Find a vulnerability

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94404",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T14:34:58.261364Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T14:48:16.245Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "AttributesController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/AttributesController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user\u2019s browser without that user knowingly approving the change.\u003c/p\u003e\u003cp\u003eThe affected function did not properly enforce MISP\u2019s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.\u003c/p\u003e\u003cp\u003eIf successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.\u003c/p\u003e\u003cp\u003eThe attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.\u003c/p\u003e\u003cp\u003eThe main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.\u003c/p\u003eVersion affected: \u0026lt;2.5.47"
            }
          ],
          "value": "MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user\u2019s browser without that user knowingly approving the change.\n\nThe affected function did not properly enforce MISP\u2019s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.\n\nIf successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.\n\nThe attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.\n\nThe main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-124",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-124 Cross-Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T13:50:46.410Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/dfbae33f9"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token.\u003c/p\u003e"
            }
          ],
          "value": "The editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token."
        }
      ],
      "title": "MISP CSRF vulnerability allows unauthorized attribute modification",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary (v2.5.47 with 7 commits after the fix); no explicit \u0027affected\u0027 or \u0027fixed\u0027 version strings are provided in the metadata, so the exact version boundary is approximate.",
                  "UI:P (Passive) is assumed because the commit message describes a \u0027cross-site form post\u0027 that auto-submits when the victim\u0027s browser loads the attacker\u0027s page; if the attack requires the victim to explicitly click a link or submit a form, UI:A would be more appropriate.",
                  "PR:N is assumed because the attacker does not need their own MISP account; the victim\u0027s authenticated session cookie is sufficient. If MISP deployments require additional authentication factors (e.g., MFA) that would block a cross-site form post, the effective exploitability may be lower.",
                  "The CAPEC-124 mapping is the closest standard pattern for CSRF; no more specific CAPEC exists for the CakePHP unlockedActions bypass mechanism.",
                  "The Co-Authored-By AI tool is included as a \u0027tool\u0027 credit based on explicit commit metadata; it is not a human contributor."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-124",
                    "rationale": "The patch description explicitly states that a cross-site form post carrying the victim\u0027s session cookie could rewrite attribute fields. This is the canonical CSRF attack pattern: an attacker induces a victim\u0027s browser to send an authenticated request to a target application without the victim\u0027s knowledge or consent. CAPEC-124 is the most direct and specific match."
                  }
                ],
                "commit": "dfbae33f9a93bf127fae115bc6cd1a9e03d028e9",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The attack is delivered over the network via a malicious web page. AC:L: Crafting a CSRF form is straightforward and requires no race conditions or special timing. AT:N: The target MISP instance is not under the attacker\u0027s control. PR:N: The attacker needs no account on MISP; the victim\u0027s existing session is sufficient. UI:P: The victim must passively load the attacker\u0027s page (e.g., visit a link), which triggers the auto-submitting form; no explicit click or form submission by the victim is required. VC:N: The attack modifies data but does not disclose confidential information. VI:H: The attacker can alter attribute values, types, categories, distribution, and timestamps, corrupting threat-intelligence data for all users. VA:N: No denial-of-service impact is indicated. SC/SI/SA:N: No secondary impacts on other systems are evidenced.",
                "fixSummary": "The editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token.",
                "generatedAt": "2026-09-21T13:38:54.473662Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "beb65b8daaa1d2e649f1178cc7f2c774f4ba7e75a13cc000524eef566c4545c8",
                "patchSummary": "In app/Controller/AttributesController.php, the string \u0027editField\u0027 is added to the _csrfTokenHeaderOnly() call in beforeFilter(), enabling header-or-body CSRF token validation for that action. Simultaneously, the line adding \u0027editField\u0027 to $this-\u003eSecurity-\u003eunlockedActions[] is removed, so the action is no longer exempt from CSRF checks. A comment block is added explaining that both the Overmind index (token in X-CSRF-Token header) and legacy inline forms (token in body) already carry a valid token, so only the unsatisfiable field-hash check is dropped.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "dfbae33f9a93bf127fae115bc6cd1a9e03d028e9",
                    "patchSha256": "beb65b8daaa1d2e649f1178cc7f2c774f4ba7e75a13cc000524eef566c4545c8",
                    "source": "https://github.com/MISP/MISP/commit/dfbae33f9.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/dfbae33f9.patch",
                    "subject": "fix: [security] Keep the CSRF check on the inline attribute"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/dfbae33f9.patch",
                "subject": "fix: [security] Keep the CSRF check on the inline attribute",
                "tagVersionBoundary": {
                  "commits_after_fix": 7,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-352",
                    "rationale": "The editField action was placed in unlockedActions, which explicitly bypassed the CSRF token check. This allowed a cross-site form post to modify attribute data using only the victim\u0027s session cookie, a textbook CSRF weakness."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20043"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94404",
    "datePublished": "2026-09-21T13:50:46.410Z",
    "dateReserved": "2026-09-21T13:50:44.676Z",
    "dateUpdated": "2026-09-21T14:48:16.245Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94401",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T14:35:17.511576Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T14:48:16.804Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Model/Event.php (addMISPExportFile)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Event.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services.\u003c/p\u003e\u003cp\u003eWhen importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify data could upload a file containing a local file path or a web address instead.\u003c/p\u003e\u003cp\u003eIf a local file path was supplied, MISP could read that file from the server. If a URL was supplied, MISP could make a request to that address, including systems that may only be reachable from inside the organization\u2019s network.\u003c/p\u003e\u003cp\u003eThe vulnerability could therefore expose sensitive local files and allow unauthorized requests to internal services.\u003c/p\u003e\u003cp\u003eExploitation required a valid MISP account with modify permissions, but no additional user interaction was needed.\u003c/p\u003eVersion affected: \u0026lt;2.5.47"
            }
          ],
          "value": "MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services.\n\nWhen importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify data could upload a file containing a local file path or a web address instead.\n\nIf a local file path was supplied, MISP could read that file from the server. If a URL was supplied, MISP could make a request to that address, including systems that may only be reachable from inside the organization\u2019s network.\n\nThe vulnerability could therefore expose sensitive local files and allow unauthorized requests to internal services.\n\nExploitation required a valid MISP account with modify permissions, but no additional user interaction was needed.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Server Side Request Forgery"
            }
          ]
        },
        {
          "capecId": "CAPEC-2",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-2 Parameter Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73 External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T13:36:13.066Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/d5f247b91"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces two defensive measures in addMISPExportFile(): (1) a pre-parse validation that rejects any uploaded content not containing an XML document marker (the \u0027\u0026lt;\u0027 character), preventing path or URL strings from reaching the XML parser; and (2) an explicit readFile =\u0026gt; false option passed to Xml::build(), which disables the library\u0027s ability to interpret the input as a file path or URL to be read or fetched. Together these changes ensure that only genuine XML document content is parsed and that no server-side file access or network request is triggered by user-supplied data.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces two defensive measures in addMISPExportFile(): (1) a pre-parse validation that rejects any uploaded content not containing an XML document marker (the \u0027\u003c\u0027 character), preventing path or URL strings from reaching the XML parser; and (2) an explicit readFile =\u003e false option passed to Xml::build(), which disables the library\u0027s ability to interpret the input as a file path or URL to be read or fetched. Together these changes ensure that only genuine XML document content is parsed and that no server-side file access or network request is triggered by user-supplied data."
        }
      ],
      "title": "MISP Arbitrary Local File Read and SSRF via MISP Export Upload",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The commit message states the vulnerability was \u0027found during the internal review, not externally reported,\u0027 so no external finder or reporter credit is assigned. The internal reviewer\u0027s identity is not specified in the patch metadata.",
                  "The affected version range is inferred from the tag_version_boundary (v2.5.47 with 40 commits after the fix), but exact affected and fixed version numbers are not stated in the patch. The boundary is recorded as a reference point only.",
                  "PR:L assumes that perm_modify is a non-administrative, commonly granted role in MISP deployments. If perm_modify is equivalent to full administrative access in some configurations, PR could be elevated to PR:H.",
                  "The CAPEC-2 mapping is a broader, secondary pattern included for completeness; CAPEC-126 is the primary and most specific match. The uncertainty is noted in the CAPEC-2 rationale.",
                  "The commit message references an operator-precedence issue in Xml::build()\u0027s readFile guard not covering the https branch. This is taken as evidence from the commit message and patch comments; the actual Xml utility source is not included in the patch, so the exact mechanism of the https bypass is assumed rather than verified.",
                  "CVSS SC:H assumes the SSRF can reach internal services with sensitive data. If the deployment restricts outbound network access, SC could be reduced."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The patch explicitly describes the SSRF vector: an .xml upload containing a URL causes MISP to fetch that URL and import the result. CAPEC-126 describes an attacker manipulating a server-side application to make it issue requests to unintended targets, which is exactly the attack demonstrated here. The local-file-read aspect is a secondary manifestation of the same root cause (unvalidated input passed to a function that resolves locators) and is subsumed by the SSRF pattern in this context."
                  },
                  {
                    "capecId": "CAPEC-2",
                    "rationale": "The attacker manipulates the content parameter of the MISP export upload to supply a file path or URL instead of a valid XML document. CAPEC-2 covers the general technique of altering application parameters to trigger unintended behavior. This is a secondary mapping; CAPEC-126 is the more specific and primary pattern. The uncertainty is that CAPEC-2 is broader and less precise than CAPEC-126 for this specific vulnerability."
                  }
                ],
                "commit": "d5f247b91ad3e8ea86feaaa587bf0466c95ea996",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: exploitation occurs over the network via the MISP web interface. AC:L: the attack is deterministic; uploading a file with a path or URL as content reliably triggers the read/fetch. AT:N: no special target-side conditions are required. PR:L: the attacker needs an authenticated account with perm_modify (a non-privileged but authenticated role). UI:N: the attacker performs the upload autonomously; no victim interaction is needed. VC:H: arbitrary local file read exposes sensitive server data (credentials, configs, keys). VI:N: the imported data is stored as an event but does not corrupt application state or logic. VA:N: no denial-of-service impact is indicated. SC:H: the SSRF component allows the attacker to read responses from internal services (metadata endpoints, admin panels, etc.), impacting subsequent-component confidentiality. SI:N and SA:N: no evidence of integrity or availability impact on subsequent components from the patch evidence.",
                "fixSummary": "The fix introduces two defensive measures in addMISPExportFile(): (1) a pre-parse validation that rejects any uploaded content not containing an XML document marker (the \u0027\u003c\u0027 character), preventing path or URL strings from reaching the XML parser; and (2) an explicit readFile =\u003e false option passed to Xml::build(), which disables the library\u0027s ability to interpret the input as a file path or URL to be read or fetched. Together these changes ensure that only genuine XML document content is parsed and that no server-side file access or network request is triggered by user-supplied data.",
                "generatedAt": "2026-09-21T13:28:43.719596Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 6,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "004f65b4d416b8e01f8b713a982a9b4d808e454c40cd74cc94d36137eb1b2845",
                "patchSummary": "In app/Model/Event.php, the single line calling Xml::toArray(Xml::build($data)) is replaced with a guard clause that throws an Exception if strpos($data, \u0027\u003c\u0027) === false, followed by Xml::toArray(Xml::build($data, [\u0027readFile\u0027 =\u003e false])). Nine lines are added (including a four-line explanatory comment) and one line is removed. No other files are modified.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "d5f247b91ad3e8ea86feaaa587bf0466c95ea996",
                    "patchSha256": "004f65b4d416b8e01f8b713a982a9b4d808e454c40cd74cc94d36137eb1b2845",
                    "source": "https://github.com/MISP/MISP/commit/d5f247b91.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/d5f247b91.patch",
                    "subject": "fix: [security] Refuse a MISP export upload whose content is"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/d5f247b91.patch",
                "subject": "fix: [security] Refuse a MISP export upload whose content is",
                "tagVersionBoundary": {
                  "commits_after_fix": 40,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-918",
                    "rationale": "The primary and most severe impact is that an attacker-supplied URL in the uploaded file body causes the MISP server to issue an HTTP request to an arbitrary internal or external address and import the response. This is a textbook SSRF: user-controlled input is used as a network request target by the server."
                  },
                  {
                    "cweId": "CWE-73",
                    "rationale": "The secondary impact is that a user-supplied local file path in the uploaded file body is passed to Xml::build() which reads that file from the server\u0027s filesystem. The attacker controls the file path that the server reads, matching CWE-73. CWE-22 (Path Traversal) was considered but the input is not a relative traversal sequence; it is an absolute path chosen by the attacker, making CWE-73 the more precise mapping."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20056"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94401",
    "datePublished": "2026-09-21T13:36:13.066Z",
    "dateReserved": "2026-09-21T13:36:11.048Z",
    "dateUpdated": "2026-09-21T14:48:16.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94394",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T14:35:25.970564Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T14:48:16.963Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "ObjectReferencesController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/ObjectReferencesController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user.\u003cbr\u003e\u003cbr\u003e\u003cp\u003eBecause of this, someone who can view an event could potentially access attributes or objects inside that event that were meant to be restricted to a specific sharing group or distribution level.\u003c/p\u003eThe vulnerability affects authenticated users who are not site administrators and who already have access to an event containing more restricted data.\u003cbr\u003e\u003cbr\u003eThe main impact is that users may be able to view sensitive attribute values, object details, or related object data that they should not normally be allowed to see.\u003cbr\u003e"
            }
          ],
          "value": "When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user.\n\nBecause of this, someone who can view an event could potentially access attributes or objects inside that event that were meant to be restricted to a specific sharing group or distribution level.\n\nThe vulnerability affects authenticated users who are not site administrators and who already have access to an event containing more restricted data.\n\nThe main impact is that users may be able to view sensitive attribute values, object details, or related object data that they should not normally be allowed to see."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-109",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-109 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T13:25:40.360Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/f36634e57"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces granular authorization checks in the ObjectReferencesController add() method. For non-site-admin users, the query conditions for attributes, objects, and object attributes are now augmented with OR clauses that restrict results to: (1) entities belonging to the user\u0027s own event, (2) entities with unrestricted distribution levels (1, 2, 3, 5), or (3) entities with distribution level 4 whose sharing_group_id is in the user\u0027s authorized sharing group list. This ensures that only data the user is explicitly authorized to see under MISP\u0027s distribution and sharing-group model is included in the object reference operation.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces granular authorization checks in the ObjectReferencesController add() method. For non-site-admin users, the query conditions for attributes, objects, and object attributes are now augmented with OR clauses that restrict results to: (1) entities belonging to the user\u0027s own event, (2) entities with unrestricted distribution levels (1, 2, 3, 5), or (3) entities with distribution level 4 whose sharing_group_id is in the user\u0027s authorized sharing group list. This ensures that only data the user is explicitly authorized to see under MISP\u0027s distribution and sharing-group model is included in the object reference operation."
        }
      ],
      "title": "MISP ObjectReferencesController: Granular Distribution and Sharing Group Restrictions Bypassed When Adding Object References",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact affected and fixed version numbers are not specified in the patch metadata. The tag_version_boundary indicates the fix commit is 140 commits after v2.5.47, but the precise release version containing the fix is unknown.",
                  "The CAPEC-109 (Parameter Tampering) mapping is the closest available match but is not a perfect fit; the vulnerability is more precisely a missing granular authorization check rather than parameter manipulation. No CAPEC specifically models broken sub-entity access control.",
                  "The CVSS SC:H rating assumes that the exposed attribute/object data constitutes sensitive information (e.g., IOCs, malware indicators, threat intelligence) whose unauthorized disclosure is a significant confidentiality impact. If the data is considered low-sensitivity, SC:L may be more appropriate.",
                  "The vulnerability requires the attacker to already have event-level access; it does not grant access to events the user cannot see. The bypass is limited to granular restrictions within an already-accessible event.",
                  "The patch only addresses the add() method in ObjectReferencesController; other methods or controllers with similar patterns may or may not be affected, but no evidence of additional affected code paths is present in this patch."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-109",
                    "rationale": "The closest plausible CAPEC is Parameter Tampering. An authenticated user supplies an objectId parameter to the add() endpoint, and the application fails to enforce proper authorization on the sub-entities (attributes, objects, object attributes) associated with that object. The user effectively \u0027tampers\u0027 with the scope of accessible data by leveraging event-level access to reach restricted sub-entities. This is not a perfect match because the user is not modifying a parameter to an invalid value but rather exploiting the absence of a check on a valid parameter\u0027s sub-resources. No CAPEC specifically models \u0027broken granular access control\u0027 or \u0027insecure direct object reference at sub-entity level,\u0027 making CAPEC-109 the best available approximation."
