DeutschShown in its original language — a full translation is planned for a future version.
MISP: Mehrere Schwachstellen
view advisory published 2026-06-04
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um Sicherheitsmechanismen zu umgehen, um Daten offenzulegen, zu manipulieren oder zu löschen, um Benutzer zu täuschen und um Benutzerkonten zu manipulieren
01
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-10868US | — | — | ||
A mass assignment vulnerability exists in the MISP user edit functionality due to insufficient filtering of user-supplied fields in UsersController::edit(). When processing edit re… | ||||
| CVE-2026-10864US | medium4.3 | — | ||
A vulnerability in the MISP dashboard widgets allowed an authenticated user to manipulate the fields option and influence which fields were returned by the New Users and New Organi… | ||||
| CVE-2026-10860US | medium6.5OT elevated | — | ||
A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method. Due to missing parentheses in the dele… | ||||
| CVE-2026-10861US | medium6.1 | — | ||
An open redirect vulnerability existed in MISP UsersController::routeafterlogin() because the value stored in the pre_login_requested_url session key was used as the post-login red… | ||||
| CVE-2026-10856US | medium6.1 | — | ||
A URL validation flaw in the MISP dashboard button widget allowed a crafted relative-looking URL to be accepted as a local path while being interpreted by browsers as an external U… | ||||
| CVE-2026-10855US | medium4.3OT elevated | — | ||
An authorization flaw existed in the MISP Event Template Importer overwrite workflow. When importing an event template in overwrite mode, the application checked whether a matching… | ||||
| CVE-2026-10854US | medium4.3 | — | ||
A visibility control issue in the event template creation workflow allowed non-site-admin users to access private galaxies belonging to other organisations. The event template buil… | ||||
02
references
External citations — patches, advisories, analysis.
- MISP Pull Requests vom 2026-06-04external
- GitHub Security Advisory GHSA-243V-5F97-VFQ3 vom 2026-06-04external
- GitHub Security Advisory GHSA-3636-3MQQ-Q7X9 vom 2026-06-04external
- GitHub Security Advisory GHSA-9GJJ-GMCX-6FHJ vom 2026-06-04external
- GitHub Security Advisory GHSA-FPXH-9966-H5G3 vom 2026-06-04external
- GitHub Security Advisory GHSA-MQM2-JJX4-44GX vom 2026-06-04external
- GitHub Security Advisory GHSA-RX96-8W86-5HHH vom 2026-06-04external
- GitHub Security Advisory GHSA-h7wj-m45x-884x vom 2026-06-04external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan