Junglewise Threat Intelligence

CVE-2026-56422: MISP multiple core controllers authorization bypass via mass assignment

CVE-2026-56422 · Severity: info · CVSS 9.4 · Published 2026-06-22

Vendors: MISP Project.

Executive brief

MISP, a widely used open-source threat intelligence platform, was found to have multiple security flaws in how it handles data updates and creation. An authenticated user could bypass intended security restrictions by sending specially crafted requests that trick the system into modifying or overwriting data belonging to other users or organizations. This could lead to the unauthorized disclosure of sensitive threat data, the hijacking of synchronization settings between servers, or the corruption of existing security events and attributes.

Technical details

The vulnerability stems from multiple 'mass-assignment' flaws across various MISP core controllers (e.g., Servers, Taxonomies, ShadowAttributes, and Templates). The application accepted client-supplied primary keys (id) and foreign keys (event_id, org_id, etc.) in REST or form payloads without consistently stripping or re-validating them against the authorized session context. In the CRUDComponent::edit() and various add/import methods, CakePHP's save() or saveAssociated() functions would honor these injected IDs, effectively turning intended 'create' operations into 'updates' of arbitrary database rows. An authenticated attacker could exploit this to overwrite server sync configurations, re-parent taxonomy predicates, or inject attributes into events they do not own. The fix involves hardening the CRUD flows by unsetting client-supplied IDs on creation, re-pinning authorized identifiers before save operations, and implementing field whitelists.

Affected products

  • MISP Project MISP Prior to 2.4.194

Timeline

  • 2026-06-22: advisory: CVE-2026-56422 published
  • 2026-06-22: disclosed

References