                  }
                ],
                "commit": "f36634e57b93ad9daa3ab9530b76b9e5cba796e2",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The attack requires no special conditions beyond having a valid account with event-level access; no race conditions or complex setup needed. AT:N: No manipulation of a separate attack target is required. PR:L: The attacker needs a low-privilege authenticated account (any non-site-admin user with access to an event containing restricted attributes/objects). UI:N: No victim interaction is required; the attacker simply calls the API endpoint. VC:N/VI:N/VA:N: The MISP server itself (the vulnerable component) is not compromised in its own confidentiality, integrity, or availability. SC:H: The resource impact is high because restricted attribute values, object metadata, and object-attribute data that are explicitly gated by distribution levels and sharing groups are exposed to an unauthorized user. SI:N: No integrity impact on the data. SA:N: No safety impact.",
                "fixSummary": "The fix introduces granular authorization checks in the ObjectReferencesController add() method. For non-site-admin users, the query conditions for attributes, objects, and object attributes are now augmented with OR clauses that restrict results to: (1) entities belonging to the user\u0027s own event, (2) entities with unrestricted distribution levels (1, 2, 3, 5), or (3) entities with distribution level 4 whose sharing_group_id is in the user\u0027s authorized sharing group list. This ensures that only data the user is explicitly authorized to see under MISP\u0027s distribution and sharing-group model is included in the object reference operation.",
                "generatedAt": "2026-09-21T13:15:28.001598Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "2688fca1334e3016b8b885ce926749f8d47e49d7b657cf38f7b2edcd6eaf6cf0",
                "patchSummary": "In app/Controller/ObjectReferencesController.php, the add() method is modified to build dynamic condition arrays ($attributeConditions, $objectConditions, $objectAttributeConditions) that incorporate the current user\u0027s role and authorized sharing group IDs. For non-site-admin users, each condition array gains an OR clause filtering by event ownership, distribution levels (1,2,3,5), or distribution level 4 with a matching sharing_group_id from the user\u0027s authorized IDs. These condition arrays replace the previously hardcoded minimal conditions (deleted=0, object_id=0) in the Contain clauses for Attribute, Object, and nested Object.Attribute queries. The user\u0027s authorized sharing group IDs are obtained via SharingGroup-\u003eauthorizedIds($user).",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "f36634e57b93ad9daa3ab9530b76b9e5cba796e2",
                    "patchSha256": "2688fca1334e3016b8b885ce926749f8d47e49d7b657cf38f7b2edcd6eaf6cf0",
                    "source": "https://github.com/MISP/MISP/commit/f36634e57.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/f36634e57.patch",
                    "subject": "fix: [security] Extended event granular restrictions ignored"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/f36634e57.patch",
                "subject": "fix: [security] Extended event granular restrictions ignored",
                "tagVersionBoundary": {
                  "commits_after_fix": 140,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The ObjectReferencesController add() method was missing authorization checks for granular distribution-level and sharing-group restrictions on attributes, objects, and object attributes. Only event-level access was verified, while the sub-entity level access controls (distribution levels 1-5, sharing group membership) were entirely absent from the query conditions. This is a classic missing authorization check at a finer granularity than what was enforced."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20106"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94394",
    "datePublished": "2026-09-21T13:25:40.360Z",
    "dateReserved": "2026-09-21T13:25:38.483Z",
    "dateUpdated": "2026-09-21T14:48:16.963Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94393",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:18:01.147790Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T15:18:17.855Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Model/EventReport.php"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/EventReport.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "David Andr\u00e9"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003c/div\u003e\u003cp\u003eWhen a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event.\u003c/p\u003e\u003cp\u003eAs a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report\u2019s UUID. Once moved, they could view and change information that they were not originally allowed to access.\u003c/p\u003e\u003cp\u003eThe vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID.\u003c/p\u003e\u003cp\u003eThe main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP\u2019s normal access restrictions.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e\u003cdiv\u003e\u003c/div\u003e"
            }
          ],
          "value": "When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event.\n\nAs a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report\u2019s UUID. Once moved, they could view and change information that they were not originally allowed to access.\n\nThe vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID.\n\nThe main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP\u2019s normal access restrictions.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-174",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-174 Exploiting Incorrectly Handled Edge Cases"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T13:14:00.619Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/43665b9bb"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix adds an ownership check in editReport: before adopting an existing report found by UUID, the code now verifies that the report\u0027s event_id matches the event being edited. If the UUID resolves to a report belonging to a different event, the operation is rejected with an error message, preventing cross-event reparenting, unauthorized read, and unauthorized overwrite of reports.\u003c/p\u003e"
            }
          ],
          "value": "The fix adds an ownership check in editReport: before adopting an existing report found by UUID, the code now verifies that the report\u0027s event_id matches the event being edited. If the UUID resolves to a report belonging to a different event, the operation is rejected with an error message, preventing cross-event reparenting, unauthorized read, and unauthorized overwrite of reports."
        }
      ],
      "title": "MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary (v2.5.47, 56 commits after fix); the exact first affected and first fixed release versions are not stated in the patch and are marked unspecified.",
                  "PR:L assumes the attacker needs at minimum editor-level access to one event; the patch does not specify whether viewer-level access could also trigger the code path, but the commit message explicitly references \u0027an event editor\u0027.",
                  "CAPEC-174 is selected as the closest available attack pattern; no CAPEC entry specifically covers IDOR or broken object reference resolution, so the mapping is approximate.",
                  "The CVSS sub-component impact (SC:H, SI:H) assumes the event report data constitutes a distinct data asset whose confidentiality and integrity are the primary impact, rather than the MISP application\u0027s own state.",
                  "The commit date (2026-09-16) and tag boundary are taken at face value from the supplied metadata; no independent verification of release timing was performed."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-174",
                    "rationale": "The edge case of a UUID belonging to a different event was not handled: the code assumed any UUID found in the global table belonged to the current event. The attacker exploits this unhandled edge case to reparent a foreign report. This is the closest CAPEC; a more specific \u0027IDOR\u0027 or \u0027broken object reference\u0027 CAPEC does not exist in the CAPEC catalog, so CAPEC-174 is the best available match."
                  }
                ],
                "commit": "43665b9bb6bd39af0db1f38e608bdf2cb84b9dec",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  },
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "David Andr\u00e9"
                  },
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: the attacker only needs to supply a known/guessed UUID in a standard edit request; no race or complex condition. AT:N: no manipulation of the target environment is required. PR:L: the attacker must be an authenticated user with editor role on at least one event. UI:N: no victim interaction is needed. VC:N/VI:N/VA:N: the MISP application itself (its configuration, credentials, availability) is not directly impacted. SC:H: the attacker gains read access to private report data in events they cannot otherwise see. SI:H: the attacker can overwrite and modify report data belonging to other events. SA:N: no safety-system impact.",
                "fixSummary": "The fix adds an ownership check in editReport: before adopting an existing report found by UUID, the code now verifies that the report\u0027s event_id matches the event being edited. If the UUID resolves to a report belonging to a different event, the operation is rejected with an error message, preventing cross-event reparenting, unauthorized read, and unauthorized overwrite of reports.",
                "generatedAt": "2026-09-21T13:01:16.364280Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "2306bd95d16b9c00582997897aa9181253364082a09589640fce576a03beafb4",
                "patchSummary": "In app/Model/EventReport.php, the editReport method\u0027s else-branch (handling an existing report found by UUID) now includes an 11-line guard: it compares (string)$existingReport[\u0027EventReport\u0027][\u0027event_id\u0027] against (string)$eventId and, on mismatch, appends an error string and returns early, preventing the subsequent assignment of the foreign report\u0027s ID to the current event\u0027s report record.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "43665b9bb6bd39af0db1f38e608bdf2cb84b9dec",
                    "patchSha256": "2306bd95d16b9c00582997897aa9181253364082a09589640fce576a03beafb4",
                    "source": "https://github.com/MISP/MISP/commit/43665b9bb.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/43665b9bb.patch",
                    "subject": "fix: [security] Refuse to adopt an event report that belongs"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/43665b9bb.patch",
                "subject": "fix: [security] Refuse to adopt an event report that belongs",
                "tagVersionBoundary": {
                  "commits_after_fix": 56,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-639",
                    "rationale": "The report UUID is a user-controlled key resolved globally without scoping to the caller\u0027s event context. The system failed to verify that the referenced object (report) belongs to the event the caller is authorized to edit, allowing cross-event access."
                  },
                  {
                    "cweId": "CWE-284",
                    "rationale": "The broader category applies: MISP\u0027s per-event access control model was bypassed because the editReport path did not enforce that a report UUID maps to the same event the caller is operating on."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20057"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94393",
    "datePublished": "2026-09-21T13:14:00.619Z",
    "dateReserved": "2026-09-21T13:13:54.299Z",
    "dateUpdated": "2026-09-21T15:18:17.855Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94383",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T14:37:12.233579Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T14:48:17.369Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "WorkflowModules/action/Module_blocklist_action"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/WorkflowModules/action/Module_blocklist_action.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename() to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary extension that would be placed in the MISP export directory. If the underlying web server is configured to interpret and execute scripts from that directory, the resulting file could be invoked, leading to arbitrary code execution in the context of the web server process.\u003c/p\u003e\u003cp\u003eThe vulnerability requires the attacker to hold site-administrator privileges within MISP, as the blocklist workflow module is restricted to that role. No additional user interaction is required beyond triggering the workflow action with a crafted filename parameter. The impact is full compromise of the MISP server\u0027s confidentiality, integrity, and availability, as arbitrary script execution grants the attacker the same privileges as the web server user.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename() to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary extension that would be placed in the MISP export directory. If the underlying web server is configured to interpret and execute scripts from that directory, the resulting file could be invoked, leading to arbitrary code execution in the context of the web server process.\n\nThe vulnerability requires the attacker to hold site-administrator privileges within MISP, as the blocklist workflow module is restricted to that role. No additional user interaction is required beyond triggering the workflow action with a crafted filename parameter. The impact is full compromise of the MISP server\u0027s confidentiality, integrity, and availability, as arbitrary script execution grants the attacker the same privileges as the web server user.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-170",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-170 File Upload"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:52:03.355Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/e5a943178"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe vulnerability is remediated by enforcing a strict whitelist of allowed file extensions (txt, list, blocklist, csv) on the blocklist filename parameter before the file is processed. Any filename with an extension outside this whitelist is rejected with an error, preventing an attacker from placing files with executable or dangerous extensions (e.g., .php, .phtml) into the MISP export directory where they could be interpreted by the web server.\u003c/p\u003e"
            }
          ],
          "value": "The vulnerability is remediated by enforcing a strict whitelist of allowed file extensions (txt, list, blocklist, csv) on the blocklist filename parameter before the file is processed. Any filename with an extension outside this whitelist is rejected with an error, preventing an attacker from placing files with executable or dangerous extensions (e.g., .php, .phtml) into the MISP export directory where they could be interpreted by the web server."
        }
      ],
      "title": "MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The commit message states \u0027site admin only\u0027, which is taken as evidence that the vulnerable workflow module requires MISP site-administrator privileges. The exact privilege model and whether lower-privilege roles could reach this code path is not confirmed by the patch alone.",
                  "The assumption that the MISP export directory is web-accessible and that the web server is configured to execute scripts (e.g., PHP) from that directory is inferred from the commit subject \u0027arbitrary script execution\u0027. The patch does not include web server configuration evidence.",
                  "The affected version boundary (prior to v2.5.47) is inferred from the tag_version_boundary metadata showing v2.5.47 as the nearest tag with 142 commits after the fix. The exact first affected version is not stated in the patch.",
                  "CAPEC-170 (File Upload) is the closest available attack pattern, but the actual mechanism is a workflow parameter specifying a filename rather than a traditional file upload. This mapping is approximate.",
                  "The CVSS PR:H rating assumes that \u0027site admin\u0027 in MISP corresponds to a high-privilege role requiring authentication and elevated permissions, consistent with MISP\u0027s role model."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-170",
                    "rationale": "CAPEC-170 describes an attacker uploading or placing a file with a dangerous extension into a target directory where it can be executed. In this case, a site admin specifies a blocklist filename with a dangerous extension (e.g., .php) that is placed in the MISP export directory. The mechanism is not a traditional multipart upload but rather a workflow parameter that results in a file being written to a web-accessible location. CAPEC-170 is the closest available pattern; the uncertainty is that the file is not uploaded via a standard upload endpoint but is instead referenced by name in a workflow action, making the mapping approximate."
                  }
                ],
                "commit": "e5a9431784b4a78faddc0cc6efc2a287f2fd3d08",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The attack requires only specifying a filename with a dangerous extension in a workflow parameter; no race conditions or complex timing are needed. AT:N: No manipulation of the target system is required beyond the normal API call. PR:H: The commit message explicitly states \u0027site admin only\u0027, requiring high-privilege MISP access. UI:N: No victim interaction is needed; the workflow action is triggered by the admin themselves. VC:H, VI:H, VA:H: Arbitrary script execution on the MISP server compromises all three local security properties. SC:N, SI:N, SA:N: The impact is confined to the MISP server; no evidence of lateral impact on other systems is present in the patch.",
                "fixSummary": "The vulnerability is remediated by enforcing a strict whitelist of allowed file extensions (txt, list, blocklist, csv) on the blocklist filename parameter before the file is processed. Any filename with an extension outside this whitelist is rejected with an error, preventing an attacker from placing files with executable or dangerous extensions (e.g., .php, .phtml) into the MISP export directory where they could be interpreted by the web server.",
                "generatedAt": "2026-09-21T12:44:28.234229Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "9b7cc757cbbc8a4dd7491c6388e0ee12057c790bb6ca21e10b1d78209bbb7748",
                "patchSummary": "In app/Model/WorkflowModules/action/Module_blocklist_action.php, five lines are inserted after the existing basename() call. The added code defines an $allowedExtensions array containing \u0027txt\u0027, \u0027list\u0027, \u0027blocklist\u0027, and \u0027csv\u0027, extracts the file extension via pathinfo() with PATHINFO_EXTENSION, and performs a strict (===) in_array() check. If the extension is not in the whitelist, the method returns early with a failure message \u0027Blocklist filename has an invalid extension.\u0027 This check is placed before the existing empty/dot filename validation.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "e5a9431784b4a78faddc0cc6efc2a287f2fd3d08",
                    "patchSha256": "9b7cc757cbbc8a4dd7491c6388e0ee12057c790bb6ca21e10b1d78209bbb7748",
                    "source": "https://github.com/MISP/MISP/commit/e5a943178.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/e5a943178.patch",
                    "subject": "fix: [security] arbitrary script execution via insufficient"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/e5a943178.patch",
                "subject": "fix: [security] arbitrary script execution via insufficient",
                "tagVersionBoundary": {
                  "commits_after_fix": 142,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-434",
                    "rationale": "The blocklist filename parameter accepted arbitrary file extensions without restriction. A site admin could supply a filename with a dangerous extension (e.g., .php) that would be placed in a web-accessible export directory, enabling script execution. The fix restricts extensions to a safe whitelist, which is the canonical remediation for CWE-434."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "The filename parameter was not validated against a set of acceptable values (extensions). Only path stripping and empty-string checks were performed, leaving the extension entirely unvalidated. This is a general improper input validation weakness that enabled the more specific dangerous-file-type issue."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20009"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94383",
    "datePublished": "2026-09-21T12:52:03.355Z",
    "dateReserved": "2026-09-21T12:52:01.101Z",
    "dateUpdated": "2026-09-21T14:48:17.369Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94381",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T14:37:33.435781Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T14:48:17.524Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "UsersController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/UsersController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eMISP has a security issue that can let a user gain more access than their API key is supposed to allow.\u003c/p\u003e\u003cp\u003eA read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user\u2019s normal account permissions. This means someone with a read-only API key could potentially gain write, delete, or even administrator access if their underlying account has those permissions.\u003c/p\u003e\u003cp\u003eExploiting the issue requires a valid read-only API key and a single request to the affected function.\u003c/p\u003e\u003cp\u003eThe main impact is that MISP\u2019s API key restrictions can be bypassed, allowing actions that the API key was specifically meant to prevent.\u003c/p\u003e\u003cbr\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "MISP has a security issue that can let a user gain more access than their API key is supposed to allow.\n\nA read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user\u2019s normal account permissions. This means someone with a read-only API key could potentially gain write, delete, or even administrator access if their underlying account has those permissions.\n\nExploiting the issue requires a valid read-only API key and a single request to the affected function.\n\nThe main impact is that MISP\u2019s API key restrictions can be bypassed, allowing actions that the API key was specifically meant to prevent.\n\n\n\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-114 Exploiting Incorrectly Configured Privileges"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:42:53.242Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/fd27e592a"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix removes the call to User::getAuthUser() and Auth::login() from the updateLoginTime() method, which was re-authenticating the user with their full role permissions. It replaces this with a call to _refreshAuth(), which refreshes the authentication state while preserving the current (restricted) permission level associated with the API key, preventing privilege escalation.\u003c/p\u003e"
            }
          ],
          "value": "The fix removes the call to User::getAuthUser() and Auth::login() from the updateLoginTime() method, which was re-authenticating the user with their full role permissions. It replaces this with a call to _refreshAuth(), which refreshes the authentication state while preserving the current (restricted) permission level associated with the API key, preventing privilege escalation."
        }
      ],
      "title": "MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The tag_version_boundary indicates the fix commit is 141 commits before v2.5.47, implying v2.5.47 contains the fix; versions prior to v2.5.47 are assumed affected. No explicit version range is stated in the patch.",
                  "The _refreshAuth() method is assumed to preserve the current API-key-scoped permission level rather than re-fetching full role permissions; this is inferred from the commit subject and the removal of getAuthUser()/Auth::login().",
                  "The \u0027full role\u0027 referenced in the commit subject is assumed to be a higher-privilege role (e.g., admin or site admin) compared to the read-only API key scope.",
                  "CAPEC-114 is the closest available attack pattern; no CAPEC specifically models session privilege escalation via authentication refresh, so this mapping carries some uncertainty.",
                  "CVSS impact metrics (VC/VI/VA) assume the user\u0027s full role grants broad administrative access to the MISP instance; actual impact depends on the specific role assigned to the user."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-114",
                    "rationale": "The vulnerability arises because the updateLoginTime endpoint incorrectly reconfigures the user\u0027s privilege level during session refresh, upgrading from the API-key-scoped read-only permissions to the user\u0027s full role. The attacker exploits this misconfiguration by simply calling the endpoint. CAPEC-114 is the closest match as it covers scenarios where an application incorrectly assigns or maintains privilege levels. Uncertainty: no CAPEC specifically covers \u0027session privilege escalation via auth refresh,\u0027 so this is the best available approximation."
