Executive brief
MISP, an open-source threat intelligence platform, contains a vulnerability in its user management system. An attacker could exploit this flaw to modify account details belonging to other users by manipulating request identifiers. This could lead to unauthorized changes to user profiles and compromise the integrity of account data within the platform.
Technical details
A mass assignment vulnerability exists in the UsersController::edit() function of MISP. The application failed to properly filter user-supplied fields, specifically accepting a user-controlled 'User.id' value from request data during edit operations. An authenticated attacker can craft a request containing a different user identifier, causing the application to apply updates to that unintended account instead of their own. The vulnerability has been patched by explicitly unsetting the 'User.id' field from the request data before processing the update.
Affected products
- MISP Project MISP
Timeline
- 2026-06-04: advisory: NVD publication date
- 2026-06-04: patched: Fix committed to MISP repository