CVE-2026-85239
HighCVSS 7.1Summary
A vulnerability in MISP allows an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. By supplying a pre-encoded string instead of an array structure, an invalid definition can be persistently stored. On retrieval, invalid JSON triggers an exception, causing HTTP 500 errors in event template functionality.
Risk Assessment
The risk is a persistent denial of service affecting event template features for all authenticated users. A single malicious or malformed template can make the template listing and dependent functions unavailable until manual database repair.
Recommendation
Apply the vendor-provided patch immediately, which enforces structured object validation before saving and handles decoding failures gracefully on retrieval. After updating, audit the database for existing invalid template definitions and repair them.
Other vulnerabilities in MISP
See all- CVE-2026-85238High
MISP contains a session fixation vulnerability in the CustomAuth authentication flow. After successful authentication via CustomAuth, MISP stores the authenticated user identity in the existing session without first rotating the session identifier. An attacker who knows the victim's session identifier before authentication can later reuse it to access the victim's authenticated session.
- CVE-2026-85237High
A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The email_otp() endpoint did not apply brute-force protection, enabling repeated guessing of OTP and potential bypass of the additional authentication factor.
- CVE-2026-85236High
A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. An attacker could cause an authenticated user with sufficient privileges to invoke the endpoint, leading to deletion of published empty events.
- CVE-2026-85227Medium
MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a <script> element.
- CVE-2026-85226Medium
MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events. As a result, an authenticated user could receive correlation results referring to attributes or events that the user was not authorized to access.
- CVE-2026-61474Medium
An improper authorization check in MISP's attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharing_group_id without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly set to 4 — 'sharing group'.
- CVE-2017-14337High
In MISP versions before 2.4.80, when configured with X.509 certificate authentication alongside a non-MISP external user management API, an unauthenticated user can gain access as an arbitrary user if the API returns an empty value.
- CVE-2026-85216Critical
MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. An attacker knowing a valid directory user's email address could submit an empty password, which may be accepted by an LDAP server allowing unauthenticated binds. Additionally, in the LinOTP component, empty passwords could be checked against local MISP password hashes, and LDAP-provisioned accounts could be created with empty local passwords.
- CVE-2026-10868Critical
MISP has a mass assignment vulnerability in the user edit functionality (UsersController::edit()). An authenticated attacker can modify the user ID in the request, leading to updates on another user's account.
- CVE-2026-10611Critical
MISP contains an authentication bypass vulnerability when LDAP mixed authentication is enabled with OTP enforcement. An authenticated user can bypass the OTP step and access the application without providing a TOTP, HOTP, or email OTP code.
Original NVD description (English source)
A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. The EventTemplate::beforeValidate() method only performed semantic validation when the supplied definition was already represented as an array. If a caller instead supplied a pre-encoded string, including malformed JSON or JSON representing an unexpected data type, the value bypassed validateDefinition() and only needed to satisfy the generic notBlank validation rule. As a result, an invalid event template definition could be stored persistently in the database. When event templates were subsequently retrieved, EventTemplate::afterFind() attempted to decode the stored definition using JsonTool::decode() without handling decoding failures. A definition containing invalid JSON could therefore trigger an exception during retrieval. Because the event template index is available to all authenticated users, a single malicious or malformed template could make the event template listing and other functionality relying on EventTemplate queries return HTTP 500 errors until the offending database row was manually repaired. Valid JSON representing an unexpected type, rather than the expected JSON object, could similarly result in invalid data reaching downstream consumers. The vulnerability can therefore be exploited by a user capable of saving event templates to persist malformed template data and cause a persistent denial of service against event-template functionality for other users. The patch enforces that event template definitions must be supplied as structured objects before saving and always applies semantic validation. On retrieval, malformed JSON and definitions that do not decode to the expected structure are caught, logged, and replaced with an empty definition, preventing a malformed database entry from breaking all event template queries. Poisoning doesn't seem reachable according to the lead developer.