                  }
                ],
                "commit": "fd27e592a617f21934f4a2c424e0578287affb36",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N - the endpoint is accessible over the network via HTTP POST. AC:L - the attack requires only a single POST request to a known endpoint; no race conditions or complex timing. AT:N - no manipulation of the target system is needed beyond the API call. PR:L - the attacker must possess a valid read-only API key (authenticated user). UI:N - no user interaction is required. VC:H - the escalated user can read all data in the MISP instance that their full role permits. VI:H - the escalated user can create, modify, and delete threat intelligence data. VA:H - the escalated user can delete data, modify configurations, or disrupt the MISP service. SC/SI/SA:N - the impact is confined to the MISP instance itself; no cascading impact on other systems is evidenced.",
                "fixSummary": "The fix removes the call to User::getAuthUser() and Auth::login() from the updateLoginTime() method, which was re-authenticating the user with their full role permissions. It replaces this with a call to _refreshAuth(), which refreshes the authentication state while preserving the current (restricted) permission level associated with the API key, preventing privilege escalation.",
                "generatedAt": "2026-09-21T12:37:21.609779Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "d4143841f5f0d52a14d8538760872a7d91f78ba110384eafa3eedcad8e6480d3",
                "patchSummary": "In app/Controller/UsersController.php, the updateLoginTime() method is modified: the lines that fetched the user record via User::find(), called User::getAuthUser() to retrieve the full auth user, and called Auth::login() to re-establish the session are removed. These are replaced with a single call to $this-\u003e_refreshAuth(), which updates the authentication context without upgrading the permission scope. Net change: 1 insertion, 6 deletions.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "fd27e592a617f21934f4a2c424e0578287affb36",
                    "patchSha256": "d4143841f5f0d52a14d8538760872a7d91f78ba110384eafa3eedcad8e6480d3",
                    "source": "https://github.com/MISP/MISP/commit/fd27e592a.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/fd27e592a.patch",
                    "subject": "fix: [security] read only api keys can regain full role"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/fd27e592a.patch",
                "subject": "fix: [security] read only api keys can regain full role",
                "tagVersionBoundary": {
                  "commits_after_fix": 141,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-269",
                    "rationale": "The system fails to maintain the restricted privilege level (read-only) associated with the API key authentication. The updateLoginTime endpoint re-establishes the session with the user\u0027s full role permissions, effectively granting higher privileges than the authentication credential intended. This is a failure to properly manage and enforce the privilege boundary during session refresh."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20048"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94381",
    "datePublished": "2026-09-21T12:42:53.242Z",
    "dateReserved": "2026-09-21T12:42:51.237Z",
    "dateUpdated": "2026-09-21T14:48:17.524Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94379",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:20:43.610267Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T15:21:01.092Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "UsersController (login endpoint)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/UsersController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "unspecified",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe login() function in MISP\u0027s UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically:\u0026nbsp;\u003c/p\u003e\u2003-\u0026nbsp;the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked\u003cbr\u003e\u2003-\u0026nbsp; the email OTP two-factor authentication step was skipped, defeating the second factor of authentication\u003cbr\u003e\u003cdiv\u003e\u2003- login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cp\u003eThe security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance.\u003cbr\u003e\u003c/p\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "The login() function in MISP\u0027s UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically:\u00a0\n\n\u2003-\u00a0the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked\n\u2003-\u00a0 the email OTP two-factor authentication step was skipped, defeating the second factor of authentication\n\u2003- login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry.\n\n\n\n\nThe security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance.\n\n\n\n\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Improperly Controlled Modification of Authentication Logic"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:35:26.533Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/ef4dc19c6"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix replaces the allowlist-style HTTP method checks (is POST or PUT) with a denylist approach (is NOT GET) in all three security-critical branches of the login() function. This ensures that every non-GET HTTP method\u2014regardless of whether it is POST, PUT, PATCH, DELETE, HEAD, OPTIONS, or any other\u2014triggers the bruteforce protection, email OTP verification, and login-failure logging code paths, closing the method-based bypass.\u003c/p\u003e"
            }
          ],
          "value": "The fix replaces the allowlist-style HTTP method checks (is POST or PUT) with a denylist approach (is NOT GET) in all three security-critical branches of the login() function. This ensures that every non-GET HTTP method\u2014regardless of whether it is POST, PUT, PATCH, DELETE, HEAD, OPTIONS, or any other\u2014triggers the bruteforce protection, email OTP verification, and login-failure logging code paths, closing the method-based bypass."
        }
      ],
      "title": "MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact affected version range is not explicitly stated in the patch; the tag_version_boundary metadata indicates v2.5.47 with 143 commits after the fix, suggesting the fix landed shortly after 2.5.47, but the precise last-affected and first-fixed versions are not confirmed.",
                  "The CAPEC-1 mapping is the closest available pattern; the actual attack vector (HTTP method substitution) is a form of request parameter manipulation that does not have a dedicated CAPEC entry, so CAPEC-1 is used as the best approximation.",
                  "The CVSS vector assumes the MISP instance is exposed over a network and that the login endpoint is reachable without prior authentication, which is the standard deployment model for MISP.",
                  "The patch does not include a test case demonstrating the bypass; the analysis is based solely on the code diff and commit message.",
                  "It is assumed that the MISP framework (CakePHP) does not independently enforce HTTP method restrictions at a middleware layer that would have already blocked non-POST/PUT methods to this endpoint; the patch implies such enforcement was absent."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "The attacker modifies a parameter of the authentication request (the HTTP method) to alter which security checks are executed, effectively modifying the authentication logic at runtime. This is the closest CAPEC to the observed bypass. Uncertainty: CAPEC-1 typically refers to modifying authentication logic in a more direct sense (e.g., altering credential checks), whereas here the modification is via the HTTP method header. However, no other CAPEC more precisely captures the act of altering a request attribute to skip authentication security controls."
                  }
                ],
                "commit": "ef4dc19c6d4f029c3173e5fafea75a94c127f8b5",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N \u2013 the login endpoint is network-accessible. AC:L \u2013 the attack requires only changing the HTTP method in a request; no race conditions or complex setup. AT:N \u2013 no manipulation of the target system is needed. PR:N \u2013 the login endpoint is accessible without prior authentication. UI:N \u2013 no user interaction required. VC:L \u2013 bypass of bruteforce protection enables credential brute-forcing, potentially exposing user credentials. VI:L \u2013 bypass of email OTP (2FA) and failure logging compromises the integrity of the authentication process and audit trail. VA:N \u2013 no direct denial-of-service impact. SC/SI/SA:N \u2013 no secondary system impact is evidenced.",
                "fixSummary": "The fix replaces the allowlist-style HTTP method checks (is POST or PUT) with a denylist approach (is NOT GET) in all three security-critical branches of the login() function. This ensures that every non-GET HTTP method\u2014regardless of whether it is POST, PUT, PATCH, DELETE, HEAD, OPTIONS, or any other\u2014triggers the bruteforce protection, email OTP verification, and login-failure logging code paths, closing the method-based bypass.",
                "generatedAt": "2026-09-21T12:30:02.387878Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "ff6f133b194fcd5c913990fce421bd56de7a12e488291a2ec7422d92284e71d8",
                "patchSummary": "Three conditional expressions in UsersController::login() were changed. (1) The bruteforce-protection guard changed from $this-\u003erequest-\u003eis([\u0027post\u0027,\u0027put\u0027]) to !$this-\u003erequest-\u003eis([\u0027get\u0027]). (2) The email-OTP guard changed from $this-\u003erequest-\u003eis(\u0027post\u0027) to !$this-\u003erequest-\u003eis([\u0027get\u0027]). (3) The login-failure handling guard changed from $this-\u003erequest-\u003eis(\u0027post\u0027) || $this-\u003erequest-\u003eis(\u0027put\u0027) to !$this-\u003erequest-\u003eis(\u0027get\u0027). All three changes invert the logic from an explicit allowlist of methods to a denylist that excludes only GET, so that any other HTTP method is treated as a state-changing login attempt subject to all security controls.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "ef4dc19c6d4f029c3173e5fafea75a94c127f8b5",
                    "patchSha256": "ff6f133b194fcd5c913990fce421bd56de7a12e488291a2ec7422d92284e71d8",
                    "source": "https://github.com/MISP/MISP/commit/ef4dc19c6.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/ef4dc19c6.patch",
                    "subject": "fix: [security] insufficient check on http methods for the"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/ef4dc19c6.patch",
                "subject": "fix: [security] insufficient check on http methods for the",
                "tagVersionBoundary": {
                  "commits_after_fix": 143,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-20",
                    "rationale": "The root cause is that the application validated the HTTP method using an incomplete allowlist (POST, PUT) rather than rejecting all non-safe methods. This is a classic improper input validation flaw where the set of accepted values was not exhaustive, allowing unexpected methods to bypass security logic."
                  },
                  {
                    "cweId": "CWE-285",
                    "rationale": "The security controls (bruteforce protection, OTP enforcement, failure logging) are authorization/authentication enforcement mechanisms that were improperly applied only to a subset of HTTP methods, effectively allowing unauthorized bypass of these controls."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20013"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94379",
    "datePublished": "2026-09-21T12:35:26.533Z",
    "dateReserved": "2026-09-21T12:35:24.635Z",
    "dateUpdated": "2026-09-21T15:21:01.092Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94374",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:21:38.785106Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T15:21:57.870Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Model/Event.php (processModuleResultsData / handleModuleResults)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Event.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module results, the code iterates over EventReport entries supplied in the resolved data and saves each one. Unlike the adjacent attribute and object processing loops, the report loop did not unset the client-supplied \u0027id\u0027 field before calling save(). Because the MISP EventReport model\u0027s create() method does not strip the id field, an authenticated user with permission to submit module results could include an \u0027id\u0027 value referencing an existing report belonging to a different event. Upon save(), the ORM would update that existing row rather than insert a new one, allowing the attacker to\u0026nbsp;\u003c/p\u003e\u2003-\u0026nbsp;read the content of another event\u0027s report by reparenting it into their own event\u003cbr\u003e\u2003-\u0026nbsp;overwrite the report\u0027s fields with attacker-controlled data\u003cbr\u003e\u003cdiv\u003e\u2003-\u0026nbsp;change the report\u0027s event_id to redirect ownership.\u0026nbsp;\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cp\u003eThis constitutes an authorization bypass through a user-controlled key, enabling cross-event data disclosure and integrity compromise. The vulnerability requires an authenticated session with the ability to invoke module result processing on an event.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "MISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module results, the code iterates over EventReport entries supplied in the resolved data and saves each one. Unlike the adjacent attribute and object processing loops, the report loop did not unset the client-supplied \u0027id\u0027 field before calling save(). Because the MISP EventReport model\u0027s create() method does not strip the id field, an authenticated user with permission to submit module results could include an \u0027id\u0027 value referencing an existing report belonging to a different event. Upon save(), the ORM would update that existing row rather than insert a new one, allowing the attacker to\u00a0\n\n\u2003-\u00a0read the content of another event\u0027s report by reparenting it into their own event\n\u2003-\u00a0overwrite the report\u0027s fields with attacker-controlled data\n\u2003-\u00a0change the report\u0027s event_id to redirect ownership.\u00a0\n\n\n\n\nThis constitutes an authorization bypass through a user-controlled key, enabling cross-event data disclosure and integrity compromise. The vulnerability requires an authenticated session with the ability to invoke module result processing on an event.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-472",
              "description": "CWE-472 External Control of Assumed-Immutable Web Parameter",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:25:02.628Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/4c1a03b20"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix adds an unset($report[\u0027id\u0027]) call in the EventReport processing loop within processModuleResultsData, immediately before the event_id assignment and save() call. This ensures that any client-supplied id field is stripped from the report data, forcing the ORM to perform an insert (new report) rather than an update (existing report), consistent with the existing behavior of the attribute and object loops in the same method.\u003c/p\u003e"
            }
          ],
          "value": "The fix adds an unset($report[\u0027id\u0027]) call in the EventReport processing loop within processModuleResultsData, immediately before the event_id assignment and save() call. This ensures that any client-supplied id field is stripped from the report data, forcing the ORM to perform an insert (new report) rather than an update (existing report), consistent with the existing behavior of the attribute and object loops in the same method."
        }
      ],
      "title": "MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events\u0027 Reports",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact affected and fixed MISP version numbers are not stated in the patch metadata; the tag boundary (v2.5.47, 53 commits after fix) suggests the fix landed after v2.5.47 but the precise fixed release is unspecified.",
                  "PR:L assumes that submitting module results is available to any authenticated user with write access to an event; if MISP requires a more restrictive role (e.g., admin or org admin), PR should be raised to H.",
                  "VC:L assumes the attacker can read only the specific report they target by id; if the reparenting exposes additional data (e.g., related attributes), the confidentiality impact could be higher.",
                  "CAPEC-126 (Parameter Tampering) is the closest available CAPEC; the actual technique is more precisely a mass-assignment / IDOR via unsanitized primary key, for which no dedicated CAPEC entry exists.",
                  "The Co-Authored-By line references an AI assistant (Claude Opus 4.8); it is credited as a tool rather than a human remediation developer."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The attacker tampers with the module-results payload by injecting an \u0027id\u0027 parameter that the application does not expect or sanitize, redirecting the save operation to an arbitrary existing report row. This is the closest CAPEC to the observed attack: manipulating a request parameter to alter application behavior and access an unauthorized object. The mapping is approximate because CAPEC-126 typically describes in-transit tampering, whereas here the parameter is included in the initial request body; however, no more specific CAPEC for mass-assignment IDOR exists in the CAPEC catalog."
                  }
                ],
                "commit": "4c1a03b200fc75854879897c9cfc33a86b965d11",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  }
                ],
                "cvssRationale": "AV:N \u2013 MISP is a network-accessible web application. AC:L \u2013 the attack requires only including an \u0027id\u0027 field in a normal module-results submission; no race condition or complex bypass is needed. AT:N \u2013 no prior user interaction or attack preparation beyond crafting the payload. PR:L \u2013 requires an authenticated user with permission to submit module results on an event (a common MISP role). UI:N \u2013 no victim interaction required. VC:L \u2013 the attacker can read the content of one specific report they target by id. VI:H \u2013 the attacker can overwrite all fields of the targeted report and change its event_id, fully compromising its integrity. VA:N \u2013 no availability impact. SC/SI/SA \u2013 no impact on adjacent systems; SI:H reflects the integrity compromise of the shared report data store.",
                "fixSummary": "The fix adds an unset($report[\u0027id\u0027]) call in the EventReport processing loop within processModuleResultsData, immediately before the event_id assignment and save() call. This ensures that any client-supplied id field is stripped from the report data, forcing the ORM to perform an insert (new report) rather than an update (existing report), consistent with the existing behavior of the attribute and object loops in the same method.",
                "generatedAt": "2026-09-21T12:19:38.677403Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "1079aff9d4e4710ba6c4ea950bcbbe2597411bfe7065efbc1bc9a5587f87a6c9",
                "patchSummary": "In app/Model/Event.php, within the foreach loop over $resolved_data[\u0027EventReport\u0027] in processModuleResultsData, a single line unset($report[\u0027id\u0027]); is inserted after $this-\u003eEventReport-\u003ecreate() and before $report[\u0027event_id\u0027] = $id. A four-line comment is added explaining that module-result import only creates reports and that stripping the client id prevents redirecting save() onto another event\u0027s report row. No other files or logic are modified.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "4c1a03b200fc75854879897c9cfc33a86b965d11",
                    "patchSha256": "1079aff9d4e4710ba6c4ea950bcbbe2597411bfe7065efbc1bc9a5587f87a6c9",
                    "source": "https://github.com/MISP/MISP/commit/4c1a03b20.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/4c1a03b20.patch",
                    "subject": "fix: [security] Strip the client id from module-result event"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/4c1a03b20.patch",
                "subject": "fix: [security] Strip the client id from module-result event",
                "tagVersionBoundary": {
                  "commits_after_fix": 53,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-639",
                    "rationale": "The attacker supplies an \u0027id\u0027 value in the module-results payload that the application uses as the primary key for the save() operation, redirecting the write to an object (report row) belonging to a different event. The user-controlled key bypasses the intended create-only semantics and grants unauthorized read/write access to another event\u0027s report."
                  },
                  {
                    "cweId": "CWE-472",
                    "rationale": "The \u0027id\u0027 field is assumed to be server-generated and immutable for new records, but the application accepts a client-supplied value and passes it directly to the ORM save() call, allowing the attacker to control which database row is affected."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20022"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94374",
    "datePublished": "2026-09-21T12:25:02.628Z",
    "dateReserved": "2026-09-21T12:25:00.527Z",
    "dateUpdated": "2026-09-21T15:21:57.870Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94373",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:22:19.064596Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T15:22:31.730Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/webroot/js/contextual_menu.js"
          ],
          "product": "MISP",
          "programFiles": [
            "app/webroot/js/contextual_menu.js"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "David Andre"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML \u0026lt;option\u0026gt; elements by assigning user-controllable values to the innerHTML property. Because innerHTML parses and renders HTML markup, any untrusted string supplied as the option text (value.text or value) is interpreted as live DOM content rather than plain text. An attacker who can influence the data rendered in the contextual menu can inject arbitrary HTML or JavaScript that executes in the victim\u0027s browser within the MISP application origin. This may allow session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML \u003coption\u003e elements by assigning user-controllable values to the innerHTML property. Because innerHTML parses and renders HTML markup, any untrusted string supplied as the option text (value.text or value) is interpreted as live DOM content rather than plain text. An attacker who can influence the data rendered in the contextual menu can inject arbitrary HTML or JavaScript that executes in the victim\u0027s browser within the MISP application origin. This may allow session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-12",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-12 DOM-based XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:16:47.877Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/b062698f2"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe vulnerability is remediated by replacing the unsafe innerHTML property assignments with the safe textContent property when setting the display text of dynamically created \u0026lt;option\u0026gt; elements. textContent inserts the value as plain text without parsing HTML, thereby neutralizing any injected markup or script.\u003c/p\u003e"
            }
          ],
          "value": "The vulnerability is remediated by replacing the unsafe innerHTML property assignments with the safe textContent property when setting the display text of dynamically created \u003coption\u003e elements. textContent inserts the value as plain text without parsing HTML, thereby neutralizing any injected markup or script."
        }
      ],
      "title": "MISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary (v2.5.47 with 137 commits after the fix), suggesting the fix landed shortly after v2.5.47; no explicit affected/fixed version strings are provided in the metadata.",
                  "PR:L assumes the attacker must be an authenticated MISP user to inject data that reaches the contextual menu; if an unauthenticated injection path exists, PR could be N.",
                  "UI:P assumes the victim must actively open or interact with the contextual menu for the XSS to trigger; if the menu renders automatically on page load, UI could be N.",
                  "The CAPEC-12 mapping is high-confidence based on the innerHTML-to-textContent pattern, but the exact data flow (which upstream field feeds value.text) is not visible in the patch.",
                  "AT:N assumes the attacker does not need to target a specific user\u0027s session; if the payload must be tailored to a particular user\u0027s view, AT could be P."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-12",
                    "rationale": "The vulnerability is a textbook DOM-based XSS: attacker-controlled data is written into the DOM via the innerHTML property, causing the browser to parse and execute injected markup/script. CAPEC-12 (DOM-based XSS) is the most precise CAPEC pattern. The mapping is high-confidence because the patch explicitly targets innerHTML-to-textContent in a client-side JS file, which is the defining characteristic of DOM-based XSS."
