Exploitation observed; activity peaked at 4 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
Multiple MISP core controllers and model capture paths accepted client-controlled request fields such as primary keys (id) and ownership/scope foreign keys (event_id, org_id, user_id, sharing_group_id, galaxy_cluster_uuid, organisation_uuid, and related nested object identifiers) without consistently stripping, pinning, or revalidating them against the server-authorized object. In affected paths, an authenticated user with access to one authorized object could submit crafted REST or form payloads that caused MISP to save data against a different object than the one checked by the authorization logic. Depending on the endpoint, this could allow object overwrite, object re-parenting, ownership transfer, unauthorized sharing-group scoping, event/object injection, proposal retargeting, or stored attacker-controlled content appearing in another user’s context. The fixes harden affected create/edit/import flows by stripping client-supplied primary keys on create-only saves, re-pinning route- or database-authorized identifiers before save operations, validating effective sharing-group scope, and adding field whitelists where ownership fields must never be editable. The initial broad fix also added a central CRUDComponent::edit() primary-key re-pin so payload-supplied IDs cannot redirect saves away from the already-authorized row. GitHub’s patch for 7acf8220c describes this central issue as CRUDComponent::edit() copying supplied fields, including a payload primary key, onto the loaded record, allowing CakePHP save() to update an arbitrary row unless the loaded ID is re-pinned.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-22 | 4 | Disclosure4 |
| 2026-06-23 | 1 | Active Exploitation1 |
| 2026-06-24 | 1 | Disclosure1 |
| 2026-07-06 | 1 | General1 |
⚠️ Vulnerabilidades en productos MISP ❗ CVE-2026-56447 ❗ CVE-2026-56423 ❗ CVE-2026-56422 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-misp/ https://t.co/VkJ11jLE4b
Post summary
The post announces three MISP CVEs and links to a CERT page for more information, but provides no technical or exploit details.
CVE-2026-56422 — MISP Authorisation bypass that could allow authenticated users to manipulate client-supplied identifiers. Full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-06-22/TIER_2_CVE-2026-56422.md #CyberSecurity #ThreatIntelligence #VulnerabilityManagement #CyberObs
Post summary
The report announces a new CVE‑2026‑56422 vulnerability—a user‑auth Bypass enabling manipulation of identifiers—without providing exploit code or patch details.
Some increased actor activities are shown targeting MISP (CVE-2026-56422) https://vuldb.com/vuln/372669/cti
Post summary
The post indicates attackers are actively targeting the MISP CVE-2026-56422 vulnerability, but no PoC, exploit code, patch, or technical details are shared.
🚨High - MISP Multiple Security Vulnerabilities (CVE-2026-56422 & CVE-2026-56425) CVE-2026-56422- Multiple MISP core controllers and models accept client-controlled primary keys (id) and foreign keys (event_id, org_id, user_id, sharing_group_id, etc.) without proper revalidation. An authenticated user can overwrite objects, re-parent data, transfer ownership, or inject content into other users' contexts. This is a broad Mass Assignment / Authorization Bypass issue (CWE-639) affecting many create/edit/import flows. CVE-2026-56425- MISP's AAD Authentication Plugin contains multiple weaknesses in its OAuth 2.0 flow: session IDs exposed as OAuth state parameters, no session regeneration post-login, missing single-use nonce enforcement, no HTTPS enforcement on redirect URIs, and verbatim logging of attacker-controlled error parameters. Combined, these enable session hijacking, session fixation, CSRF, replay attacks, and log injection. 👉Affected: MISP (pre-fix versions). Fixed in: Latest MISP. Upgrade to latest.
Post summary
MISP faces two high‑severity CVEs—one involving mass assignment via unvalidated primary keys and another exposing OAuth 2.0 weaknesses—both fixable by upgrading to the latest version.
🚨*CVE* CVE-2026-56422 Multiple MISP core controllers and model capture paths accepted client-controlled request fields such as primary keys (id) and ownership/scope foreign keys (event_id,… https://www.cve.org/CVERecord?id=CVE-2026-56422 ----- Traducción: CVE-2026-56422 Múl… http://infoflow.cloud`
Post summary
The post announces the existence of CVE-2026‑56422 with some technical detail but does not provide any PoC, exploit, patch, or evidence of active exploitation.
CVE-2026-56422 Multiple MISP core controllers and model capture paths accepted client-controlled request fields such as primary keys (id) and ownership/scope foreign keys (event_id,… https://www.cve.org/CVERecord?id=CVE-2026-56422
Post summary
The text announces CVE‑2026‑56422, describing how MISP controllers can accept untrusted request fields, but provides no PoC, exploit code, patch, or evidence of active exploitation.
CVE-2026-56422 Improper Input Validation in MISP Core Controllers Enables Unauthorized Object Manipulation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-56422
Post summary
The post announces CVE-2026-56422, highlighting that improper input validation in MISP Core Controllers can lead to unauthorized object manipulation, but it does not provide exploit code, patch details, or evidence of active exploitation.