MISP Core: Mass Assignment and Object Re-ownership via Unvalidated Request Fields

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2026-56422
StatePUBLISHED
AssignerCIRCL
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-06-22 12:16:26 UTC
Updated2026-06-22 12:16:26 UTC
DescriptionMultiple MISP core controllers and model capture paths accepted client-controlled request fields such as primary keys (id) and ownership/scope foreign keys (event_id, org_id, user_id, sharing_group_id, galaxy_cluster_uuid, organisation_uuid, and related nested object identifiers) without consistently stripping, pinning, or revalidating them against the server-authorized object. In affected paths, an authenticated user with access to one authorized object could submit crafted REST or form payloads that caused MISP to save data against a different object than the one checked by the authorization logic. Depending on the endpoint, this could allow object overwrite, object re-parenting, ownership transfer, unauthorized sharing-group scoping, event/object injection, proposal retargeting, or stored attacker-controlled content appearing in another user’s context. The fixes harden affected create/edit/import flows by stripping client-supplied primary keys on create-only saves, re-pinning route- or database-authorized identifiers before save operations, validating effective sharing-group scope, and adding field whitelists where ownership fields must never be editable. The initial broad fix also added a central CRUDComponent::edit() primary-key re-pin so payload-supplied IDs cannot redirect saves away from the already-authorized row. GitHub’s patch for 7acf8220c describes this central issue as CRUDComponent::edit() copying supplied fields, including a payload primary key, onto the loaded record, allowing CakePHP save() to update an arbitrary row unless the loaded ID is re-pinned.

Risk And Classification

Primary CVSS: v4.0 9.4 CRITICAL from 5a6e4751-2f3f-4070-9419-94fb35b644e8

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Problem Types: CWE-639 | CWE-639 CWE-639 Authorization Bypass Through User-Controlled Key

VersionSourceTypeScoreSeverityVector
4.05a6e4751-2f3f-4070-9419-94fb35b644e8Secondary9.4CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/C...
4.0CNACVSS9.4CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS v4.0 Breakdown

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Confidentiality
High
Integrity
High
Availability
High
Sub Conf.
High
Sub Integrity
High
Sub Availability
High

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Misp Misp affected 2.5.41 semver Not specified

References

ReferenceSourceLinkTags
github.com/MISP/MISP/commit/3ff6bd9cfdab5d41b4667ea7298d88ffd6f3fcb8 5a6e4751-2f3f-4070-9419-94fb35b644e8 github.com
github.com/MISP/MISP/commit/7acf8220cafac58bcfb362da37aca512fe4bb396 5a6e4751-2f3f-4070-9419-94fb35b644e8 github.com
github.com/MISP/MISP/commit/634f1f87c295193486c08c2c7ba1fee8a7339baa 5a6e4751-2f3f-4070-9419-94fb35b644e8 github.com
github.com/MISP/MISP/commit/8311427c2edd72a8341f0a65e1f11073d7ad9191 5a6e4751-2f3f-4070-9419-94fb35b644e8 github.com
github.com/MISP/MISP/commit/bc182d55dde5686a36ca2eb88fe6c2adabb9fad9 5a6e4751-2f3f-4070-9419-94fb35b644e8 github.com
github.com/MISP/MISP/commit/57433015815e59db5a1f11536f90920952cf3fcd 5a6e4751-2f3f-4070-9419-94fb35b644e8 github.com
github.com/MISP/MISP/commit/025f711506850aadb69cde1b57e5e5d57628c87f 5a6e4751-2f3f-4070-9419-94fb35b644e8 github.com
github.com/MISP/MISP/commit/05aad418c57bb78e6b58a843d70d45de8f50db45 5a6e4751-2f3f-4070-9419-94fb35b644e8 github.com
github.com/MISP/MISP/commit/ab9619dfa6cb5210fd20fb3b0b57006e4fc93916 5a6e4751-2f3f-4070-9419-94fb35b644e8 github.com
github.com/MISP/MISP/commit/63aebc27a878233b9475c742985aaef909bc755b 5a6e4751-2f3f-4070-9419-94fb35b644e8 github.com
github.com/MISP/MISP/commit/9341690e9b6dde7f0605edea5533e05ba7362e35 5a6e4751-2f3f-4070-9419-94fb35b644e8 github.com
github.com/MISP/MISP/commit/00b2e3dae56fa24ea750eb525cc4709b7e5bee85 5a6e4751-2f3f-4070-9419-94fb35b644e8 github.com
github.com/MISP/MISP/commit/58f637aaab4d133e72f1454ebb963191d96d3b78 5a6e4751-2f3f-4070-9419-94fb35b644e8 github.com
github.com/MISP/MISP/commit/c80a3533b3d787f45f5185a4621cc0f05b0cf2e5 5a6e4751-2f3f-4070-9419-94fb35b644e8 github.com
github.com/MISP/MISP/commit/84bafe69f5d0ab7f811371c0801a613f271ebc0b 5a6e4751-2f3f-4070-9419-94fb35b644e8 github.com
github.com/MISP/MISP/commit/2cc26f38f3e85c594957899f09043d5193146607 5a6e4751-2f3f-4070-9419-94fb35b644e8 github.com
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: Andras Iklody (en)

CNA: Jeroen Pinoy (en)

CNA: Claude (the international export version) (en)

© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report