                  }
                ],
                "commit": "b062698f269996ffe3ceb23de78612d768a3bfe2",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The injection is straightforward once attacker-controlled data reaches the menu options. AT:N: No special targeting of a specific session state is required beyond the data being rendered. PR:L: The attacker must be authenticated to MISP to inject data that will be rendered in the contextual menu. UI:P: The victim must interact with the contextual menu (e.g., open it) for the injected content to execute. VC/VI/VA:N: The MISP server itself is not directly compromised. SC:H/SI:H: The victim\u0027s browser (subsequent component) suffers high confidentiality and integrity impact via script execution in the MISP origin. SA:N: Availability of the browser is not impacted.",
                "draft": false,
                "fixSummary": "The vulnerability is remediated by replacing the unsafe innerHTML property assignments with the safe textContent property when setting the display text of dynamically created \u003coption\u003e elements. textContent inserts the value as plain text without parsing HTML, thereby neutralizing any injected markup or script.",
                "generatedAt": "2026-09-21T12:08:13.810140Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "843bc32d5dc337c115c79558f499550f4659a063b250fca808e32725cd586c9f",
                "patchSummary": "In app/webroot/js/contextual_menu.js, within the ContextualMenu class, two lines that set option.innerHTML (one for object-valued entries using value.text and one for scalar entries using value) are changed to option.textContent. No other logic, event handlers, or surrounding code is modified. The change is limited to the two assignment statements in the option-population loop.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "b062698f269996ffe3ceb23de78612d768a3bfe2",
                    "patchSha256": "843bc32d5dc337c115c79558f499550f4659a063b250fca808e32725cd586c9f",
                    "source": "https://github.com/MISP/MISP/commit/b062698f2.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/b062698f2.patch",
                    "subject": "fix: [xss] via JS innerHTML - as reported by David Andre and"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/b062698f2.patch",
                "subject": "fix: [xss] via JS innerHTML - as reported by David Andre and",
                "tagVersionBoundary": {
                  "commits_after_fix": 137,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "The patch replaces innerHTML with textContent to prevent HTML/JS injection into the DOM, which is the canonical remediation for DOM-based XSS (CWE-79). The specific sub-type is DOM-based XSS via unsafe DOM API usage (innerHTML), but CWE-79 is the narrowest standard identifier that covers this."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20033"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94373",
    "datePublished": "2026-09-21T12:16:47.877Z",
    "dateReserved": "2026-09-21T12:16:44.364Z",
    "dateUpdated": "2026-09-21T15:22:31.730Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94372",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:22:49.873477Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T15:23:04.003Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "Galaxies index (default theme)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/View/Galaxies/index.ctp"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a stored cross-site scripting (XSS) vulnerability in the default theme\u0027s Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the default theme, these sample tag names were inserted into the HTML output without HTML-entity encoding. A user with tag-editor privileges could craft a malicious misp-galaxy tag containing arbitrary script. When a site administrator subsequently viewed the Galaxies index page, the crafted tag content was interpreted as executable markup in the administrator\u0027s browser session, enabling the attacker to read session data, perform actions on behalf of the administrator, or otherwise compromise the administrator\u0027s browser context. The Overmind theme already applied HTML escaping to the same values and was not affected. The vulnerability requires the attacker to possess tag-editor-level access to create the crafted tag and requires the victim (a site administrator) to view the Galaxies index page in the default theme. The impact is limited to the administrator\u0027s browser session and does not directly compromise the MISP server process.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a stored cross-site scripting (XSS) vulnerability in the default theme\u0027s Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the default theme, these sample tag names were inserted into the HTML output without HTML-entity encoding. A user with tag-editor privileges could craft a malicious misp-galaxy tag containing arbitrary script. When a site administrator subsequently viewed the Galaxies index page, the crafted tag content was interpreted as executable markup in the administrator\u0027s browser session, enabling the attacker to read session data, perform actions on behalf of the administrator, or otherwise compromise the administrator\u0027s browser context. The Overmind theme already applied HTML escaping to the same values and was not affected. The vulnerability requires the attacker to possess tag-editor-level access to create the crafted tag and requires the victim (a site administrator) to view the Galaxies index page in the default theme. The impact is limited to the administrator\u0027s browser session and does not directly compromise the MISP server process.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Improper Neutralization of Input"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:02:17.104Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/ce10436ae"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix applies CakePHP\u0027s h() HTML-encoding function to each sample tag name before it is interpolated into the HTML notice. This ensures that any angle brackets, quotes, or ampersands contained in user-supplied tag names are rendered as inert HTML entities, preventing script execution in the administrator\u0027s browser.\u003c/p\u003e"
            }
          ],
          "value": "The fix applies CakePHP\u0027s h() HTML-encoding function to each sample tag name before it is interpolated into the HTML notice. This ensures that any angle brackets, quotes, or ampersands contained in user-supplied tag names are rendered as inert HTML entities, preventing script execution in the administrator\u0027s browser."
        }
      ],
      "title": "Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The tag_version_boundary (v2.5.47, 45 commits after fix) is interpreted as the fix landing after v2.5.47; exact affected version range is not explicitly stated in the patch and is marked as less_than 2.5.47 with status affected, but this is an inference.",
                  "The \u0027tag editor\u0027 role is assumed to be a lower-privilege role than site admin in MISP\u0027s RBAC model, justifying PR:L.",
                  "UI:P (Passive) is used because the victim only needs to load the Galaxies index page; no click or explicit interaction with the malicious content is required. The previous UI:R value was invalid in CVSS v4.0 (valid values: N, P, A).",
                  "CAPEC-1 is the closest available pattern; no CAPEC specifically names stored XSS, so the mapping is approximate.",
                  "The Overmind theme is stated in the commit message as already escaping these values; it is assumed unaffected but no patch evidence for it is provided.",
                  "The Co-Authored-By line for Claude Opus 4.8 is treated as a remediation developer credit per the supplied metadata; it is unclear whether this represents an AI-assisted contribution or a human developer using AI tooling."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "CAPEC-1 is the closest available pattern describing an attacker supplying malicious input that is not properly neutralized before being used in a context where it is interpreted (here, HTML). No dedicated CAPEC for stored XSS exists in the catalog; CAPEC-1 is the narrowest defensible match for an output-encoding failure. Uncertainty: the pattern is broad and does not specifically name XSS, but it is the best available mapping for an input-escaping deficiency."
                  }
                ],
                "commit": "ce10436ae989a4580a35ada1557ff9d9107f43ed",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  }
                ],
                "cvssRationale": "AV:N: exploited over the network via the web UI. AC:L: the attacker simply creates a tag with a script payload; no race or complex condition. AT:N: no attack-target manipulation required. PR:L: the attacker needs tag-editor privileges (lower than admin) to create the crafted misp-galaxy tag. UI:P: the victim (site admin) must passively view the Galaxies index page for the script to execute. VC/VI/VA:N: the MISP application process itself is not directly compromised; the impact is on the victim\u0027s browser session. SC:H: the attacker can read the admin\u0027s session cookies, tokens, and data visible in the browser. SI:H: the attacker can perform authenticated actions as the admin via the compromised session. SA:N: no meaningful availability impact on the scope component.",
                "draft": false,
                "fixSummary": "The fix applies CakePHP\u0027s h() HTML-encoding function to each sample tag name before it is interpolated into the HTML notice. This ensures that any angle brackets, quotes, or ampersands contained in user-supplied tag names are rendered as inert HTML entities, preventing script execution in the administrator\u0027s browser.",
                "generatedAt": "2026-09-21T11:56:43.983892Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 6,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 4
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "c629d71fb493dcf9ae82dd54bd424cd4335e7638f3db46ec4c0ae90695abb535",
                "patchSummary": "In app/View/Galaxies/index.ctp, two lines that built $tagSampleHTML via sprintf and implode over the unknownCustomClustersSamples and unknownDefaultClustersSamples arrays were modified to wrap each array with array_map(\u0027h\u0027, ...) before the implode. This causes every element to pass through CakePHP\u0027s h() helper (HTML entity encoding) prior to concatenation into the \u003cli\u003e list markup. No other logic, routing, or authorization changes were made.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "ce10436ae989a4580a35ada1557ff9d9107f43ed",
                    "patchSha256": "c629d71fb493dcf9ae82dd54bd424cd4335e7638f3db46ec4c0ae90695abb535",
                    "source": "https://github.com/MISP/MISP/commit/ce10436ae.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/ce10436ae.patch",
                    "subject": "fix: [security] Escape unknown-cluster samples in the"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/ce10436ae.patch",
                "subject": "fix: [security] Escape unknown-cluster samples in the",
                "tagVersionBoundary": {
                  "commits_after_fix": 45,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "User-controlled tag names (misp-galaxy tags created by a tag editor) are inserted into an HTML page without output encoding, allowing script injection. This is a classic stored XSS (CWE-79) where the dangerous data is persisted in the database and rendered unsafely in a server-side template."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20002"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94372",
    "datePublished": "2026-09-21T12:02:17.104Z",
    "dateReserved": "2026-09-21T12:02:13.614Z",
    "dateUpdated": "2026-09-21T15:23:04.003Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94404",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T14:34:58.261364Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T14:48:16.245Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "AttributesController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/AttributesController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user\u2019s browser without that user knowingly approving the change.\u003c/p\u003e\u003cp\u003eThe affected function did not properly enforce MISP\u2019s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.\u003c/p\u003e\u003cp\u003eIf successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.\u003c/p\u003e\u003cp\u003eThe attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.\u003c/p\u003e\u003cp\u003eThe main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.\u003c/p\u003eVersion affected: \u0026lt;2.5.47"
            }
          ],
          "value": "MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user\u2019s browser without that user knowingly approving the change.\n\nThe affected function did not properly enforce MISP\u2019s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.\n\nIf successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.\n\nThe attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.\n\nThe main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-124",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-124 Cross-Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T13:50:46.410Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/dfbae33f9"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token.\u003c/p\u003e"
            }
          ],
          "value": "The editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token."
        }
      ],
      "title": "MISP CSRF vulnerability allows unauthorized attribute modification",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary (v2.5.47 with 7 commits after the fix); no explicit \u0027affected\u0027 or \u0027fixed\u0027 version strings are provided in the metadata, so the exact version boundary is approximate.",
                  "UI:P (Passive) is assumed because the commit message describes a \u0027cross-site form post\u0027 that auto-submits when the victim\u0027s browser loads the attacker\u0027s page; if the attack requires the victim to explicitly click a link or submit a form, UI:A would be more appropriate.",
                  "PR:N is assumed because the attacker does not need their own MISP account; the victim\u0027s authenticated session cookie is sufficient. If MISP deployments require additional authentication factors (e.g., MFA) that would block a cross-site form post, the effective exploitability may be lower.",
                  "The CAPEC-124 mapping is the closest standard pattern for CSRF; no more specific CAPEC exists for the CakePHP unlockedActions bypass mechanism.",
                  "The Co-Authored-By AI tool is included as a \u0027tool\u0027 credit based on explicit commit metadata; it is not a human contributor."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-124",
                    "rationale": "The patch description explicitly states that a cross-site form post carrying the victim\u0027s session cookie could rewrite attribute fields. This is the canonical CSRF attack pattern: an attacker induces a victim\u0027s browser to send an authenticated request to a target application without the victim\u0027s knowledge or consent. CAPEC-124 is the most direct and specific match."
                  }
                ],
                "commit": "dfbae33f9a93bf127fae115bc6cd1a9e03d028e9",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The attack is delivered over the network via a malicious web page. AC:L: Crafting a CSRF form is straightforward and requires no race conditions or special timing. AT:N: The target MISP instance is not under the attacker\u0027s control. PR:N: The attacker needs no account on MISP; the victim\u0027s existing session is sufficient. UI:P: The victim must passively load the attacker\u0027s page (e.g., visit a link), which triggers the auto-submitting form; no explicit click or form submission by the victim is required. VC:N: The attack modifies data but does not disclose confidential information. VI:H: The attacker can alter attribute values, types, categories, distribution, and timestamps, corrupting threat-intelligence data for all users. VA:N: No denial-of-service impact is indicated. SC/SI/SA:N: No secondary impacts on other systems are evidenced.",
                "fixSummary": "The editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token.",
                "generatedAt": "2026-09-21T13:38:54.473662Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "beb65b8daaa1d2e649f1178cc7f2c774f4ba7e75a13cc000524eef566c4545c8",
                "patchSummary": "In app/Controller/AttributesController.php, the string \u0027editField\u0027 is added to the _csrfTokenHeaderOnly() call in beforeFilter(), enabling header-or-body CSRF token validation for that action. Simultaneously, the line adding \u0027editField\u0027 to $this-\u003eSecurity-\u003eunlockedActions[] is removed, so the action is no longer exempt from CSRF checks. A comment block is added explaining that both the Overmind index (token in X-CSRF-Token header) and legacy inline forms (token in body) already carry a valid token, so only the unsatisfiable field-hash check is dropped.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "dfbae33f9a93bf127fae115bc6cd1a9e03d028e9",
                    "patchSha256": "beb65b8daaa1d2e649f1178cc7f2c774f4ba7e75a13cc000524eef566c4545c8",
                    "source": "https://github.com/MISP/MISP/commit/dfbae33f9.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/dfbae33f9.patch",
                    "subject": "fix: [security] Keep the CSRF check on the inline attribute"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/dfbae33f9.patch",
                "subject": "fix: [security] Keep the CSRF check on the inline attribute",
                "tagVersionBoundary": {
                  "commits_after_fix": 7,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-352",
                    "rationale": "The editField action was placed in unlockedActions, which explicitly bypassed the CSRF token check. This allowed a cross-site form post to modify attribute data using only the victim\u0027s session cookie, a textbook CSRF weakness."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20043"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94404",
    "datePublished": "2026-09-21T13:50:46.410Z",
    "dateReserved": "2026-09-21T13:50:44.676Z",
    "dateUpdated": "2026-09-21T14:48:16.245Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94401",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T14:35:17.511576Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T14:48:16.804Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Model/Event.php (addMISPExportFile)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Event.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services.\u003c/p\u003e\u003cp\u003eWhen importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify data could upload a file containing a local file path or a web address instead.\u003c/p\u003e\u003cp\u003eIf a local file path was supplied, MISP could read that file from the server. If a URL was supplied, MISP could make a request to that address, including systems that may only be reachable from inside the organization\u2019s network.\u003c/p\u003e\u003cp\u003eThe vulnerability could therefore expose sensitive local files and allow unauthorized requests to internal services.\u003c/p\u003e\u003cp\u003eExploitation required a valid MISP account with modify permissions, but no additional user interaction was needed.\u003c/p\u003eVersion affected: \u0026lt;2.5.47"
            }
          ],
          "value": "MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services.\n\nWhen importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify data could upload a file containing a local file path or a web address instead.\n\nIf a local file path was supplied, MISP could read that file from the server. If a URL was supplied, MISP could make a request to that address, including systems that may only be reachable from inside the organization\u2019s network.\n\nThe vulnerability could therefore expose sensitive local files and allow unauthorized requests to internal services.\n\nExploitation required a valid MISP account with modify permissions, but no additional user interaction was needed.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Server Side Request Forgery"
            }
          ]
        },
        {
          "capecId": "CAPEC-2",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-2 Parameter Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73 External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T13:36:13.066Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/d5f247b91"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces two defensive measures in addMISPExportFile(): (1) a pre-parse validation that rejects any uploaded content not containing an XML document marker (the \u0027\u0026lt;\u0027 character), preventing path or URL strings from reaching the XML parser; and (2) an explicit readFile =\u0026gt; false option passed to Xml::build(), which disables the library\u0027s ability to interpret the input as a file path or URL to be read or fetched. Together these changes ensure that only genuine XML document content is parsed and that no server-side file access or network request is triggered by user-supplied data.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces two defensive measures in addMISPExportFile(): (1) a pre-parse validation that rejects any uploaded content not containing an XML document marker (the \u0027\u003c\u0027 character), preventing path or URL strings from reaching the XML parser; and (2) an explicit readFile =\u003e false option passed to Xml::build(), which disables the library\u0027s ability to interpret the input as a file path or URL to be read or fetched. Together these changes ensure that only genuine XML document content is parsed and that no server-side file access or network request is triggered by user-supplied data."
        }
      ],
      "title": "MISP Arbitrary Local File Read and SSRF via MISP Export Upload",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The commit message states the vulnerability was \u0027found during the internal review, not externally reported,\u0027 so no external finder or reporter credit is assigned. The internal reviewer\u0027s identity is not specified in the patch metadata.",
                  "The affected version range is inferred from the tag_version_boundary (v2.5.47 with 40 commits after the fix), but exact affected and fixed version numbers are not stated in the patch. The boundary is recorded as a reference point only.",
                  "PR:L assumes that perm_modify is a non-administrative, commonly granted role in MISP deployments. If perm_modify is equivalent to full administrative access in some configurations, PR could be elevated to PR:H.",
                  "The CAPEC-2 mapping is a broader, secondary pattern included for completeness; CAPEC-126 is the primary and most specific match. The uncertainty is noted in the CAPEC-2 rationale.",
                  "The commit message references an operator-precedence issue in Xml::build()\u0027s readFile guard not covering the https branch. This is taken as evidence from the commit message and patch comments; the actual Xml utility source is not included in the patch, so the exact mechanism of the https bypass is assumed rather than verified.",
                  "CVSS SC:H assumes the SSRF can reach internal services with sensitive data. If the deployment restricts outbound network access, SC could be reduced."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The patch explicitly describes the SSRF vector: an .xml upload containing a URL causes MISP to fetch that URL and import the result. CAPEC-126 describes an attacker manipulating a server-side application to make it issue requests to unintended targets, which is exactly the attack demonstrated here. The local-file-read aspect is a secondary manifestation of the same root cause (unvalidated input passed to a function that resolves locators) and is subsumed by the SSRF pattern in this context."
                  },
                  {
                    "capecId": "CAPEC-2",
                    "rationale": "The attacker manipulates the content parameter of the MISP export upload to supply a file path or URL instead of a valid XML document. CAPEC-2 covers the general technique of altering application parameters to trigger unintended behavior. This is a secondary mapping; CAPEC-126 is the more specific and primary pattern. The uncertainty is that CAPEC-2 is broader and less precise than CAPEC-126 for this specific vulnerability."
