact is evident from the patch evidence. VI:H: The attacker can perform arbitrary state-changing actions (enable/disable feeds, modify objects) on the victim\u0027s MISP instance, representing high integrity impact. VA:N: No availability impact is indicated. SC/SI/SA:N: No sub-component impact is evidenced.",
                "draft": false,
                "fixSummary": "The fix introduces a __rejectUnsafeMethodOverride() check in BetterSecurityComponent::startup() that executes before the parent SecurityComponent::startup() computes $hasData. It inspects both the _method POST field and the X-HTTP-Method-Override header (mirroring CakePHP\u0027s precedence) and rejects any value that is not a string in the allowed set {POST, PUT, PATCH, DELETE}. Non-string values (e.g., array payloads like _method[]=GET) are also refused. A BadRequestException is thrown and the event is logged, preventing the request from ever reaching the parent security logic with an emptied body.",
                "generatedAt": "2026-09-15T07:32:05.818714Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 4,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "97161c8af5472e6169868d916a2e4834f382a4e1f7c8efda555ea396171b8d3a",
                "patchSummary": "Adds a private __rejectUnsafeMethodOverride() method and a public startup() override to BetterSecurityComponent. The new method reads $_POST[\u0027_method\u0027] and the HTTP_X_HTTP_METHOD_OVERRIDE header, applies the same header-over-body precedence as CakeRequest::_processPost(), and throws BadRequestException for any override that is not a string in the ALLOWED_METHOD_OVERRIDES constant (POST, PUT, PATCH, DELETE). The startup() override calls this check before delegating to parent::startup(). A new test file BetterSecurityComponentTest.php (196 lines) covers pass-through of write verbs, refusal of non-write verbs, non-string overrides, header overrides, header-over-body precedence, and log output.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "29af008c47d2cc021b6183a0f119b36c8eabfe65",
                    "patchSha256": "97161c8af5472e6169868d916a2e4834f382a4e1f7c8efda555ea396171b8d3a",
                    "source": "https://github.com/MISP/MISP/commit/29af008c4.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/29af008c4.patch",
                    "subject": "fix: [security] Refuse HTTP method overrides that empty the"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/29af008c4.patch",
                "subject": "fix: [security] Refuse HTTP method overrides that empty the",
                "tagVersionBoundary": {
                  "commits_after_fix": 228,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-352",
                    "rationale": "The primary security impact is the complete bypass of CSRF token validation. An attacker can forge requests to state-changing MISP endpoints without a valid CSRF token by exploiting the method-override body-emptying behaviour."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "The root cause is the failure to validate the _method override value before it influences the security component\u0027s behaviour. Any verb outside the expected write set is accepted by the framework and causes the request body to be discarded, disabling security checks."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20102"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-91819",
    "datePublished": "2026-09-15T07:41:37.131Z",
    "dateReserved": "2026-09-15T07:41:29.630Z",
    "dateUpdated": "2026-09-15T14:37:05.161Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-90961",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T13:55:28.674675Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T13:55:49.225Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "LdapAuth plugin (app/Plugin/LdapAuth/Controller/Component/Auth/LdapAuthenticate.php)",
            "LinOTPAuth plugin (app/Plugin/LinOTPAuth/Controller/Component/Auth/LinOTPAuthenticate.php)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Plugin/LdapAuth/Controller/Component/Auth/LdapAuthenticate.php",
            "app/Plugin/LinOTPAuth/Controller/Component/Auth/LinOTPAuthenticate.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "elhoim (David Andr\u00e9)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass vulnerability. Both LdapAuthenticate and LinOTPAuthenticate replace CakePHP\u0027s FormAuthenticate class but fail to replicate its _checkFields() input validation guard. As a result, the email and password fields extracted from the login request are passed to downstream authentication logic without verifying that they are non-empty strings.\u003c/p\u003e\u003cp\u003eIn the LDAP authenticator, an empty or null password is forwarded to ldap_bind(). Per RFC 4513 section 5.1.2, a bind request with a valid DN and an empty password constitutes an unauthenticated bind, which many LDAP directory servers accept as successful. An attacker who knows any valid user email address in the directory can therefore authenticate as that user without possessing a password. Additionally, non-string values (null, false, arrays) are either coerced to empty strings by ldap_bind(), raise TypeErrors, or are misinterpreted as find conditions in _findUser(), all of which can lead to unintended authentication outcomes.