External risk intelligence

MISP User Edit Mass Assignment Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-10868

MISP is commonly deployed as a web-based threat intelligence platform. While the vulnerability requires an authenticated session, the application itself is frequently exposed to the network or the internet to facilitate collaborative threat data exchange and integration with external security infrastructure.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in MISP could allow an authenticated attacker to modify unintended user accounts by exploiting a flaw in how user edits are processed. This could lead to unauthorized changes in user account attributes and impact account integrity.

Unauthorized account changes possible.
Affects user data integrity.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access could exploit this vulnerability by sending a specially crafted request to the user edit function. This request would manipulate the request data to target a different user's account for modification. The vulnerability arises from insufficient filtering of user-supplied fields, allowing an attacker to potentially alter another user's account attributes, impacting its integrity.

Requires authenticated access.
Triggers via manipulated edit request data.
Risk of unauthorized account changes.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an authenticated attacker to modify the attributes of another user's account. This occurs when the application processes user edit requests without sufficiently filtering user-supplied fields, accepting a user-controlled identifier to update unintended accounts. Depending on the editable fields and the attacker's privileges, this could impact account integrity.

User account attributes at risk.
Unintended account updates via crafted requests.
Compromised account integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

Security and platform teams are most likely responsible for addressing this vulnerability in the MISP application. The first practical step is to identify all instances of MISP, confirm their network reachability and business criticality, and then locate the accountable owner to plan remediation based on risk.

Identify and catalog all MISP instances.
Verify network exposure and business impact.
Coordinate with vendor for patching or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MISP?

MISP is a widely used, open-source threat intelligence platform designed for gathering, correlating, and sharing cybersecurity indicators. Organizations deploy it to facilitate collaborative threat data exchange among security teams, allowing them to integrate intelligence directly into their defensive infrastructure.

What does mass assignment mean for CVE-2026-10868?

This vulnerability, classified as CWE-269, occurs when an application automatically binds user-provided input to internal data models without sufficient filtering. In this case, the MISP edit function mistakenly accepts a user-supplied identifier, potentially allowing an authenticated attacker to overwrite account details belonging to a different user.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted request to the user edit endpoint, injecting a different user's ID into the data payload. Note that this requires an existing authenticated session; the bug is not triggered by public, unauthenticated access or by simply browsing the interface without submitting a manipulated update request.

Is my instance relevant according to Halo Surface Signal?

Yes, Halo Surface Signal identifies this as a relevant risk because MISP is typically deployed as a network-accessible web application. Since platforms like MISP are often intentionally exposed to the internet or wide internal networks to support collaborative data sharing, they are more likely to be reachable by an authenticated actor seeking to exploit this flaw.

When should I take action for this vulnerability?

You should begin by locating all MISP deployments in your environment and assessing their network connectivity and criticality. Once identified, coordinate with your system owners to review the latest vendor guidance and prioritize applying the necessary security updates to ensure user account integrity.

References

github.com/MISP/MISP/commit/1be8c413b7104a889dfd30c5b1986e3ab172…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.