MISP vulnerabilities
We track 66 vulnerabilities in MISP products across 6 products. 66 are rated high or critical, and none are known to be exploited. The most recent was published on November 12, 2026.
Latest MISP vulnerabilities
- 9.2 Critical severity
misp-modules: Exposure of Sensitive Information to an Unauthorized Actor
The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /external_tools/list endpoint returned stored API keys (the api_key field) in its JSON response via the ExternalTools model seri
- 9.2 Critical severity
misp-modules: Missing Authorization
The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application en
- 7.1 High severity
MISP Guard, a proxy-based security filter for MISP feed distribution, contains a…
MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories
- 7.7 High severity
MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses…
MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_response method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance. The o
- 7.1 High severity
MISP: Exposure of Sensitive Information to an Unauthorized Actor
MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the config
- 7.1 High severity
MISP: Missing Authorization
MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organis
- 7.1 High severity
MISP: Improper Authentication
On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the
- 8.4 High severity
The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a…
The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the u
- 7.1 High severity
MISP: Improper Access Control
MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distributio
- 7.1 High severity
MISP: Improper Authorization
MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging exclusively to the importing user's organisation, with the default flag forced to off
- 7.1 High severity
MISP: Improper Authorization
MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In
- 9.3 Critical severity
MISP: Authentication Bypass by Capture-replay
MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is veri
- 7.6 High severity
MISP: Improper Authentication
MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token counter. The HOTP verification logic compared the submitted token against a counter value that was c
- 8.3 High severity
MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature.
MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img elem
- 8.6 High severity
MISP: Improper Access Control
MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag
- 8.3 High severity
MISP contains an improper input validation vulnerability in its ORM save path.
MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints (attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object refe
- 8.7 High severity
MISP: Authorization Bypass Through User-Controlled Key
MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submit
- 7.7 High severity
MISP: Improper Neutralization of Special Elements in Output Used by a Downstream Component
MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point. The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences: - any filesystem operation on a caller
- 7.1 High severity
MISP: Cross-Site Request Forgery
MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving the change. The affected function did not properly enforce MISP’s usual protection against forged requ
- 8.3 High severity
MISP: External Control of File Name or Path
MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services. When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of th
- 8.6 High severity
The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter…
The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename() to strip path components and a check for empty or dot values. A site administrator coul
- 8.7 High severity
MISP: Improper Privilege Management
MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore
- 8.3 High severity
MISP: External Control of Assumed-Immutable Web Parameter
MISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module results, the code iterates over EventReport entries supplied in the resolved data and saves each one. Unlike the a
- 8.5 High severity
misp: Improper Neutralization of Input During Web Page Generation
MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme's statistics views. The event General card and the server/feed preview card constructed donut chart legend labels by directly concatenating object name or category keys into
- 8.7 High severity
MISP contains a vulnerability in its background job dispatch mechanism that allows remote code…
MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::_parsePaths() scans th
- 7.1 High severity
MISP: Authorization Bypass Through User-Controlled Key
Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object. The commit explains that collection elements themselves only store UUIDs, whil
- 7.1 High severity
MISP: Missing Authorization
Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path. The vulnerable logic checked whether the acting user could use a sharing_group_id only when the request explicitly supplied distribution = 4. If the attacker i
- 9.3 Critical severity
The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass…
The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass vulnerability. Both LdapAuthenticate and LinOTPAuthenticate replace CakePHP's FormAuthenticate class but fail to replicate its _checkFields() input validation guard. As
- 8.4 High severity
MISP: Improper Neutralization of Escape, Meta, or Control Sequences
Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. The patch shows that CLI access could differ from the web application in multiple security-
- 7.1 High severity
MISP: Missing Authorization
Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates. For templates using distribution = 4, the template can specify a sharing_group_id. The instantiation path passed that value into event cre
- 7.5 High severity
MISP: Uncontrolled Resource Consumption
Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting. The users/forgot password-reset endpoint accepted an attacker-controlled email value without first i
- 9.1 Critical severity
MISP: Exposure of Sensitive Information to an Unauthorized Actor
Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality. In feed processing, redirects were followed without validating the redirect scheme or destination. The orig
- 7.1 High severity
MISP: Improper Authorization
MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query of member events by UUID without applying the caller's access control list (ACL). The CollectionsController::view() action correctly resolved collecti
- 8.6 High severity
misp: Cross-Site Request Forgery
MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the __initialiseSGQuickEdit() helper, where the HTTP method validation intended to r
- 8.3 High severity
misp: Incorrect Authorization
An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required perm_modify or perm_modify_org permissions. The affected attribute deletion paths relied on organization membership check
- 7.6 High severity
misp: Missing Authorization
An authorization flaw in MISP allowed an authenticated user to submit a sharing_group_id without verifying that the user was authorized to use the referenced Sharing Group. In several attribute and Galaxy Cluster creation and editing workflows, validation of t
- 8.1 High severity
misp: Improper Restriction of Excessive Authentication Attempts
A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The email_otp() endpoint did not apply brute-force protection when validating submitted OTP va
- 8.8 High severity
misp: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. Because bodyless GET requests are not subject to CakePHP's CS
- 9.1 Critical severity
misp: Improper Certificate Validation
MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null. When passed to cURL, this value effectively disabled TLS peer verification un
- 9.8 Critical severity
misp: Weak Password Requirements
MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. The custom LdapAuthenticate and LinOTPAuthenticate components replace CakePHP's FormAuthenticate