\u003c/p\u003e\u003cp\u003eIn the LinOTP authenticator, the same missing guard allows non-string credentials to be concatenated into the LinOTP verification request, and in the mixed-authentication branch an empty password is accepted against a stored hash of the empty string.\u003c/p\u003e\u003cp\u003eA secondary issue in the LDAP authenticator is that newly created user accounts (auto-provisioned on first LDAP login) were assigned an empty password. Because the save path skips validation, the empty string is hashed and stored. If the user later ceases to be found in LDAP and the mixed-authentication fallback is used, the stored hash of the empty string verifies against an empty password, again permitting unauthenticated access.\u003c/p\u003e\u003cp\u003eThe vulnerability requires that the affected plugin (LdapAuth or LinOTPAuth) is enabled on the MISP instance and that the attacker knows at least one valid email address registered in the directory or MISP user store. No prior authentication is required. Successful exploitation grants the attacker the full privileges of the impersonated user, which may include administrative access to threat intelligence data.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass vulnerability. Both LdapAuthenticate and LinOTPAuthenticate replace CakePHP\u0027s FormAuthenticate class but fail to replicate its _checkFields() input validation guard. As a result, the email and password fields extracted from the login request are passed to downstream authentication logic without verifying that they are non-empty strings.\n\nIn the LDAP authenticator, an empty or null password is forwarded to ldap_bind(). Per RFC 4513 section 5.1.2, a bind request with a valid DN and an empty password constitutes an unauthenticated bind, which many LDAP directory servers accept as successful. An attacker who knows any valid user email address in the directory can therefore authenticate as that user without possessing a password. Additionally, non-string values (null, false, arrays) are either coerced to empty strings by ldap_bind(), raise TypeErrors, or are misinterpreted as find conditions in _findUser(), all of which can lead to unintended authentication outcomes.\n\nIn the LinOTP authenticator, the same missing guard allows non-string credentials to be concatenated into the LinOTP verification request, and in the mixed-authentication branch an empty password is accepted against a stored hash of the empty string.\n\nA secondary issue in the LDAP authenticator is that newly created user accounts (auto-provisioned on first LDAP login) were assigned an empty password. Because the save path skips validation, the empty string is hashed and stored. If the user later ceases to be found in LDAP and the mixed-authentication fallback is used, the stored hash of the empty string verifies against an empty password, again permitting unauthenticated access.\n\nThe vulnerability requires that the affected plugin (LdapAuth or LinOTPAuth) is enabled on the MISP instance and that the attacker knows at least one valid email address registered in the directory or MISP user store. No prior authentication is required. Successful exploitation grants the attacker the full privileges of the impersonated user, which may include administrative access to threat intelligence data.\n\n\nVersion affected: \u22642.5.45"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T13:22:07.185Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/0ee058548"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix adds explicit type and emptiness validation for the email and password fields in both LdapAuthenticate and LinOTPAuthenticate before any authentication logic is invoked. Non-string or empty credentials are rejected with a logged error and a false return. Additionally, the LDAP authenticator now assigns a cryptographically random password to auto-provisioned user accounts instead of an empty string, preventing the stored hash of \u0027\u0027 from being verifiable in the mixed-authentication fallback path. The LinOTP authenticator also rejects an empty password specifically in the mixed-authentication branch where the password is checked against the local database.\u003c/p\u003e"
            }
          ],
          "value": "The fix adds explicit type and emptiness validation for the email and password fields in both LdapAuthenticate and LinOTPAuthenticate before any authentication logic is invoked. Non-string or empty credentials are rejected with a logged error and a false return. Additionally, the LDAP authenticator now assigns a cryptographically random password to auto-provisioned user accounts instead of an empty string, preventing the stored hash of \u0027\u0027 from being verifiable in the mixed-authentication fallback path. The LinOTP authenticator also rejects an empty password specifically in the mixed-authentication branch where the password is checked against the local database."
