CVE-2026-86347

A vulnerability in MISP allows unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting. The password reset endpoint accepts an attacker-controlled email value without length or format validation, leading to multiple persistent writes. The fix adds length limits, format validation, pre-authentication request budget, and HTTP 429 responses.

MISP versions up to 2.5.45 allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data() without first checking whether the requester is authorized to view the object the reference belongs to. The lack of parent-object ACL allows access to information outside the user's normal scope.

In MISP versions up to and including 2.5.45, several dashboard widgets displaying organisation information did not honor the Security.hide_organisation_index_from_users setting. Authenticated users without the perm_sharing_group permission could enumerate organisations that were normally hidden, and could also obtain additional database fields through JSON export. Additionally, a contributor leaderboard widget revealed all organisations with events, ignoring the same visibility setting.

MISP versions up to 2.5.45 insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The previous logic considered a URL safe if it appeared relative or hostname matched, but failed to reject dangerous schemes like javascript: or backslash-based URLs, leading to stored XSS.

Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality. In feed processing, redirects were followed without validating the redirect scheme or destination, and original request headers were reused, potentially forwarding authentication headers or API credentials to a different host. Redirects could also target internal network resources, resulting in SSRF. The fix adds redirect validation, blocks internal destinations for cross-host redirects, strips configured feed credentials before following redirects to another host, and pins validated DNS results. The TAXII discovery endpoint had a related incomplete SSRF defense using gethostbyname() and comparing against only a few literal addresses, missing cases like IPv6 loopback (::1), numeric host encodings such as 0x7f000001, and multiple DNS records. The fix moves TAXII discovery to the shared URL egress validator.

In MISP versions up to and including 2.5.45, the dashboard organisation picker exposed organisation metadata without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. When Security.hide_organisation_index_from_users was enabled, normal organisation enumeration was restricted, but the picker still queried all organisations, allowing authenticated users to discover organisations that should have remained hidden.

MISP versions up to 2.5.45 inconsistently enforced email-address visibility in DashboardsController::listTemplates(). The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal HTML interface could request the REST/JSON representation and receive template owners’ email addresses without the intended privilege check.

Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view(). The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as type, key_data, and fingerprint, but did not fetch or authorize the associated parent event first. The fix adds parent_id and parent_type to the lookup and enforces authorization through the associated event using fetchSimpleEvent($user, parent_id). If the parent is not an Event, access is limited to site administrators.

In MISP up to version 2.5.45, the validation of the user-configurable homepage only checks if the path starts with '/', which is insufficient. Protocol-relative URLs like '//attacker.example' also start with '/' but resolve to an external origin in browsers. The vulnerable homepage value can be stored and used in post-login routing.

A vulnerability in MISP allows an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. By supplying a pre-encoded string instead of an array structure, an invalid definition can be persistently stored. On retrieval, invalid JSON triggers an exception, causing HTTP 500 errors in event template functionality.