CVE-2026-39962
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk26th percentile — higher than 26% of all known CVEs
Summary
MISP is a threat intelligence management platform. In versions prior to 2.5.36, there is a vulnerability to LDAP injection due to improper neutralization of special elements in an LDAP query, allowing manipulation of the LDAP search filter.
Risk Assessment
An attacker could exploit this vulnerability to bypass authentication constraints or perform unauthorized LDAP queries, potentially leading to the exposure of sensitive information.
Recommendation
It is recommended to upgrade to version 2.5.36 or later to mitigate this vulnerability.
Original NVD description (English source)
MISP is an open source threat intelligence and sharing platform. Prior to 2.5.36, improper neutralization of special elements in an LDAP query in ApacheAuthenticate.php allows LDAP injection via an unsanitized username value when ApacheAuthenticate.apacheEnv is configured to use a user-controlled server variable instead of REMOTE_USER (such as in certain proxy setups). An attacker able to control that value can manipulate the LDAP search filter and potentially bypass authentication constraints or cause unauthorized LDAP queries. This vulnerability is fixed in 2.5.36.