PatchSiren cyber security CVE debrief
CVE-2026-56422 misp CVE debrief
CVE-2026-56422 is a critical vulnerability with a CVSS score of 9.4, affecting MISP core controllers and model capture paths. An authenticated user with access to one authorized object could submit crafted REST or form payloads, causing MISP to save data against a different object than the one checked by the authorization logic. This could lead to object overwrite, object re-parenting, ownership transfer, unauthorized sharing-group scoping, event/object injection, proposal retargeting, or stored attacker-controlled content appearing in another user's context.
- Vendor
- misp
- Product
- Unknown
- CVSS
- CRITICAL 9.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-22
- Original CVE updated
- 2026-06-22
- Advisory published
- 2026-06-22
- Advisory updated
- 2026-06-22
Who should care
Defenders of MISP installations, security teams, and administrators responsible for MISP servers should prioritize addressing this vulnerability. Given the critical severity and potential impact, immediate attention is necessary to limit exposure.
Technical summary
The vulnerability arises from MISP core controllers and model capture paths accepting client-controlled request fields, such as primary keys and ownership/scope foreign keys, without consistently stripping, pinning, or revalidating them against the server-authorized object. This allows an authenticated user to manipulate object relationships and content, potentially leading to unauthorized modifications across the MISP instance.
Defensive priority
High priority due to critical CVSS score and potential for significant unauthorized modifications
Recommended defensive actions
- Inventory and review MISP instances for exposure
- Apply official patches or updates provided by MISP
- Review and restrict user access and permissions
- Monitor for suspicious activity or anomalies
- Implement compensating controls to limit potential damage
Evidence notes
The CVE record and NVD detail provide information on the vulnerability. Multiple commits in the MISP GitHub repository address this issue, including 00b2e3d, 025f711, and 7acf822. These commits harden affected create/edit/import flows by stripping client-supplied primary keys, re-pinning route- or database-authorized identifiers, validating effective sharing-group scope, and adding field whitelists.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-56422 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-56422
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-56422 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56422
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://github.com/MISP/MISP/commit/00b2e3dae56fa24ea750eb525cc4709b7e5bee85
5a6e4751-2f3f-4070-9419-94fb35b644e8
-
Source reference
Unverified legacy reference
URL: https://github.com/MISP/MISP/commit/025f711506850aadb69cde1b57e5e5d57628c87f
5a6e4751-2f3f-4070-9419-94fb35b644e8
-
Source reference
Unverified legacy reference
URL: https://github.com/MISP/MISP/commit/05aad418c57bb78e6b58a843d70d45de8f50db45
5a6e4751-2f3f-4070-9419-94fb35b644e8
-
Source reference
Unverified legacy reference
URL: https://github.com/MISP/MISP/commit/2cc26f38f3e85c594957899f09043d5193146607
5a6e4751-2f3f-4070-9419-94fb35b644e8
-
Source reference
Unverified legacy reference
URL: https://github.com/MISP/MISP/commit/3ff6bd9cfdab5d41b4667ea7298d88ffd6f3fcb8
5a6e4751-2f3f-4070-9419-94fb35b644e8
-
Source reference
Unverified legacy reference
URL: https://github.com/MISP/MISP/commit/57433015815e59db5a1f11536f90920952cf3fcd
5a6e4751-2f3f-4070-9419-94fb35b644e8
-
Source reference
Unverified legacy reference
URL: https://github.com/MISP/MISP/commit/58f637aaab4d133e72f1454ebb963191d96d3b78
5a6e4751-2f3f-4070-9419-94fb35b644e8
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.