                  }
                ],
                "commit": "d5f247b91ad3e8ea86feaaa587bf0466c95ea996",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: exploitation occurs over the network via the MISP web interface. AC:L: the attack is deterministic; uploading a file with a path or URL as content reliably triggers the read/fetch. AT:N: no special target-side conditions are required. PR:L: the attacker needs an authenticated account with perm_modify (a non-privileged but authenticated role). UI:N: the attacker performs the upload autonomously; no victim interaction is needed. VC:H: arbitrary local file read exposes sensitive server data (credentials, configs, keys). VI:N: the imported data is stored as an event but does not corrupt application state or logic. VA:N: no denial-of-service impact is indicated. SC:H: the SSRF component allows the attacker to read responses from internal services (metadata endpoints, admin panels, etc.), impacting subsequent-component confidentiality. SI:N and SA:N: no evidence of integrity or availability impact on subsequent components from the patch evidence.",
                "fixSummary": "The fix introduces two defensive measures in addMISPExportFile(): (1) a pre-parse validation that rejects any uploaded content not containing an XML document marker (the \u0027\u003c\u0027 character), preventing path or URL strings from reaching the XML parser; and (2) an explicit readFile =\u003e false option passed to Xml::build(), which disables the library\u0027s ability to interpret the input as a file path or URL to be read or fetched. Together these changes ensure that only genuine XML document content is parsed and that no server-side file access or network request is triggered by user-supplied data.",
                "generatedAt": "2026-09-21T13:28:43.719596Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 6,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "004f65b4d416b8e01f8b713a982a9b4d808e454c40cd74cc94d36137eb1b2845",
                "patchSummary": "In app/Model/Event.php, the single line calling Xml::toArray(Xml::build($data)) is replaced with a guard clause that throws an Exception if strpos($data, \u0027\u003c\u0027) === false, followed by Xml::toArray(Xml::build($data, [\u0027readFile\u0027 =\u003e false])). Nine lines are added (including a four-line explanatory comment) and one line is removed. No other files are modified.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "d5f247b91ad3e8ea86feaaa587bf0466c95ea996",
                    "patchSha256": "004f65b4d416b8e01f8b713a982a9b4d808e454c40cd74cc94d36137eb1b2845",
                    "source": "https://github.com/MISP/MISP/commit/d5f247b91.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/d5f247b91.patch",
                    "subject": "fix: [security] Refuse a MISP export upload whose content is"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/d5f247b91.patch",
                "subject": "fix: [security] Refuse a MISP export upload whose content is",
                "tagVersionBoundary": {
                  "commits_after_fix": 40,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-918",
                    "rationale": "The primary and most severe impact is that an attacker-supplied URL in the uploaded file body causes the MISP server to issue an HTTP request to an arbitrary internal or external address and import the response. This is a textbook SSRF: user-controlled input is used as a network request target by the server."
                  },
                  {
                    "cweId": "CWE-73",
                    "rationale": "The secondary impact is that a user-supplied local file path in the uploaded file body is passed to Xml::build() which reads that file from the server\u0027s filesystem. The attacker controls the file path that the server reads, matching CWE-73. CWE-22 (Path Traversal) was considered but the input is not a relative traversal sequence; it is an absolute path chosen by the attacker, making CWE-73 the more precise mapping."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20056"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94401",
    "datePublished": "2026-09-21T13:36:13.066Z",
    "dateReserved": "2026-09-21T13:36:11.048Z",
    "dateUpdated": "2026-09-21T14:48:16.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94394",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T14:35:25.970564Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T14:48:16.963Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "ObjectReferencesController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/ObjectReferencesController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user.\u003cbr\u003e\u003cbr\u003e\u003cp\u003eBecause of this, someone who can view an event could potentially access attributes or objects inside that event that were meant to be restricted to a specific sharing group or distribution level.\u003c/p\u003eThe vulnerability affects authenticated users who are not site administrators and who already have access to an event containing more restricted data.\u003cbr\u003e\u003cbr\u003eThe main impact is that users may be able to view sensitive attribute values, object details, or related object data that they should not normally be allowed to see.\u003cbr\u003e"
            }
          ],
          "value": "When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user.\n\nBecause of this, someone who can view an event could potentially access attributes or objects inside that event that were meant to be restricted to a specific sharing group or distribution level.\n\nThe vulnerability affects authenticated users who are not site administrators and who already have access to an event containing more restricted data.\n\nThe main impact is that users may be able to view sensitive attribute values, object details, or related object data that they should not normally be allowed to see."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-109",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-109 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T13:25:40.360Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/f36634e57"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces granular authorization checks in the ObjectReferencesController add() method. For non-site-admin users, the query conditions for attributes, objects, and object attributes are now augmented with OR clauses that restrict results to: (1) entities belonging to the user\u0027s own event, (2) entities with unrestricted distribution levels (1, 2, 3, 5), or (3) entities with distribution level 4 whose sharing_group_id is in the user\u0027s authorized sharing group list. This ensures that only data the user is explicitly authorized to see under MISP\u0027s distribution and sharing-group model is included in the object reference operation.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces granular authorization checks in the ObjectReferencesController add() method. For non-site-admin users, the query conditions for attributes, objects, and object attributes are now augmented with OR clauses that restrict results to: (1) entities belonging to the user\u0027s own event, (2) entities with unrestricted distribution levels (1, 2, 3, 5), or (3) entities with distribution level 4 whose sharing_group_id is in the user\u0027s authorized sharing group list. This ensures that only data the user is explicitly authorized to see under MISP\u0027s distribution and sharing-group model is included in the object reference operation."
        }
      ],
      "title": "MISP ObjectReferencesController: Granular Distribution and Sharing Group Restrictions Bypassed When Adding Object References",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact affected and fixed version numbers are not specified in the patch metadata. The tag_version_boundary indicates the fix commit is 140 commits after v2.5.47, but the precise release version containing the fix is unknown.",
                  "The CAPEC-109 (Parameter Tampering) mapping is the closest available match but is not a perfect fit; the vulnerability is more precisely a missing granular authorization check rather than parameter manipulation. No CAPEC specifically models broken sub-entity access control.",
                  "The CVSS SC:H rating assumes that the exposed attribute/object data constitutes sensitive information (e.g., IOCs, malware indicators, threat intelligence) whose unauthorized disclosure is a significant confidentiality impact. If the data is considered low-sensitivity, SC:L may be more appropriate.",
                  "The vulnerability requires the attacker to already have event-level access; it does not grant access to events the user cannot see. The bypass is limited to granular restrictions within an already-accessible event.",
                  "The patch only addresses the add() method in ObjectReferencesController; other methods or controllers with similar patterns may or may not be affected, but no evidence of additional affected code paths is present in this patch."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-109",
                    "rationale": "The closest plausible CAPEC is Parameter Tampering. An authenticated user supplies an objectId parameter to the add() endpoint, and the application fails to enforce proper authorization on the sub-entities (attributes, objects, object attributes) associated with that object. The user effectively \u0027tampers\u0027 with the scope of accessible data by leveraging event-level access to reach restricted sub-entities. This is not a perfect match because the user is not modifying a parameter to an invalid value but rather exploiting the absence of a check on a valid parameter\u0027s sub-resources. No CAPEC specifically models \u0027broken granular access control\u0027 or \u0027insecure direct object reference at sub-entity level,\u0027 making CAPEC-109 the best available approximation."
                  }
                ],
                "commit": "f36634e57b93ad9daa3ab9530b76b9e5cba796e2",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The attack requires no special conditions beyond having a valid account with event-level access; no race conditions or complex setup needed. AT:N: No manipulation of a separate attack target is required. PR:L: The attacker needs a low-privilege authenticated account (any non-site-admin user with access to an event containing restricted attributes/objects). UI:N: No victim interaction is required; the attacker simply calls the API endpoint. VC:N/VI:N/VA:N: The MISP server itself (the vulnerable component) is not compromised in its own confidentiality, integrity, or availability. SC:H: The resource impact is high because restricted attribute values, object metadata, and object-attribute data that are explicitly gated by distribution levels and sharing groups are exposed to an unauthorized user. SI:N: No integrity impact on the data. SA:N: No safety impact.",
                "fixSummary": "The fix introduces granular authorization checks in the ObjectReferencesController add() method. For non-site-admin users, the query conditions for attributes, objects, and object attributes are now augmented with OR clauses that restrict results to: (1) entities belonging to the user\u0027s own event, (2) entities with unrestricted distribution levels (1, 2, 3, 5), or (3) entities with distribution level 4 whose sharing_group_id is in the user\u0027s authorized sharing group list. This ensures that only data the user is explicitly authorized to see under MISP\u0027s distribution and sharing-group model is included in the object reference operation.",
                "generatedAt": "2026-09-21T13:15:28.001598Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "2688fca1334e3016b8b885ce926749f8d47e49d7b657cf38f7b2edcd6eaf6cf0",
                "patchSummary": "In app/Controller/ObjectReferencesController.php, the add() method is modified to build dynamic condition arrays ($attributeConditions, $objectConditions, $objectAttributeConditions) that incorporate the current user\u0027s role and authorized sharing group IDs. For non-site-admin users, each condition array gains an OR clause filtering by event ownership, distribution levels (1,2,3,5), or distribution level 4 with a matching sharing_group_id from the user\u0027s authorized IDs. These condition arrays replace the previously hardcoded minimal conditions (deleted=0, object_id=0) in the Contain clauses for Attribute, Object, and nested Object.Attribute queries. The user\u0027s authorized sharing group IDs are obtained via SharingGroup-\u003eauthorizedIds($user).",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "f36634e57b93ad9daa3ab9530b76b9e5cba796e2",
                    "patchSha256": "2688fca1334e3016b8b885ce926749f8d47e49d7b657cf38f7b2edcd6eaf6cf0",
                    "source": "https://github.com/MISP/MISP/commit/f36634e57.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/f36634e57.patch",
                    "subject": "fix: [security] Extended event granular restrictions ignored"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/f36634e57.patch",
                "subject": "fix: [security] Extended event granular restrictions ignored",
                "tagVersionBoundary": {
                  "commits_after_fix": 140,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The ObjectReferencesController add() method was missing authorization checks for granular distribution-level and sharing-group restrictions on attributes, objects, and object attributes. Only event-level access was verified, while the sub-entity level access controls (distribution levels 1-5, sharing group membership) were entirely absent from the query conditions. This is a classic missing authorization check at a finer granularity than what was enforced."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20106"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94394",
    "datePublished": "2026-09-21T13:25:40.360Z",
    "dateReserved": "2026-09-21T13:25:38.483Z",
    "dateUpdated": "2026-09-21T14:48:16.963Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94393",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:18:01.147790Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T15:18:17.855Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Model/EventReport.php"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/EventReport.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "David Andr\u00e9"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003c/div\u003e\u003cp\u003eWhen a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event.\u003c/p\u003e\u003cp\u003eAs a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report\u2019s UUID. Once moved, they could view and change information that they were not originally allowed to access.\u003c/p\u003e\u003cp\u003eThe vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID.\u003c/p\u003e\u003cp\u003eThe main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP\u2019s normal access restrictions.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e\u003cdiv\u003e\u003c/div\u003e"
            }
          ],
          "value": "When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event.\n\nAs a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report\u2019s UUID. Once moved, they could view and change information that they were not originally allowed to access.\n\nThe vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID.\n\nThe main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP\u2019s normal access restrictions.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-174",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-174 Exploiting Incorrectly Handled Edge Cases"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T13:14:00.619Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/43665b9bb"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix adds an ownership check in editReport: before adopting an existing report found by UUID, the code now verifies that the report\u0027s event_id matches the event being edited. If the UUID resolves to a report belonging to a different event, the operation is rejected with an error message, preventing cross-event reparenting, unauthorized read, and unauthorized overwrite of reports.\u003c/p\u003e"
            }
          ],
          "value": "The fix adds an ownership check in editReport: before adopting an existing report found by UUID, the code now verifies that the report\u0027s event_id matches the event being edited. If the UUID resolves to a report belonging to a different event, the operation is rejected with an error message, preventing cross-event reparenting, unauthorized read, and unauthorized overwrite of reports."
        }
      ],
      "title": "MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary (v2.5.47, 56 commits after fix); the exact first affected and first fixed release versions are not stated in the patch and are marked unspecified.",
                  "PR:L assumes the attacker needs at minimum editor-level access to one event; the patch does not specify whether viewer-level access could also trigger the code path, but the commit message explicitly references \u0027an event editor\u0027.",
                  "CAPEC-174 is selected as the closest available attack pattern; no CAPEC entry specifically covers IDOR or broken object reference resolution, so the mapping is approximate.",
                  "The CVSS sub-component impact (SC:H, SI:H) assumes the event report data constitutes a distinct data asset whose confidentiality and integrity are the primary impact, rather than the MISP application\u0027s own state.",
                  "The commit date (2026-09-16) and tag boundary are taken at face value from the supplied metadata; no independent verification of release timing was performed."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-174",
                    "rationale": "The edge case of a UUID belonging to a different event was not handled: the code assumed any UUID found in the global table belonged to the current event. The attacker exploits this unhandled edge case to reparent a foreign report. This is the closest CAPEC; a more specific \u0027IDOR\u0027 or \u0027broken object reference\u0027 CAPEC does not exist in the CAPEC catalog, so CAPEC-174 is the best available match."
                  }
                ],
                "commit": "43665b9bb6bd39af0db1f38e608bdf2cb84b9dec",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  },
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "David Andr\u00e9"
                  },
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: the attacker only needs to supply a known/guessed UUID in a standard edit request; no race or complex condition. AT:N: no manipulation of the target environment is required. PR:L: the attacker must be an authenticated user with editor role on at least one event. UI:N: no victim interaction is needed. VC:N/VI:N/VA:N: the MISP application itself (its configuration, credentials, availability) is not directly impacted. SC:H: the attacker gains read access to private report data in events they cannot otherwise see. SI:H: the attacker can overwrite and modify report data belonging to other events. SA:N: no safety-system impact.",
                "fixSummary": "The fix adds an ownership check in editReport: before adopting an existing report found by UUID, the code now verifies that the report\u0027s event_id matches the event being edited. If the UUID resolves to a report belonging to a different event, the operation is rejected with an error message, preventing cross-event reparenting, unauthorized read, and unauthorized overwrite of reports.",
                "generatedAt": "2026-09-21T13:01:16.364280Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "2306bd95d16b9c00582997897aa9181253364082a09589640fce576a03beafb4",
                "patchSummary": "In app/Model/EventReport.php, the editReport method\u0027s else-branch (handling an existing report found by UUID) now includes an 11-line guard: it compares (string)$existingReport[\u0027EventReport\u0027][\u0027event_id\u0027] against (string)$eventId and, on mismatch, appends an error string and returns early, preventing the subsequent assignment of the foreign report\u0027s ID to the current event\u0027s report record.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "43665b9bb6bd39af0db1f38e608bdf2cb84b9dec",
                    "patchSha256": "2306bd95d16b9c00582997897aa9181253364082a09589640fce576a03beafb4",
                    "source": "https://github.com/MISP/MISP/commit/43665b9bb.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/43665b9bb.patch",
                    "subject": "fix: [security] Refuse to adopt an event report that belongs"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/43665b9bb.patch",
                "subject": "fix: [security] Refuse to adopt an event report that belongs",
                "tagVersionBoundary": {
                  "commits_after_fix": 56,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-639",
                    "rationale": "The report UUID is a user-controlled key resolved globally without scoping to the caller\u0027s event context. The system failed to verify that the referenced object (report) belongs to the event the caller is authorized to edit, allowing cross-event access."
                  },
                  {
                    "cweId": "CWE-284",
                    "rationale": "The broader category applies: MISP\u0027s per-event access control model was bypassed because the editReport path did not enforce that a report UUID maps to the same event the caller is operating on."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20057"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94393",
    "datePublished": "2026-09-21T13:14:00.619Z",
    "dateReserved": "2026-09-21T13:13:54.299Z",
    "dateUpdated": "2026-09-21T15:18:17.855Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94383",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T14:37:12.233579Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T14:48:17.369Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "WorkflowModules/action/Module_blocklist_action"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/WorkflowModules/action/Module_blocklist_action.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename() to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary extension that would be placed in the MISP export directory. If the underlying web server is configured to interpret and execute scripts from that directory, the resulting file could be invoked, leading to arbitrary code execution in the context of the web server process.\u003c/p\u003e\u003cp\u003eThe vulnerability requires the attacker to hold site-administrator privileges within MISP, as the blocklist workflow module is restricted to that role. No additional user interaction is required beyond triggering the workflow action with a crafted filename parameter. The impact is full compromise of the MISP server\u0027s confidentiality, integrity, and availability, as arbitrary script execution grants the attacker the same privileges as the web server user.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename() to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary extension that would be placed in the MISP export directory. If the underlying web server is configured to interpret and execute scripts from that directory, the resulting file could be invoked, leading to arbitrary code execution in the context of the web server process.\n\nThe vulnerability requires the attacker to hold site-administrator privileges within MISP, as the blocklist workflow module is restricted to that role. No additional user interaction is required beyond triggering the workflow action with a crafted filename parameter. The impact is full compromise of the MISP server\u0027s confidentiality, integrity, and availability, as arbitrary script execution grants the attacker the same privileges as the web server user.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-170",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-170 File Upload"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:52:03.355Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/e5a943178"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe vulnerability is remediated by enforcing a strict whitelist of allowed file extensions (txt, list, blocklist, csv) on the blocklist filename parameter before the file is processed. Any filename with an extension outside this whitelist is rejected with an error, preventing an attacker from placing files with executable or dangerous extensions (e.g., .php, .phtml) into the MISP export directory where they could be interpreted by the web server.\u003c/p\u003e"
            }
          ],
          "value": "The vulnerability is remediated by enforcing a strict whitelist of allowed file extensions (txt, list, blocklist, csv) on the blocklist filename parameter before the file is processed. Any filename with an extension outside this whitelist is rejected with an error, preventing an attacker from placing files with executable or dangerous extensions (e.g., .php, .phtml) into the MISP export directory where they could be interpreted by the web server."
        }
      ],
      "title": "MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The commit message states \u0027site admin only\u0027, which is taken as evidence that the vulnerable workflow module requires MISP site-administrator privileges. The exact privilege model and whether lower-privilege roles could reach this code path is not confirmed by the patch alone.",
                  "The assumption that the MISP export directory is web-accessible and that the web server is configured to execute scripts (e.g., PHP) from that directory is inferred from the commit subject \u0027arbitrary script execution\u0027. The patch does not include web server configuration evidence.",
                  "The affected version boundary (prior to v2.5.47) is inferred from the tag_version_boundary metadata showing v2.5.47 as the nearest tag with 142 commits after the fix. The exact first affected version is not stated in the patch.",
                  "CAPEC-170 (File Upload) is the closest available attack pattern, but the actual mechanism is a workflow parameter specifying a filename rather than a traditional file upload. This mapping is approximate.",
                  "The CVSS PR:H rating assumes that \u0027site admin\u0027 in MISP corresponds to a high-privilege role requiring authentication and elevated permissions, consistent with MISP\u0027s role model."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-170",
                    "rationale": "CAPEC-170 describes an attacker uploading or placing a file with a dangerous extension into a target directory where it can be executed. In this case, a site admin specifies a blocklist filename with a dangerous extension (e.g., .php) that is placed in the MISP export directory. The mechanism is not a traditional multipart upload but rather a workflow parameter that results in a file being written to a web-accessible location. CAPEC-170 is the closest available pattern; the uncertainty is that the file is not uploaded via a standard upload endpoint but is instead referenced by name in a workflow action, making the mapping approximate."
