PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-56422 misp CVE debrief

CVE-2026-56422 is a critical vulnerability with a CVSS score of 9.4, affecting MISP core controllers and model capture paths. An authenticated user with access to one authorized object could submit crafted REST or form payloads, causing MISP to save data against a different object than the one checked by the authorization logic. This could lead to object overwrite, object re-parenting, ownership transfer, unauthorized sharing-group scoping, event/object injection, proposal retargeting, or stored attacker-controlled content appearing in another user's context.

Vendor
misp
Product
Unknown
CVSS
CRITICAL 9.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-22
Original CVE updated
2026-06-22
Advisory published
2026-06-22
Advisory updated
2026-06-22

Who should care

Defenders of MISP installations, security teams, and administrators responsible for MISP servers should prioritize addressing this vulnerability. Given the critical severity and potential impact, immediate attention is necessary to limit exposure.

Technical summary

The vulnerability arises from MISP core controllers and model capture paths accepting client-controlled request fields, such as primary keys and ownership/scope foreign keys, without consistently stripping, pinning, or revalidating them against the server-authorized object. This allows an authenticated user to manipulate object relationships and content, potentially leading to unauthorized modifications across the MISP instance.

Defensive priority

High priority due to critical CVSS score and potential for significant unauthorized modifications

Recommended defensive actions

  • Inventory and review MISP instances for exposure
  • Apply official patches or updates provided by MISP
  • Review and restrict user access and permissions
  • Monitor for suspicious activity or anomalies
  • Implement compensating controls to limit potential damage

Evidence notes

The CVE record and NVD detail provide information on the vulnerability. Multiple commits in the MISP GitHub repository address this issue, including 00b2e3d, 025f711, and 7acf822. These commits harden affected create/edit/import flows by stripping client-supplied primary keys, re-pinning route- or database-authorized identifiers, validating effective sharing-group scope, and adding field whitelists.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-56422 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-56422

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-56422 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56422

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/MISP/MISP/commit/00b2e3dae56fa24ea750eb525cc4709b7e5bee85

    5a6e4751-2f3f-4070-9419-94fb35b644e8

  • Source reference

    Unverified legacy reference

    URL: https://github.com/MISP/MISP/commit/025f711506850aadb69cde1b57e5e5d57628c87f

    5a6e4751-2f3f-4070-9419-94fb35b644e8

  • Source reference

    Unverified legacy reference

    URL: https://github.com/MISP/MISP/commit/05aad418c57bb78e6b58a843d70d45de8f50db45

    5a6e4751-2f3f-4070-9419-94fb35b644e8

  • Source reference

    Unverified legacy reference

    URL: https://github.com/MISP/MISP/commit/2cc26f38f3e85c594957899f09043d5193146607

    5a6e4751-2f3f-4070-9419-94fb35b644e8

  • Source reference

    Unverified legacy reference

    URL: https://github.com/MISP/MISP/commit/3ff6bd9cfdab5d41b4667ea7298d88ffd6f3fcb8

    5a6e4751-2f3f-4070-9419-94fb35b644e8

  • Source reference

    Unverified legacy reference

    URL: https://github.com/MISP/MISP/commit/57433015815e59db5a1f11536f90920952cf3fcd

    5a6e4751-2f3f-4070-9419-94fb35b644e8

  • Source reference

    Unverified legacy reference

    URL: https://github.com/MISP/MISP/commit/58f637aaab4d133e72f1454ebb963191d96d3b78

    5a6e4751-2f3f-4070-9419-94fb35b644e8

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.