MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = \"<?php echo $org;?>\";. Because the value was placed inside a double-quoted JavaScript string without any encoding, an organization name containing a double-quote character (or a backslash) could terminate the string literal and inject arbitrary JavaScript into the page. The injected script would execute in the context of any authenticated user who subsequently loads the admin email page, potentially allowing session hijacking, data exfiltration, or privileged actions performed on behalf of the victim.
Exploitation requires the ability to set or modify the MISP.org organization name and a second authenticated user visiting the affected admin email view.
The vulnerability is a classic instance of insufficient output encoding in a JavaScript context.
"}],"value":"MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = \"\";. Because the value was placed inside a double-quoted JavaScript string without any encoding, an organization name containing a double-quote character (or a backslash) could terminate the string literal and inject arbitrary JavaScript into the page. The injected script would execute in the context of any authenticated user who subsequently loads the admin email page, potentially allowing session hijacking, data exfiltration, or privileged actions performed on behalf of the victim.\n\nExploitation requires the ability to set or modify the MISP.org organization name and a second authenticated user visiting the affected admin email view.\n\nThe vulnerability is a classic instance of insufficient output encoding in a JavaScript context."}],"impacts":[{"capecId":"CAPEC-1","descriptions":[{"lang":"en","value":"CAPEC-1 Cross Site Scripting (XSS)"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":4.8,"baseSeverity":"MEDIUM","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-22T13:56:51.445Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/MISP/MISP/commit/5d6ace65e"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The fix replaces the raw PHP echo of the organization name with a json_encode() call using the flags JSON_HEX_TAG, JSON_HEX_AMP, JSON_HEX_APOS, and JSON_HEX_QUOT. This produces a properly escaped JavaScript string literal that neutralizes quotes, angle brackets, ampersands, and other metacharacters, preventing breakout from the string context and subsequent script injection.
"}],"value":"The fix replaces the raw PHP echo of the organization name with a json_encode() call using the flags JSON_HEX_TAG, JSON_HEX_AMP, JSON_HEX_APOS, and JSON_HEX_QUOT. This produces a properly escaped JavaScript string literal that neutralizes quotes, angle brackets, ampersands, and other metacharacters, preventing breakout from the string context and subsequent script injection."}],"title":"MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"full","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["PR:H assumes that setting the MISP.org organization name requires administrative privileges; if a lower-privileged role can modify this setting, PR should be lowered.","The exact fixed version is not stated in the patch; the tag boundary (v2.5.47, 52 commits after fix) suggests the fix lands in a release after v2.5.47, but the precise version number is unconfirmed.","UI:P assumes the victim merely navigates to the admin email page (passive interaction); no click or form submission is required to trigger the stored script.","The CAPEC-1 mapping is direct; no uncertainty is noted because the commit message and diff unambiguously describe a stored XSS via unescaped output in a JavaScript context.","Impact metrics (VC:L, VI:L, SC:L, SI:L) assume the XSS is confined to the MISP application context and does not enable cross-origin data theft beyond what the victim's browser session already exposes."],"capecRationale":[{"capecId":"CAPEC-1","rationale":"The patch demonstrates a stored XSS where attacker-controlled data (the MISP.org name) is reflected into a JavaScript context without encoding. CAPEC-1 is the canonical attack pattern for cross-site scripting. The mapping is direct and unambiguous given the commit message explicitly describes quote-breakout script injection."}],"commit":"5d6ace65e1d523dcbf04ce405a2f3a833cd353b2","confidence":"high","credits":[{"lang":"en","type":"reporter","value":"Jeroen Pinoy"},{"lang":"en","type":"remediation developer","value":"iglocska"},{"lang":"en","type":"remediation developer","value":"Claude Opus 4.8"}],"cvssRationale":"AV:N: exploited over the network via a web application. AC:L: no race conditions or special timing; a single quote in the org name suffices. AT:N: no manipulation of the attack target required. PR:H: the attacker must have sufficient privileges to set the MISP.org organization name (assumed to be an admin-level capability). UI:P: the victim passively triggers the payload by navigating to the admin email page. VC:L / VI:L: the injected script can read page data, cookies, and perform actions in the victim's session, but is scoped to the MISP application. VA:N: no denial-of-service impact. SC:L / SI:L: limited sub-system impact via the victim's browser session. SA:N: no availability impact on the sub-system.","fixSummary":"The fix replaces the raw PHP echo of the organization name with a json_encode() call using the flags JSON_HEX_TAG, JSON_HEX_AMP, JSON_HEX_APOS, and JSON_HEX_QUOT. This produces a properly escaped JavaScript string literal that neutralizes quotes, angle brackets, ampersands, and other metacharacters, preventing breakout from the string context and subsequent script injection.","generatedAt":"2026-09-22T13:52:55.463303Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":9,"assumptionCount":5,"confidence":"high","model":"qwen3.8:27b","score":6}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"9891167be879e4192e2ddd15347138945efa2bb402c49e7304af1b67f02a054b","patchSummary":"In app/View/Users/admin_email.ctp, line 72, the expression var org = \"\"; is replaced with var org = ;. The surrounding double quotes are removed because json_encode already emits a quoted string literal. The four JSON_HEX_* flags ensure that <, >, &, ', and \" are hex-escaped, making the output safe for embedding in both HTML and JavaScript contexts.","patchTruncated":false,"patches":[{"commit":"5d6ace65e1d523dcbf04ce405a2f3a833cd353b2","patchSha256":"9891167be879e4192e2ddd15347138945efa2bb402c49e7304af1b67f02a054b","source":"https://github.com/MISP/MISP/commit/5d6ace65e.patch","sourceUrl":"https://github.com/MISP/MISP/commit/5d6ace65e.patch","subject":"fix: [ui] Escape MISP.org when it is echoed into the admin"}],"source":"https://github.com/MISP/MISP/commit/5d6ace65e.patch","subject":"fix: [ui] Escape MISP.org when it is echoed into the admin","tagVersionBoundary":{"commits_after_fix":52,"repository":"https://github.com/MISP/MISP","tag":"v2.5.47","version":"2.5.47","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-79","rationale":"The organization name (attacker-influenced data) is written into a JavaScript string literal in an HTML page without context-appropriate encoding, allowing script breakout. This is a textbook stored XSS in a JavaScript context, which maps directly to CWE-79."}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20214"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-95682","datePublished":"2026-09-22T13:56:51.445Z","dateReserved":"2026-09-22T13:56:48.812Z","dateUpdated":"2026-09-22T15:31:09.389Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-22 14:17:22","lastModifiedDate":"2026-09-22 16:18:22","problem_types":["CWE-79","CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-22T15:31:00.583552Z","id":"CVE-2026-95682","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"95682","Ordinal":"1","Title":"MISP Stored Cross-Site Scripting via Unescaped Organization Name","CVE":"CVE-2026-95682","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"95682","Ordinal":"1","NoteData":"MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = \"\";. Because the value was placed inside a double-quoted JavaScript string without any encoding, an organization name containing a double-quote character (or a backslash) could terminate the string literal and inject arbitrary JavaScript into the page. The injected script would execute in the context of any authenticated user who subsequently loads the admin email page, potentially allowing session hijacking, data exfiltration, or privileged actions performed on behalf of the victim.\n\nExploitation requires the ability to set or modify the MISP.org organization name and a second authenticated user visiting the affected admin email view.\n\nThe vulnerability is a classic instance of insufficient output encoding in a JavaScript context.","Type":"Description","Title":"MISP Stored Cross-Site Scripting via Unescaped Organization Name"}]}}}