                  }
                ],
                "commit": "e5a9431784b4a78faddc0cc6efc2a287f2fd3d08",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The attack requires only specifying a filename with a dangerous extension in a workflow parameter; no race conditions or complex timing are needed. AT:N: No manipulation of the target system is required beyond the normal API call. PR:H: The commit message explicitly states \u0027site admin only\u0027, requiring high-privilege MISP access. UI:N: No victim interaction is needed; the workflow action is triggered by the admin themselves. VC:H, VI:H, VA:H: Arbitrary script execution on the MISP server compromises all three local security properties. SC:N, SI:N, SA:N: The impact is confined to the MISP server; no evidence of lateral impact on other systems is present in the patch.",
                "fixSummary": "The vulnerability is remediated by enforcing a strict whitelist of allowed file extensions (txt, list, blocklist, csv) on the blocklist filename parameter before the file is processed. Any filename with an extension outside this whitelist is rejected with an error, preventing an attacker from placing files with executable or dangerous extensions (e.g., .php, .phtml) into the MISP export directory where they could be interpreted by the web server.",
                "generatedAt": "2026-09-21T12:44:28.234229Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "9b7cc757cbbc8a4dd7491c6388e0ee12057c790bb6ca21e10b1d78209bbb7748",
                "patchSummary": "In app/Model/WorkflowModules/action/Module_blocklist_action.php, five lines are inserted after the existing basename() call. The added code defines an $allowedExtensions array containing \u0027txt\u0027, \u0027list\u0027, \u0027blocklist\u0027, and \u0027csv\u0027, extracts the file extension via pathinfo() with PATHINFO_EXTENSION, and performs a strict (===) in_array() check. If the extension is not in the whitelist, the method returns early with a failure message \u0027Blocklist filename has an invalid extension.\u0027 This check is placed before the existing empty/dot filename validation.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "e5a9431784b4a78faddc0cc6efc2a287f2fd3d08",
                    "patchSha256": "9b7cc757cbbc8a4dd7491c6388e0ee12057c790bb6ca21e10b1d78209bbb7748",
                    "source": "https://github.com/MISP/MISP/commit/e5a943178.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/e5a943178.patch",
                    "subject": "fix: [security] arbitrary script execution via insufficient"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/e5a943178.patch",
                "subject": "fix: [security] arbitrary script execution via insufficient",
                "tagVersionBoundary": {
                  "commits_after_fix": 142,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-434",
                    "rationale": "The blocklist filename parameter accepted arbitrary file extensions without restriction. A site admin could supply a filename with a dangerous extension (e.g., .php) that would be placed in a web-accessible export directory, enabling script execution. The fix restricts extensions to a safe whitelist, which is the canonical remediation for CWE-434."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "The filename parameter was not validated against a set of acceptable values (extensions). Only path stripping and empty-string checks were performed, leaving the extension entirely unvalidated. This is a general improper input validation weakness that enabled the more specific dangerous-file-type issue."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20009"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94383",
    "datePublished": "2026-09-21T12:52:03.355Z",
    "dateReserved": "2026-09-21T12:52:01.101Z",
    "dateUpdated": "2026-09-21T14:48:17.369Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94381",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T14:37:33.435781Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T14:48:17.524Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "UsersController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/UsersController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eMISP has a security issue that can let a user gain more access than their API key is supposed to allow.\u003c/p\u003e\u003cp\u003eA read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user\u2019s normal account permissions. This means someone with a read-only API key could potentially gain write, delete, or even administrator access if their underlying account has those permissions.\u003c/p\u003e\u003cp\u003eExploiting the issue requires a valid read-only API key and a single request to the affected function.\u003c/p\u003e\u003cp\u003eThe main impact is that MISP\u2019s API key restrictions can be bypassed, allowing actions that the API key was specifically meant to prevent.\u003c/p\u003e\u003cbr\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "MISP has a security issue that can let a user gain more access than their API key is supposed to allow.\n\nA read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user\u2019s normal account permissions. This means someone with a read-only API key could potentially gain write, delete, or even administrator access if their underlying account has those permissions.\n\nExploiting the issue requires a valid read-only API key and a single request to the affected function.\n\nThe main impact is that MISP\u2019s API key restrictions can be bypassed, allowing actions that the API key was specifically meant to prevent.\n\n\n\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-114 Exploiting Incorrectly Configured Privileges"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:42:53.242Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/fd27e592a"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix removes the call to User::getAuthUser() and Auth::login() from the updateLoginTime() method, which was re-authenticating the user with their full role permissions. It replaces this with a call to _refreshAuth(), which refreshes the authentication state while preserving the current (restricted) permission level associated with the API key, preventing privilege escalation.\u003c/p\u003e"
            }
          ],
          "value": "The fix removes the call to User::getAuthUser() and Auth::login() from the updateLoginTime() method, which was re-authenticating the user with their full role permissions. It replaces this with a call to _refreshAuth(), which refreshes the authentication state while preserving the current (restricted) permission level associated with the API key, preventing privilege escalation."
        }
      ],
      "title": "MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The tag_version_boundary indicates the fix commit is 141 commits before v2.5.47, implying v2.5.47 contains the fix; versions prior to v2.5.47 are assumed affected. No explicit version range is stated in the patch.",
                  "The _refreshAuth() method is assumed to preserve the current API-key-scoped permission level rather than re-fetching full role permissions; this is inferred from the commit subject and the removal of getAuthUser()/Auth::login().",
                  "The \u0027full role\u0027 referenced in the commit subject is assumed to be a higher-privilege role (e.g., admin or site admin) compared to the read-only API key scope.",
                  "CAPEC-114 is the closest available attack pattern; no CAPEC specifically models session privilege escalation via authentication refresh, so this mapping carries some uncertainty.",
                  "CVSS impact metrics (VC/VI/VA) assume the user\u0027s full role grants broad administrative access to the MISP instance; actual impact depends on the specific role assigned to the user."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-114",
                    "rationale": "The vulnerability arises because the updateLoginTime endpoint incorrectly reconfigures the user\u0027s privilege level during session refresh, upgrading from the API-key-scoped read-only permissions to the user\u0027s full role. The attacker exploits this misconfiguration by simply calling the endpoint. CAPEC-114 is the closest match as it covers scenarios where an application incorrectly assigns or maintains privilege levels. Uncertainty: no CAPEC specifically covers \u0027session privilege escalation via auth refresh,\u0027 so this is the best available approximation."
                  }
                ],
                "commit": "fd27e592a617f21934f4a2c424e0578287affb36",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N - the endpoint is accessible over the network via HTTP POST. AC:L - the attack requires only a single POST request to a known endpoint; no race conditions or complex timing. AT:N - no manipulation of the target system is needed beyond the API call. PR:L - the attacker must possess a valid read-only API key (authenticated user). UI:N - no user interaction is required. VC:H - the escalated user can read all data in the MISP instance that their full role permits. VI:H - the escalated user can create, modify, and delete threat intelligence data. VA:H - the escalated user can delete data, modify configurations, or disrupt the MISP service. SC/SI/SA:N - the impact is confined to the MISP instance itself; no cascading impact on other systems is evidenced.",
                "fixSummary": "The fix removes the call to User::getAuthUser() and Auth::login() from the updateLoginTime() method, which was re-authenticating the user with their full role permissions. It replaces this with a call to _refreshAuth(), which refreshes the authentication state while preserving the current (restricted) permission level associated with the API key, preventing privilege escalation.",
                "generatedAt": "2026-09-21T12:37:21.609779Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "d4143841f5f0d52a14d8538760872a7d91f78ba110384eafa3eedcad8e6480d3",
                "patchSummary": "In app/Controller/UsersController.php, the updateLoginTime() method is modified: the lines that fetched the user record via User::find(), called User::getAuthUser() to retrieve the full auth user, and called Auth::login() to re-establish the session are removed. These are replaced with a single call to $this-\u003e_refreshAuth(), which updates the authentication context without upgrading the permission scope. Net change: 1 insertion, 6 deletions.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "fd27e592a617f21934f4a2c424e0578287affb36",
                    "patchSha256": "d4143841f5f0d52a14d8538760872a7d91f78ba110384eafa3eedcad8e6480d3",
                    "source": "https://github.com/MISP/MISP/commit/fd27e592a.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/fd27e592a.patch",
                    "subject": "fix: [security] read only api keys can regain full role"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/fd27e592a.patch",
                "subject": "fix: [security] read only api keys can regain full role",
                "tagVersionBoundary": {
                  "commits_after_fix": 141,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-269",
                    "rationale": "The system fails to maintain the restricted privilege level (read-only) associated with the API key authentication. The updateLoginTime endpoint re-establishes the session with the user\u0027s full role permissions, effectively granting higher privileges than the authentication credential intended. This is a failure to properly manage and enforce the privilege boundary during session refresh."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20048"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94381",
    "datePublished": "2026-09-21T12:42:53.242Z",
    "dateReserved": "2026-09-21T12:42:51.237Z",
    "dateUpdated": "2026-09-21T14:48:17.524Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94379",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:20:43.610267Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T15:21:01.092Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "UsersController (login endpoint)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/UsersController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "unspecified",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe login() function in MISP\u0027s UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically:\u0026nbsp;\u003c/p\u003e\u2003-\u0026nbsp;the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked\u003cbr\u003e\u2003-\u0026nbsp; the email OTP two-factor authentication step was skipped, defeating the second factor of authentication\u003cbr\u003e\u003cdiv\u003e\u2003- login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cp\u003eThe security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance.\u003cbr\u003e\u003c/p\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "The login() function in MISP\u0027s UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically:\u00a0\n\n\u2003-\u00a0the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked\n\u2003-\u00a0 the email OTP two-factor authentication step was skipped, defeating the second factor of authentication\n\u2003- login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry.\n\n\n\n\nThe security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance.\n\n\n\n\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Improperly Controlled Modification of Authentication Logic"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:35:26.533Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/ef4dc19c6"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix replaces the allowlist-style HTTP method checks (is POST or PUT) with a denylist approach (is NOT GET) in all three security-critical branches of the login() function. This ensures that every non-GET HTTP method\u2014regardless of whether it is POST, PUT, PATCH, DELETE, HEAD, OPTIONS, or any other\u2014triggers the bruteforce protection, email OTP verification, and login-failure logging code paths, closing the method-based bypass.\u003c/p\u003e"
            }
          ],
          "value": "The fix replaces the allowlist-style HTTP method checks (is POST or PUT) with a denylist approach (is NOT GET) in all three security-critical branches of the login() function. This ensures that every non-GET HTTP method\u2014regardless of whether it is POST, PUT, PATCH, DELETE, HEAD, OPTIONS, or any other\u2014triggers the bruteforce protection, email OTP verification, and login-failure logging code paths, closing the method-based bypass."
        }
      ],
      "title": "MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact affected version range is not explicitly stated in the patch; the tag_version_boundary metadata indicates v2.5.47 with 143 commits after the fix, suggesting the fix landed shortly after 2.5.47, but the precise last-affected and first-fixed versions are not confirmed.",
                  "The CAPEC-1 mapping is the closest available pattern; the actual attack vector (HTTP method substitution) is a form of request parameter manipulation that does not have a dedicated CAPEC entry, so CAPEC-1 is used as the best approximation.",
                  "The CVSS vector assumes the MISP instance is exposed over a network and that the login endpoint is reachable without prior authentication, which is the standard deployment model for MISP.",
                  "The patch does not include a test case demonstrating the bypass; the analysis is based solely on the code diff and commit message.",
                  "It is assumed that the MISP framework (CakePHP) does not independently enforce HTTP method restrictions at a middleware layer that would have already blocked non-POST/PUT methods to this endpoint; the patch implies such enforcement was absent."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "The attacker modifies a parameter of the authentication request (the HTTP method) to alter which security checks are executed, effectively modifying the authentication logic at runtime. This is the closest CAPEC to the observed bypass. Uncertainty: CAPEC-1 typically refers to modifying authentication logic in a more direct sense (e.g., altering credential checks), whereas here the modification is via the HTTP method header. However, no other CAPEC more precisely captures the act of altering a request attribute to skip authentication security controls."
                  }
                ],
                "commit": "ef4dc19c6d4f029c3173e5fafea75a94c127f8b5",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N \u2013 the login endpoint is network-accessible. AC:L \u2013 the attack requires only changing the HTTP method in a request; no race conditions or complex setup. AT:N \u2013 no manipulation of the target system is needed. PR:N \u2013 the login endpoint is accessible without prior authentication. UI:N \u2013 no user interaction required. VC:L \u2013 bypass of bruteforce protection enables credential brute-forcing, potentially exposing user credentials. VI:L \u2013 bypass of email OTP (2FA) and failure logging compromises the integrity of the authentication process and audit trail. VA:N \u2013 no direct denial-of-service impact. SC/SI/SA:N \u2013 no secondary system impact is evidenced.",
                "fixSummary": "The fix replaces the allowlist-style HTTP method checks (is POST or PUT) with a denylist approach (is NOT GET) in all three security-critical branches of the login() function. This ensures that every non-GET HTTP method\u2014regardless of whether it is POST, PUT, PATCH, DELETE, HEAD, OPTIONS, or any other\u2014triggers the bruteforce protection, email OTP verification, and login-failure logging code paths, closing the method-based bypass.",
                "generatedAt": "2026-09-21T12:30:02.387878Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "ff6f133b194fcd5c913990fce421bd56de7a12e488291a2ec7422d92284e71d8",
                "patchSummary": "Three conditional expressions in UsersController::login() were changed. (1) The bruteforce-protection guard changed from $this-\u003erequest-\u003eis([\u0027post\u0027,\u0027put\u0027]) to !$this-\u003erequest-\u003eis([\u0027get\u0027]). (2) The email-OTP guard changed from $this-\u003erequest-\u003eis(\u0027post\u0027) to !$this-\u003erequest-\u003eis([\u0027get\u0027]). (3) The login-failure handling guard changed from $this-\u003erequest-\u003eis(\u0027post\u0027) || $this-\u003erequest-\u003eis(\u0027put\u0027) to !$this-\u003erequest-\u003eis(\u0027get\u0027). All three changes invert the logic from an explicit allowlist of methods to a denylist that excludes only GET, so that any other HTTP method is treated as a state-changing login attempt subject to all security controls.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "ef4dc19c6d4f029c3173e5fafea75a94c127f8b5",
                    "patchSha256": "ff6f133b194fcd5c913990fce421bd56de7a12e488291a2ec7422d92284e71d8",
                    "source": "https://github.com/MISP/MISP/commit/ef4dc19c6.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/ef4dc19c6.patch",
                    "subject": "fix: [security] insufficient check on http methods for the"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/ef4dc19c6.patch",
                "subject": "fix: [security] insufficient check on http methods for the",
                "tagVersionBoundary": {
                  "commits_after_fix": 143,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-20",
                    "rationale": "The root cause is that the application validated the HTTP method using an incomplete allowlist (POST, PUT) rather than rejecting all non-safe methods. This is a classic improper input validation flaw where the set of accepted values was not exhaustive, allowing unexpected methods to bypass security logic."
                  },
                  {
                    "cweId": "CWE-285",
                    "rationale": "The security controls (bruteforce protection, OTP enforcement, failure logging) are authorization/authentication enforcement mechanisms that were improperly applied only to a subset of HTTP methods, effectively allowing unauthorized bypass of these controls."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20013"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94379",
    "datePublished": "2026-09-21T12:35:26.533Z",
    "dateReserved": "2026-09-21T12:35:24.635Z",
    "dateUpdated": "2026-09-21T15:21:01.092Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94374",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:21:38.785106Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T15:21:57.870Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Model/Event.php (processModuleResultsData / handleModuleResults)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Event.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module results, the code iterates over EventReport entries supplied in the resolved data and saves each one. Unlike the adjacent attribute and object processing loops, the report loop did not unset the client-supplied \u0027id\u0027 field before calling save(). Because the MISP EventReport model\u0027s create() method does not strip the id field, an authenticated user with permission to submit module results could include an \u0027id\u0027 value referencing an existing report belonging to a different event. Upon save(), the ORM would update that existing row rather than insert a new one, allowing the attacker to\u0026nbsp;\u003c/p\u003e\u2003-\u0026nbsp;read the content of another event\u0027s report by reparenting it into their own event\u003cbr\u003e\u2003-\u0026nbsp;overwrite the report\u0027s fields with attacker-controlled data\u003cbr\u003e\u003cdiv\u003e\u2003-\u0026nbsp;change the report\u0027s event_id to redirect ownership.\u0026nbsp;\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cp\u003eThis constitutes an authorization bypass through a user-controlled key, enabling cross-event data disclosure and integrity compromise. The vulnerability requires an authenticated session with the ability to invoke module result processing on an event.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "MISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module results, the code iterates over EventReport entries supplied in the resolved data and saves each one. Unlike the adjacent attribute and object processing loops, the report loop did not unset the client-supplied \u0027id\u0027 field before calling save(). Because the MISP EventReport model\u0027s create() method does not strip the id field, an authenticated user with permission to submit module results could include an \u0027id\u0027 value referencing an existing report belonging to a different event. Upon save(), the ORM would update that existing row rather than insert a new one, allowing the attacker to\u00a0\n\n\u2003-\u00a0read the content of another event\u0027s report by reparenting it into their own event\n\u2003-\u00a0overwrite the report\u0027s fields with attacker-controlled data\n\u2003-\u00a0change the report\u0027s event_id to redirect ownership.\u00a0\n\n\n\n\nThis constitutes an authorization bypass through a user-controlled key, enabling cross-event data disclosure and integrity compromise. The vulnerability requires an authenticated session with the ability to invoke module result processing on an event.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-472",
              "description": "CWE-472 External Control of Assumed-Immutable Web Parameter",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:25:02.628Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/4c1a03b20"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix adds an unset($report[\u0027id\u0027]) call in the EventReport processing loop within processModuleResultsData, immediately before the event_id assignment and save() call. This ensures that any client-supplied id field is stripped from the report data, forcing the ORM to perform an insert (new report) rather than an update (existing report), consistent with the existing behavior of the attribute and object loops in the same method.\u003c/p\u003e"
            }
          ],
          "value": "The fix adds an unset($report[\u0027id\u0027]) call in the EventReport processing loop within processModuleResultsData, immediately before the event_id assignment and save() call. This ensures that any client-supplied id field is stripped from the report data, forcing the ORM to perform an insert (new report) rather than an update (existing report), consistent with the existing behavior of the attribute and object loops in the same method."
