CVE-2026-107278

MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request's deletion takes effect. Preconditions: The target MISP instance has email OTP login enabled; the attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering); the attacker can issue two HTTP POST requests in close temporal proximity. Impact: The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions. This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted. Affected versions: <2.5.48.

On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of mandatory two-factor authentication applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing non-browser requests (AJAX/XHR, REST API, .json URLs, restSearch, automation). Because these requests cannot follow the redirect to the TOTP enrolment page, the guard was skipped, and the user retained full access without completing the second-factor setup. Fixes (commits 8deb0619e and 6b527ba6e) broadened the guard to cover all non-browser requests, except API key authentication. Affected version: <2.5.48.

MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified. When a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted. Security impact: stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure. Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing. Preconditions: an authenticated user with write access to at least one MISP event; the user modifies the event's distribution or sharing_group_id field. Affected versions: <2.5.48

MISP before version 2.5.48 has an improper input validation vulnerability in the decaying model import functionality. A user with perm_decaying permissions can overwrite existing models of other organizations, change their ownership, or create a default model, affecting scoring behavior.

MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript string context, meaning a malicious linked server could supply a tag ID containing characters (such as a single quote) that break out of the JavaScript string literal and inject arbitrary script. Preconditions: a linked/remote MISP server is configured and connected to the local instance, the linked server supplies a crafted tag ID in an event, and an authenticated user views the event preview and interacts with the affected tag element. Impact: arbitrary JavaScript execution in the context of the viewing user's browser session, potentially allowing session hijacking, data exfiltration, or unauthorized actions on behalf of the user. Affected versions: MISP prior to the fix commit (v2.5.48 or later, exact boundary unconfirmed).

MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII object can inject arbitrary HTML or JavaScript that executes in the context of the victim's MISP session. Preconditions: the victim must be an authenticated MISP user with access to the TAXII object viewer, and the victim must open or view the crafted TAXII object. Impact: execution of arbitrary JavaScript in the victim's browser within the MISP application context, potential theft of session tokens, API keys, or other sensitive data, and potential for performing actions on behalf of the authenticated user. Affected versions: <2.5.48.

MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without proper output encoding. A malicious or compromised linked server could return a crafted event ID containing arbitrary HTML or JavaScript markup. This markup would be rendered in the browser of any user in the host organization who views the ID Translator page, enabling session hijacking, credential theft, or other client-side attacks. Preconditions: the victim must be an authenticated user of the host MISP instance, a linked server must be configured on the host instance, and the victim must navigate to the ID Translator page for a given event. Affected versions: <2.5.48.

MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link URL but rendered the field value without HTML encoding. An attacker with the ability to create or modify events on a linked (remote) MISP server could craft an event identifier containing HTML or JavaScript markup. When a user on the local MISP instance views the remote event preview index, the unescaped value is rendered directly in the browser, allowing arbitrary script execution in the victim's session. Preconditions: a linked/remote MISP server is configured and connected to the local instance, the attacker has sufficient access on the linked server to create or modify an event with a crafted identifier, and a victim user on the local instance views the remote event preview index page. Impact: execution of arbitrary JavaScript in the context of the MISP web application, potential session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user. Affected versions: <2.5.48.

MISP before version 2.5.48 contains an incomplete authorization check in the discussion posting functionality. An authenticated user outside the sharing group or without visibility on the associated event can read the thread title and quoted post content, and submit new posts into the thread, to which they are not authorized.

MISP contains a reflected XSS vulnerability in the analyst data notes panel. The seed path parameter supplied via URL is passed directly into inline JavaScript without sanitization. An attacker can trick an authenticated user into visiting a crafted URL, allowing arbitrary JavaScript execution in the victim's browser. Affects versions prior to the fix (commit 58925dbf0, post v2.5.48).