        }
      ],
      "title": "MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The LDAP directory server is configured to accept unauthenticated (empty-password) binds, which is common but not universal; if the directory rejects empty-password binds, the LDAP-specific bypass is mitigated at the directory level, though the non-string credential and empty-password-hash issues remain.",
                  "The attacker must know at least one valid email address that exists in the LDAP directory or MISP user store.",
                  "The LdapAuth or LinOTPAuth plugin is enabled on the affected MISP instance.",
                  "CVSS impact ratings assume the attacker can impersonate a user with high privileges (e.g., admin); actual impact scales with the privileges of the specific user impersonated.",
                  "The exact fixed version is not specified in the patch metadata; the fix commit is 238 commits after tag v2.5.46, suggesting the fix landed in a release after 2.5.46, but the precise version boundary is unconfirmed.",
                  "The LinOTP empty-password bypass in the mixed-auth branch requires the mixedauth setting to be enabled."
                ],
                "commit": "0ee0585486cd2c9df49e4f14d48a32a953666e3a",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "elhoim (David Andr\u00e9)"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The vulnerability is exploitable over the network via the MISP web login endpoint. AC:L: Exploitation requires only sending a login request with an empty or non-string password field; no race conditions, specific directory configuration beyond accepting unauthenticated binds (which is common), or other special conditions are needed. AT:N: No attack target manipulation is required. PR:N: No prior authentication is needed; the attacker is attempting to authenticate. UI:N: No user interaction is required. VC:H: Successful exploitation grants the attacker the full data-access privileges of the impersonated user, potentially including all MISP threat intelligence data. VI:H: The attacker can create, modify, or delete MISP objects, tags, and configurations at the privilege level of the impersonated user. VA:N: No direct availability impact is demonstrated. SC/SI/SA:N: No separate subsequent system is identified; the impact is contained to the MISP instance itself.",
                "draft": false,
                "fixSummary": "The fix adds explicit type and emptiness validation for the email and password fields in both LdapAuthenticate and LinOTPAuthenticate before any authentication logic is invoked. Non-string or empty credentials are rejected with a logged error and a false return. Additionally, the LDAP authenticator now assigns a cryptographically random password to auto-provisioned user accounts instead of an empty string, preventing the stored hash of \u0027\u0027 from being verifiable in the mixed-authentication fallback path. The LinOTP authenticator also rejects an empty password specifically in the mixed-authentication branch where the password is checked against the local database.",
                "generatedAt": "2026-09-14T13:14:35.161935Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 6,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "01b60b396532e5f6ff5efca8c41961e701b7b6c539edcf49ad29aba06a906149",
                "patchSummary": "In LdapAuthenticate.php: (1) email and password are now extracted with isset() defaults to empty string; (2) a guard clause checks is_string() and non-emptiness for both fields, logging an error and returning false on failure; (3) the auto-provisioned user creation block now calls $userModel-\u003egenerateRandomPassword() and stores that value in both \u0027password\u0027 and \u0027confirm_password\u0027 fields instead of empty strings. In LinOTPAuthenticate.php: (1) email, password, and otp are extracted with isset() defaults; (2) a guard clause checks is_string() and non-emptiness for email and is_string() for password, logging and returning false on failure; (3) in the mixed-authentication branch, an additional check rejects an empty password before calling _findUser().",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "0ee0585486cd2c9df49e4f14d48a32a953666e3a",
                    "patchSha256": "01b60b396532e5f6ff5efca8c41961e701b7b6c539edcf49ad29aba06a906149",
                    "source": "https://github.com/MISP/MISP/commit/0ee058548.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/0ee058548.patch",
                    "subject": "fix: [security] Reject empty and non-string credentials in"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/0ee058548.patch",
                "subject": "fix: [security] Reject empty and non-string credentials in",
                "tagVersionBoundary": {
                  "commits_after_fix": 238,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-287",
                    "rationale": "The primary impact is an authentication bypass: empty or non-string credentials allow an unauthenticated attacker to be authenticated as a known directory user. The root cause is the absence of the credential validation guard that FormAuthenticate normally provides."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "The underlying technical weakness is the failure to validate that user-supplied credential fields are non-empty strings before passing them to ldap_bind(), the LinOTP verifier, or _findUser(). Non-string types (null, false, arrays) and empty strings are all accepted and produce unintended authentication behavior."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20246"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-90961",
    "datePublished": "2026-09-14T13:22:07.185Z",
    "dateReserved": "2026-09-14T13:22:04.165Z",
    "dateUpdated": "2026-09-14T13:55:49.225Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}