        }
      ],
      "title": "MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events\u0027 Reports",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact affected and fixed MISP version numbers are not stated in the patch metadata; the tag boundary (v2.5.47, 53 commits after fix) suggests the fix landed after v2.5.47 but the precise fixed release is unspecified.",
                  "PR:L assumes that submitting module results is available to any authenticated user with write access to an event; if MISP requires a more restrictive role (e.g., admin or org admin), PR should be raised to H.",
                  "VC:L assumes the attacker can read only the specific report they target by id; if the reparenting exposes additional data (e.g., related attributes), the confidentiality impact could be higher.",
                  "CAPEC-126 (Parameter Tampering) is the closest available CAPEC; the actual technique is more precisely a mass-assignment / IDOR via unsanitized primary key, for which no dedicated CAPEC entry exists.",
                  "The Co-Authored-By line references an AI assistant (Claude Opus 4.8); it is credited as a tool rather than a human remediation developer."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The attacker tampers with the module-results payload by injecting an \u0027id\u0027 parameter that the application does not expect or sanitize, redirecting the save operation to an arbitrary existing report row. This is the closest CAPEC to the observed attack: manipulating a request parameter to alter application behavior and access an unauthorized object. The mapping is approximate because CAPEC-126 typically describes in-transit tampering, whereas here the parameter is included in the initial request body; however, no more specific CAPEC for mass-assignment IDOR exists in the CAPEC catalog."
                  }
                ],
                "commit": "4c1a03b200fc75854879897c9cfc33a86b965d11",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  }
                ],
                "cvssRationale": "AV:N \u2013 MISP is a network-accessible web application. AC:L \u2013 the attack requires only including an \u0027id\u0027 field in a normal module-results submission; no race condition or complex bypass is needed. AT:N \u2013 no prior user interaction or attack preparation beyond crafting the payload. PR:L \u2013 requires an authenticated user with permission to submit module results on an event (a common MISP role). UI:N \u2013 no victim interaction required. VC:L \u2013 the attacker can read the content of one specific report they target by id. VI:H \u2013 the attacker can overwrite all fields of the targeted report and change its event_id, fully compromising its integrity. VA:N \u2013 no availability impact. SC/SI/SA \u2013 no impact on adjacent systems; SI:H reflects the integrity compromise of the shared report data store.",
                "fixSummary": "The fix adds an unset($report[\u0027id\u0027]) call in the EventReport processing loop within processModuleResultsData, immediately before the event_id assignment and save() call. This ensures that any client-supplied id field is stripped from the report data, forcing the ORM to perform an insert (new report) rather than an update (existing report), consistent with the existing behavior of the attribute and object loops in the same method.",
                "generatedAt": "2026-09-21T12:19:38.677403Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "1079aff9d4e4710ba6c4ea950bcbbe2597411bfe7065efbc1bc9a5587f87a6c9",
                "patchSummary": "In app/Model/Event.php, within the foreach loop over $resolved_data[\u0027EventReport\u0027] in processModuleResultsData, a single line unset($report[\u0027id\u0027]); is inserted after $this-\u003eEventReport-\u003ecreate() and before $report[\u0027event_id\u0027] = $id. A four-line comment is added explaining that module-result import only creates reports and that stripping the client id prevents redirecting save() onto another event\u0027s report row. No other files or logic are modified.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "4c1a03b200fc75854879897c9cfc33a86b965d11",
                    "patchSha256": "1079aff9d4e4710ba6c4ea950bcbbe2597411bfe7065efbc1bc9a5587f87a6c9",
                    "source": "https://github.com/MISP/MISP/commit/4c1a03b20.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/4c1a03b20.patch",
                    "subject": "fix: [security] Strip the client id from module-result event"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/4c1a03b20.patch",
                "subject": "fix: [security] Strip the client id from module-result event",
                "tagVersionBoundary": {
                  "commits_after_fix": 53,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-639",
                    "rationale": "The attacker supplies an \u0027id\u0027 value in the module-results payload that the application uses as the primary key for the save() operation, redirecting the write to an object (report row) belonging to a different event. The user-controlled key bypasses the intended create-only semantics and grants unauthorized read/write access to another event\u0027s report."
                  },
                  {
                    "cweId": "CWE-472",
                    "rationale": "The \u0027id\u0027 field is assumed to be server-generated and immutable for new records, but the application accepts a client-supplied value and passes it directly to the ORM save() call, allowing the attacker to control which database row is affected."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20022"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94374",
    "datePublished": "2026-09-21T12:25:02.628Z",
    "dateReserved": "2026-09-21T12:25:00.527Z",
    "dateUpdated": "2026-09-21T15:21:57.870Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94373",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:22:19.064596Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T15:22:31.730Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/webroot/js/contextual_menu.js"
          ],
          "product": "MISP",
          "programFiles": [
            "app/webroot/js/contextual_menu.js"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "David Andre"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML \u0026lt;option\u0026gt; elements by assigning user-controllable values to the innerHTML property. Because innerHTML parses and renders HTML markup, any untrusted string supplied as the option text (value.text or value) is interpreted as live DOM content rather than plain text. An attacker who can influence the data rendered in the contextual menu can inject arbitrary HTML or JavaScript that executes in the victim\u0027s browser within the MISP application origin. This may allow session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML \u003coption\u003e elements by assigning user-controllable values to the innerHTML property. Because innerHTML parses and renders HTML markup, any untrusted string supplied as the option text (value.text or value) is interpreted as live DOM content rather than plain text. An attacker who can influence the data rendered in the contextual menu can inject arbitrary HTML or JavaScript that executes in the victim\u0027s browser within the MISP application origin. This may allow session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-12",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-12 DOM-based XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:16:47.877Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/b062698f2"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe vulnerability is remediated by replacing the unsafe innerHTML property assignments with the safe textContent property when setting the display text of dynamically created \u0026lt;option\u0026gt; elements. textContent inserts the value as plain text without parsing HTML, thereby neutralizing any injected markup or script.\u003c/p\u003e"
            }
          ],
          "value": "The vulnerability is remediated by replacing the unsafe innerHTML property assignments with the safe textContent property when setting the display text of dynamically created \u003coption\u003e elements. textContent inserts the value as plain text without parsing HTML, thereby neutralizing any injected markup or script."
        }
      ],
      "title": "MISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary (v2.5.47 with 137 commits after the fix), suggesting the fix landed shortly after v2.5.47; no explicit affected/fixed version strings are provided in the metadata.",
                  "PR:L assumes the attacker must be an authenticated MISP user to inject data that reaches the contextual menu; if an unauthenticated injection path exists, PR could be N.",
                  "UI:P assumes the victim must actively open or interact with the contextual menu for the XSS to trigger; if the menu renders automatically on page load, UI could be N.",
                  "The CAPEC-12 mapping is high-confidence based on the innerHTML-to-textContent pattern, but the exact data flow (which upstream field feeds value.text) is not visible in the patch.",
                  "AT:N assumes the attacker does not need to target a specific user\u0027s session; if the payload must be tailored to a particular user\u0027s view, AT could be P."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-12",
                    "rationale": "The vulnerability is a textbook DOM-based XSS: attacker-controlled data is written into the DOM via the innerHTML property, causing the browser to parse and execute injected markup/script. CAPEC-12 (DOM-based XSS) is the most precise CAPEC pattern. The mapping is high-confidence because the patch explicitly targets innerHTML-to-textContent in a client-side JS file, which is the defining characteristic of DOM-based XSS."
                  }
                ],
                "commit": "b062698f269996ffe3ceb23de78612d768a3bfe2",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The injection is straightforward once attacker-controlled data reaches the menu options. AT:N: No special targeting of a specific session state is required beyond the data being rendered. PR:L: The attacker must be authenticated to MISP to inject data that will be rendered in the contextual menu. UI:P: The victim must interact with the contextual menu (e.g., open it) for the injected content to execute. VC/VI/VA:N: The MISP server itself is not directly compromised. SC:H/SI:H: The victim\u0027s browser (subsequent component) suffers high confidentiality and integrity impact via script execution in the MISP origin. SA:N: Availability of the browser is not impacted.",
                "draft": false,
                "fixSummary": "The vulnerability is remediated by replacing the unsafe innerHTML property assignments with the safe textContent property when setting the display text of dynamically created \u003coption\u003e elements. textContent inserts the value as plain text without parsing HTML, thereby neutralizing any injected markup or script.",
                "generatedAt": "2026-09-21T12:08:13.810140Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "843bc32d5dc337c115c79558f499550f4659a063b250fca808e32725cd586c9f",
                "patchSummary": "In app/webroot/js/contextual_menu.js, within the ContextualMenu class, two lines that set option.innerHTML (one for object-valued entries using value.text and one for scalar entries using value) are changed to option.textContent. No other logic, event handlers, or surrounding code is modified. The change is limited to the two assignment statements in the option-population loop.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "b062698f269996ffe3ceb23de78612d768a3bfe2",
                    "patchSha256": "843bc32d5dc337c115c79558f499550f4659a063b250fca808e32725cd586c9f",
                    "source": "https://github.com/MISP/MISP/commit/b062698f2.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/b062698f2.patch",
                    "subject": "fix: [xss] via JS innerHTML - as reported by David Andre and"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/b062698f2.patch",
                "subject": "fix: [xss] via JS innerHTML - as reported by David Andre and",
                "tagVersionBoundary": {
                  "commits_after_fix": 137,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "The patch replaces innerHTML with textContent to prevent HTML/JS injection into the DOM, which is the canonical remediation for DOM-based XSS (CWE-79). The specific sub-type is DOM-based XSS via unsafe DOM API usage (innerHTML), but CWE-79 is the narrowest standard identifier that covers this."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20033"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94373",
    "datePublished": "2026-09-21T12:16:47.877Z",
    "dateReserved": "2026-09-21T12:16:44.364Z",
    "dateUpdated": "2026-09-21T15:22:31.730Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94372",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:22:49.873477Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T15:23:04.003Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "Galaxies index (default theme)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/View/Galaxies/index.ctp"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a stored cross-site scripting (XSS) vulnerability in the default theme\u0027s Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the default theme, these sample tag names were inserted into the HTML output without HTML-entity encoding. A user with tag-editor privileges could craft a malicious misp-galaxy tag containing arbitrary script. When a site administrator subsequently viewed the Galaxies index page, the crafted tag content was interpreted as executable markup in the administrator\u0027s browser session, enabling the attacker to read session data, perform actions on behalf of the administrator, or otherwise compromise the administrator\u0027s browser context. The Overmind theme already applied HTML escaping to the same values and was not affected. The vulnerability requires the attacker to possess tag-editor-level access to create the crafted tag and requires the victim (a site administrator) to view the Galaxies index page in the default theme. The impact is limited to the administrator\u0027s browser session and does not directly compromise the MISP server process.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a stored cross-site scripting (XSS) vulnerability in the default theme\u0027s Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the default theme, these sample tag names were inserted into the HTML output without HTML-entity encoding. A user with tag-editor privileges could craft a malicious misp-galaxy tag containing arbitrary script. When a site administrator subsequently viewed the Galaxies index page, the crafted tag content was interpreted as executable markup in the administrator\u0027s browser session, enabling the attacker to read session data, perform actions on behalf of the administrator, or otherwise compromise the administrator\u0027s browser context. The Overmind theme already applied HTML escaping to the same values and was not affected. The vulnerability requires the attacker to possess tag-editor-level access to create the crafted tag and requires the victim (a site administrator) to view the Galaxies index page in the default theme. The impact is limited to the administrator\u0027s browser session and does not directly compromise the MISP server process.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Improper Neutralization of Input"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:02:17.104Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/ce10436ae"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix applies CakePHP\u0027s h() HTML-encoding function to each sample tag name before it is interpolated into the HTML notice. This ensures that any angle brackets, quotes, or ampersands contained in user-supplied tag names are rendered as inert HTML entities, preventing script execution in the administrator\u0027s browser.\u003c/p\u003e"
            }
          ],
          "value": "The fix applies CakePHP\u0027s h() HTML-encoding function to each sample tag name before it is interpolated into the HTML notice. This ensures that any angle brackets, quotes, or ampersands contained in user-supplied tag names are rendered as inert HTML entities, preventing script execution in the administrator\u0027s browser."
        }
      ],
      "title": "Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The tag_version_boundary (v2.5.47, 45 commits after fix) is interpreted as the fix landing after v2.5.47; exact affected version range is not explicitly stated in the patch and is marked as less_than 2.5.47 with status affected, but this is an inference.",
                  "The \u0027tag editor\u0027 role is assumed to be a lower-privilege role than site admin in MISP\u0027s RBAC model, justifying PR:L.",
                  "UI:P (Passive) is used because the victim only needs to load the Galaxies index page; no click or explicit interaction with the malicious content is required. The previous UI:R value was invalid in CVSS v4.0 (valid values: N, P, A).",
                  "CAPEC-1 is the closest available pattern; no CAPEC specifically names stored XSS, so the mapping is approximate.",
                  "The Overmind theme is stated in the commit message as already escaping these values; it is assumed unaffected but no patch evidence for it is provided.",
                  "The Co-Authored-By line for Claude Opus 4.8 is treated as a remediation developer credit per the supplied metadata; it is unclear whether this represents an AI-assisted contribution or a human developer using AI tooling."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "CAPEC-1 is the closest available pattern describing an attacker supplying malicious input that is not properly neutralized before being used in a context where it is interpreted (here, HTML). No dedicated CAPEC for stored XSS exists in the catalog; CAPEC-1 is the narrowest defensible match for an output-encoding failure. Uncertainty: the pattern is broad and does not specifically name XSS, but it is the best available mapping for an input-escaping deficiency."
                  }
                ],
                "commit": "ce10436ae989a4580a35ada1557ff9d9107f43ed",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  }
                ],
                "cvssRationale": "AV:N: exploited over the network via the web UI. AC:L: the attacker simply creates a tag with a script payload; no race or complex condition. AT:N: no attack-target manipulation required. PR:L: the attacker needs tag-editor privileges (lower than admin) to create the crafted misp-galaxy tag. UI:P: the victim (site admin) must passively view the Galaxies index page for the script to execute. VC/VI/VA:N: the MISP application process itself is not directly compromised; the impact is on the victim\u0027s browser session. SC:H: the attacker can read the admin\u0027s session cookies, tokens, and data visible in the browser. SI:H: the attacker can perform authenticated actions as the admin via the compromised session. SA:N: no meaningful availability impact on the scope component.",
                "draft": false,
                "fixSummary": "The fix applies CakePHP\u0027s h() HTML-encoding function to each sample tag name before it is interpolated into the HTML notice. This ensures that any angle brackets, quotes, or ampersands contained in user-supplied tag names are rendered as inert HTML entities, preventing script execution in the administrator\u0027s browser.",
                "generatedAt": "2026-09-21T11:56:43.983892Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 6,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 4
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "c629d71fb493dcf9ae82dd54bd424cd4335e7638f3db46ec4c0ae90695abb535",
                "patchSummary": "In app/View/Galaxies/index.ctp, two lines that built $tagSampleHTML via sprintf and implode over the unknownCustomClustersSamples and unknownDefaultClustersSamples arrays were modified to wrap each array with array_map(\u0027h\u0027, ...) before the implode. This causes every element to pass through CakePHP\u0027s h() helper (HTML entity encoding) prior to concatenation into the \u003cli\u003e list markup. No other logic, routing, or authorization changes were made.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "ce10436ae989a4580a35ada1557ff9d9107f43ed",
                    "patchSha256": "c629d71fb493dcf9ae82dd54bd424cd4335e7638f3db46ec4c0ae90695abb535",
                    "source": "https://github.com/MISP/MISP/commit/ce10436ae.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/ce10436ae.patch",
                    "subject": "fix: [security] Escape unknown-cluster samples in the"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/ce10436ae.patch",
                "subject": "fix: [security] Escape unknown-cluster samples in the",
                "tagVersionBoundary": {
                  "commits_after_fix": 45,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "User-controlled tag names (misp-galaxy tags created by a tag editor) are inserted into an HTML page without output encoding, allowing script injection. This is a classic stored XSS (CWE-79) where the dangerous data is persisted in the database and rendered unsafely in a server-side template."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20002"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94372",
    "datePublished": "2026-09-21T12:02:17.104Z",
    "dateReserved": "2026-09-21T12:02:13.614Z",
    "dateUpdated": "2026-09-21T15:23:04.003Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "modules": [
            "AttributesController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/AttributesController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user\u2019s browser without that user knowingly approving the change.\u003c/p\u003e\u003cp\u003eThe affected function did not properly enforce MISP\u2019s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.\u003c/p\u003e\u003cp\u003eIf successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.\u003c/p\u003e\u003cp\u003eThe attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.\u003c/p\u003e\u003cp\u003eThe main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.\u003c/p\u003eVersion affected: \u0026lt;2.5.47"
            }
          ],
          "value": "MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user\u2019s browser without that user knowingly approving the change.\n\nThe affected function did not properly enforce MISP\u2019s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.\n\nIf successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.\n\nThe attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.\n\nThe main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-124",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-124 Cross-Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/dfbae33f9"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token.\u003c/p\u003e"
            }
          ],
          "value": "The editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token."
        }
      ],
      "title": "MISP CSRF vulnerability allows unauthorized attribute modification",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary (v2.5.47 with 7 commits after the fix); no explicit \u0027affected\u0027 or \u0027fixed\u0027 version strings are provided in the metadata, so the exact version boundary is approximate.",
                  "UI:P (Passive) is assumed because the commit message describes a \u0027cross-site form post\u0027 that auto-submits when the victim\u0027s browser loads the attacker\u0027s page; if the attack requires the victim to explicitly click a link or submit a form, UI:A would be more appropriate.",
                  "PR:N is assumed because the attacker does not need their own MISP account; the victim\u0027s authenticated session cookie is sufficient. If MISP deployments require additional authentication factors (e.g., MFA) that would block a cross-site form post, the effective exploitability may be lower.",
                  "The CAPEC-124 mapping is the closest standard pattern for CSRF; no more specific CAPEC exists for the CakePHP unlockedActions bypass mechanism.",
                  "The Co-Authored-By AI tool is included as a \u0027tool\u0027 credit based on explicit commit metadata; it is not a human contributor."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-124",
                    "rationale": "The patch description explicitly states that a cross-site form post carrying the victim\u0027s session cookie could rewrite attribute fields. This is the canonical CSRF attack pattern: an attacker induces a victim\u0027s browser to send an authenticated request to a target application without the victim\u0027s knowledge or consent. CAPEC-124 is the most direct and specific match."
                  }
                ],
                "commit": "dfbae33f9a93bf127fae115bc6cd1a9e03d028e9",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The attack is delivered over the network via a malicious web page. AC:L: Crafting a CSRF form is straightforward and requires no race conditions or special timing. AT:N: The target MISP instance is not under the attacker\u0027s control. PR:N: The attacker needs no account on MISP; the victim\u0027s existing session is sufficient. UI:P: The victim must passively load the attacker\u0027s page (e.g., visit a link), which triggers the auto-submitting form; no explicit click or form submission by the victim is required. VC:N: The attack modifies data but does not disclose confidential information. VI:H: The attacker can alter attribute values, types, categories, distribution, and timestamps, corrupting threat-intelligence data for all users. VA:N: No denial-of-service impact is indicated. SC/SI/SA:N: No secondary impacts on other systems are evidenced.",
                "fixSummary": "The editField action is removed from the Security component\u0027s unlockedActions list and added to the _csrfTokenHeaderOnly array. This enforces CSRF token validation (accepted either in the X-CSRF-Token header or in the request body) while dropping only the field-hash check, which the existing AJAX callers (Overmind index and legacy inline forms) cannot satisfy. Legitimate callers are unaffected because they already transmit a valid CSRF token.",
                "generatedAt": "2026-09-21T13:38:54.473662Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "beb65b8daaa1d2e649f1178cc7f2c774f4ba7e75a13cc000524eef566c4545c8",
                "patchSummary": "In app/Controller/AttributesController.php, the string \u0027editField\u0027 is added to the _csrfTokenHeaderOnly() call in beforeFilter(), enabling header-or-body CSRF token validation for that action. Simultaneously, the line adding \u0027editField\u0027 to $this-\u003eSecurity-\u003eunlockedActions[] is removed, so the action is no longer exempt from CSRF checks. A comment block is added explaining that both the Overmind index (token in X-CSRF-Token header) and legacy inline forms (token in body) already carry a valid token, so only the unsatisfiable field-hash check is dropped.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "dfbae33f9a93bf127fae115bc6cd1a9e03d028e9",
                    "patchSha256": "beb65b8daaa1d2e649f1178cc7f2c774f4ba7e75a13cc000524eef566c4545c8",
                    "source": "https://github.com/MISP/MISP/commit/dfbae33f9.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/dfbae33f9.patch",
                    "subject": "fix: [security] Keep the CSRF check on the inline attribute"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/dfbae33f9.patch",
                "subject": "fix: [security] Keep the CSRF check on the inline attribute",
                "tagVersionBoundary": {
                  "commits_after_fix": 7,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-352",
                    "rationale": "The editField action was placed in unlockedActions, which explicitly bypassed the CSRF token check. This allowed a cross-site form post to modify attribute data using only the victim\u0027s session cookie, a textbook CSRF weakness."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20043"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-94404",
    "datePublished": "2026-09-21T13:50:37.643790Z",
    "dateReserved": "2026-09-21T13:50:44.676Z",
    "dateUpdated": "2026-09-21T13:50:44.744216Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20043"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Model/Event.php (addMISPExportFile)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Event.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services.\u003c/p\u003e\u003cp\u003eWhen importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify data could upload a file containing a local file path or a web address instead.\u003c/p\u003e\u003cp\u003eIf a local file path was supplied, MISP could read that file from the server. If a URL was supplied, MISP could make a request to that address, including systems that may only be reachable from inside the organization\u2019s network.\u003c/p\u003e\u003cp\u003eThe vulnerability could therefore expose sensitive local files and allow unauthorized requests to internal services.\u003c/p\u003e\u003cp\u003eExploitation required a valid MISP account with modify permissions, but no additional user interaction was needed.\u003c/p\u003eVersion affected: \u0026lt;2.5.47"
            }
          ],
          "value": "MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services.\n\nWhen importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify data could upload a file containing a local file path or a web address instead.\n\nIf a local file path was supplied, MISP could read that file from the server. If a URL was supplied, MISP could make a request to that address, including systems that may only be reachable from inside the organization\u2019s network.\n\nThe vulnerability could therefore expose sensitive local files and allow unauthorized requests to internal services.\n\nExploitation required a valid MISP account with modify permissions, but no additional user interaction was needed.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Server Side Request Forgery"
            }
          ]
        },
        {
          "capecId": "CAPEC-2",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-2 Parameter Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73 External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/d5f247b91"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces two defensive measures in addMISPExportFile(): (1) a pre-parse validation that rejects any uploaded content not containing an XML document marker (the \u0027\u0026lt;\u0027 character), preventing path or URL strings from reaching the XML parser; and (2) an explicit readFile =\u0026gt; false option passed to Xml::build(), which disables the library\u0027s ability to interpret the input as a file path or URL to be read or fetched. Together these changes ensure that only genuine XML document content is parsed and that no server-side file access or network request is triggered by user-supplied data.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces two defensive measures in addMISPExportFile(): (1) a pre-parse validation that rejects any uploaded content not containing an XML document marker (the \u0027\u003c\u0027 character), preventing path or URL strings from reaching the XML parser; and (2) an explicit readFile =\u003e false option passed to Xml::build(), which disables the library\u0027s ability to interpret the input as a file path or URL to be read or fetched. Together these changes ensure that only genuine XML document content is parsed and that no server-side file access or network request is triggered by user-supplied data."
        }
      ],
      "title": "MISP Arbitrary Local File Read and SSRF via MISP Export Upload",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The commit message states the vulnerability was \u0027found during the internal review, not externally reported,\u0027 so no external finder or reporter credit is assigned. The internal reviewer\u0027s identity is not specified in the patch metadata.",
                  "The affected version range is inferred from the tag_version_boundary (v2.5.47 with 40 commits after the fix), but exact affected and fixed version numbers are not stated in the patch. The boundary is recorded as a reference point only.",
                  "PR:L assumes that perm_modify is a non-administrative, commonly granted role in MISP deployments. If perm_modify is equivalent to full administrative access in some configurations, PR could be elevated to PR:H.",
                  "The CAPEC-2 mapping is a broader, secondary pattern included for completeness; CAPEC-126 is the primary and most specific match. The uncertainty is noted in the CAPEC-2 rationale.",
                  "The commit message references an operator-precedence issue in Xml::build()\u0027s readFile guard not covering the https branch. This is taken as evidence from the commit message and patch comments; the actual Xml utility source is not included in the patch, so the exact mechanism of the https bypass is assumed rather than verified.",
                  "CVSS SC:H assumes the SSRF can reach internal services with sensitive data. If the deployment restricts outbound network access, SC could be reduced."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The patch explicitly describes the SSRF vector: an .xml upload containing a URL causes MISP to fetch that URL and import the result. CAPEC-126 describes an attacker manipulating a server-side application to make it issue requests to unintended targets, which is exactly the attack demonstrated here. The local-file-read aspect is a secondary manifestation of the same root cause (unvalidated input passed to a function that resolves locators) and is subsumed by the SSRF pattern in this context."
                  },
                  {
                    "capecId": "CAPEC-2",
                    "rationale": "The attacker manipulates the content parameter of the MISP export upload to supply a file path or URL instead of a valid XML document. CAPEC-2 covers the general technique of altering application parameters to trigger unintended behavior. This is a secondary mapping; CAPEC-126 is the more specific and primary pattern. The uncertainty is that CAPEC-2 is broader and less precise than CAPEC-126 for this specific vulnerability."
                  }
                ],
                "commit": "d5f247b91ad3e8ea86feaaa587bf0466c95ea996",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: exploitation occurs over the network via the MISP web interface. AC:L: the attack is deterministic; uploading a file with a path or URL as content reliably triggers the read/fetch. AT:N: no special target-side conditions are required. PR:L: the attacker needs an authenticated account with perm_modify (a non-privileged but authenticated role). UI:N: the attacker performs the upload autonomously; no victim interaction is needed. VC:H: arbitrary local file read exposes sensitive server data (credentials, configs, keys). VI:N: the imported data is stored as an event but does not corrupt application state or logic. VA:N: no denial-of-service impact is indicated. SC:H: the SSRF component allows the attacker to read responses from internal services (metadata endpoints, admin panels, etc.), impacting subsequent-component confidentiality. SI:N and SA:N: no evidence of integrity or availability impact on subsequent components from the patch evidence.",
                "fixSummary": "The fix introduces two defensive measures in addMISPExportFile(): (1) a pre-parse validation that rejects any uploaded content not containing an XML document marker (the \u0027\u003c\u0027 character), preventing path or URL strings from reaching the XML parser; and (2) an explicit readFile =\u003e false option passed to Xml::build(), which disables the library\u0027s ability to interpret the input as a file path or URL to be read or fetched. Together these changes ensure that only genuine XML document content is parsed and that no server-side file access or network request is triggered by user-supplied data.",
                "generatedAt": "2026-09-21T13:28:43.719596Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 6,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "004f65b4d416b8e01f8b713a982a9b4d808e454c40cd74cc94d36137eb1b2845",
                "patchSummary": "In app/Model/Event.php, the single line calling Xml::toArray(Xml::build($data)) is replaced with a guard clause that throws an Exception if strpos($data, \u0027\u003c\u0027) === false, followed by Xml::toArray(Xml::build($data, [\u0027readFile\u0027 =\u003e false])). Nine lines are added (including a four-line explanatory comment) and one line is removed. No other files are modified.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "d5f247b91ad3e8ea86feaaa587bf0466c95ea996",
                    "patchSha256": "004f65b4d416b8e01f8b713a982a9b4d808e454c40cd74cc94d36137eb1b2845",
                    "source": "https://github.com/MISP/MISP/commit/d5f247b91.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/d5f247b91.patch",
                    "subject": "fix: [security] Refuse a MISP export upload whose content is"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/d5f247b91.patch",
                "subject": "fix: [security] Refuse a MISP export upload whose content is",
                "tagVersionBoundary": {
                  "commits_after_fix": 40,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-918",
                    "rationale": "The primary and most severe impact is that an attacker-supplied URL in the uploaded file body causes the MISP server to issue an HTTP request to an arbitrary internal or external address and import the response. This is a textbook SSRF: user-controlled input is used as a network request target by the server."
                  },
                  {
                    "cweId": "CWE-73",
                    "rationale": "The secondary impact is that a user-supplied local file path in the uploaded file body is passed to Xml::build() which reads that file from the server\u0027s filesystem. The attacker controls the file path that the server reads, matching CWE-73. CWE-22 (Path Traversal) was considered but the input is not a relative traversal sequence; it is an absolute path chosen by the attacker, making CWE-73 the more precise mapping."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20056"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-94401",
    "datePublished": "2026-09-21T13:35:58.783318Z",
    "dateReserved": "2026-09-21T13:36:11.048Z",
    "dateUpdated": "2026-09-21T13:36:11.123285Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20056"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "modules": [
            "ObjectReferencesController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/ObjectReferencesController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user.\u003cbr\u003e\u003cbr\u003e\u003cp\u003eBecause of this, someone who can view an event could potentially access attributes or objects inside that event that were meant to be restricted to a specific sharing group or distribution level.\u003c/p\u003eThe vulnerability affects authenticated users who are not site administrators and who already have access to an event containing more restricted data.\u003cbr\u003e\u003cbr\u003eThe main impact is that users may be able to view sensitive attribute values, object details, or related object data that they should not normally be allowed to see.\u003cbr\u003e"
            }
          ],
          "value": "When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user.\n\nBecause of this, someone who can view an event could potentially access attributes or objects inside that event that were meant to be restricted to a specific sharing group or distribution level.\n\nThe vulnerability affects authenticated users who are not site administrators and who already have access to an event containing more restricted data.\n\nThe main impact is that users may be able to view sensitive attribute values, object details, or related object data that they should not normally be allowed to see."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-109",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-109 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/f36634e57"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces granular authorization checks in the ObjectReferencesController add() method. For non-site-admin users, the query conditions for attributes, objects, and object attributes are now augmented with OR clauses that restrict results to: (1) entities belonging to the user\u0027s own event, (2) entities with unrestricted distribution levels (1, 2, 3, 5), or (3) entities with distribution level 4 whose sharing_group_id is in the user\u0027s authorized sharing group list. This ensures that only data the user is explicitly authorized to see under MISP\u0027s distribution and sharing-group model is included in the object reference operation.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces granular authorization checks in the ObjectReferencesController add() method. For non-site-admin users, the query conditions for attributes, objects, and object attributes are now augmented with OR clauses that restrict results to: (1) entities belonging to the user\u0027s own event, (2) entities with unrestricted distribution levels (1, 2, 3, 5), or (3) entities with distribution level 4 whose sharing_group_id is in the user\u0027s authorized sharing group list. This ensures that only data the user is explicitly authorized to see under MISP\u0027s distribution and sharing-group model is included in the object reference operation."
        }
      ],
      "title": "MISP ObjectReferencesController: Granular Distribution and Sharing Group Restrictions Bypassed When Adding Object References",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact affected and fixed version numbers are not specified in the patch metadata. The tag_version_boundary indicates the fix commit is 140 commits after v2.5.47, but the precise release version containing the fix is unknown.",
                  "The CAPEC-109 (Parameter Tampering) mapping is the closest available match but is not a perfect fit; the vulnerability is more precisely a missing granular authorization check rather than parameter manipulation. No CAPEC specifically models broken sub-entity access control.",
                  "The CVSS SC:H rating assumes that the exposed attribute/object data constitutes sensitive information (e.g., IOCs, malware indicators, threat intelligence) whose unauthorized disclosure is a significant confidentiality impact. If the data is considered low-sensitivity, SC:L may be more appropriate.",
                  "The vulnerability requires the attacker to already have event-level access; it does not grant access to events the user cannot see. The bypass is limited to granular restrictions within an already-accessible event.",
                  "The patch only addresses the add() method in ObjectReferencesController; other methods or controllers with similar patterns may or may not be affected, but no evidence of additional affected code paths is present in this patch."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-109",
                    "rationale": "The closest plausible CAPEC is Parameter Tampering. An authenticated user supplies an objectId parameter to the add() endpoint, and the application fails to enforce proper authorization on the sub-entities (attributes, objects, object attributes) associated with that object. The user effectively \u0027tampers\u0027 with the scope of accessible data by leveraging event-level access to reach restricted sub-entities. This is not a perfect match because the user is not modifying a parameter to an invalid value but rather exploiting the absence of a check on a valid parameter\u0027s sub-resources. No CAPEC specifically models \u0027broken granular access control\u0027 or \u0027insecure direct object reference at sub-entity level,\u0027 making CAPEC-109 the best available approximation."
                  }
                ],
                "commit": "f36634e57b93ad9daa3ab9530b76b9e5cba796e2",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The attack requires no special conditions beyond having a valid account with event-level access; no race conditions or complex setup needed. AT:N: No manipulation of a separate attack target is required. PR:L: The attacker needs a low-privilege authenticated account (any non-site-admin user with access to an event containing restricted attributes/objects). UI:N: No victim interaction is required; the attacker simply calls the API endpoint. VC:N/VI:N/VA:N: The MISP server itself (the vulnerable component) is not compromised in its own confidentiality, integrity, or availability. SC:H: The resource impact is high because restricted attribute values, object metadata, and object-attribute data that are explicitly gated by distribution levels and sharing groups are exposed to an unauthorized user. SI:N: No integrity impact on the data. SA:N: No safety impact.",
                "fixSummary": "The fix introduces granular authorization checks in the ObjectReferencesController add() method. For non-site-admin users, the query conditions for attributes, objects, and object attributes are now augmented with OR clauses that restrict results to: (1) entities belonging to the user\u0027s own event, (2) entities with unrestricted distribution levels (1, 2, 3, 5), or (3) entities with distribution level 4 whose sharing_group_id is in the user\u0027s authorized sharing group list. This ensures that only data the user is explicitly authorized to see under MISP\u0027s distribution and sharing-group model is included in the object reference operation.",
                "generatedAt": "2026-09-21T13:15:28.001598Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "2688fca1334e3016b8b885ce926749f8d47e49d7b657cf38f7b2edcd6eaf6cf0",
                "patchSummary": "In app/Controller/ObjectReferencesController.php, the add() method is modified to build dynamic condition arrays ($attributeConditions, $objectConditions, $objectAttributeConditions) that incorporate the current user\u0027s role and authorized sharing group IDs. For non-site-admin users, each condition array gains an OR clause filtering by event ownership, distribution levels (1,2,3,5), or distribution level 4 with a matching sharing_group_id from the user\u0027s authorized IDs. These condition arrays replace the previously hardcoded minimal conditions (deleted=0, object_id=0) in the Contain clauses for Attribute, Object, and nested Object.Attribute queries. The user\u0027s authorized sharing group IDs are obtained via SharingGroup-\u003eauthorizedIds($user).",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "f36634e57b93ad9daa3ab9530b76b9e5cba796e2",
                    "patchSha256": "2688fca1334e3016b8b885ce926749f8d47e49d7b657cf38f7b2edcd6eaf6cf0",
                    "source": "https://github.com/MISP/MISP/commit/f36634e57.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/f36634e57.patch",
                    "subject": "fix: [security] Extended event granular restrictions ignored"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/f36634e57.patch",
                "subject": "fix: [security] Extended event granular restrictions ignored",
                "tagVersionBoundary": {
                  "commits_after_fix": 140,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The ObjectReferencesController add() method was missing authorization checks for granular distribution-level and sharing-group restrictions on attributes, objects, and object attributes. Only event-level access was verified, while the sub-entity level access controls (distribution levels 1-5, sharing group membership) were entirely absent from the query conditions. This is a classic missing authorization check at a finer granularity than what was enforced."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20106"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-94394",
    "datePublished": "2026-09-21T13:25:31.534037Z",
    "dateReserved": "2026-09-21T13:25:38.483Z",
    "dateUpdated": "2026-09-21T13:25:38.557803Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20106"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}