External risk intelligence

MISP Object Overwrite and Unauthorized Sharing Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-56422

MISP (Malware Information Sharing Platform) is a collaborative platform designed to be accessed over networks by multiple users and external systems to share threat intelligence. It is commonly deployed as a web-based service or API endpoint intended to be reachable by authorized remote users or peer organizations, placing the web application interface directly within the reachable surface.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in MISP core controllers allows authenticated users to manipulate data ownership and sharing permissions by submitting crafted requests. This could lead to unauthorized modification or access of sensitive information within the platform.

Unauthenticated data manipulation risks.
Critical for maintaining data integrity and trust.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access to one object could manipulate requests to save data onto different objects. This could allow them to overwrite or take ownership of other users' data, inject content, or alter sharing permissions. The vulnerability lies in how the system handles client-provided identifiers for objects and their relationships, which are not always properly validated server-side before data modification occurs.

Authenticated user access required.
Crafted request payloads trigger vulnerability.
Data corruption and unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

An authenticated user could manipulate requests to save data against objects not intended for them, potentially altering or overwriting existing information or misattributing ownership within the MISP platform. This could occur when the platform does not properly validate or re-pin identifiers during save operations.

Threat intelligence data could be altered.
Data could be saved to unintended objects.
Unauthorized information access may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership likely falls to the MISP platform administrators or the security team managing the threat intelligence infrastructure. The first practical step is to identify all MISP instances, assess their network exposure and business criticality, and confirm the accountable owner for each before planning remediation.

Platform administrators should own the issue.
Verify all MISP instances and exposure.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MISP and how is it used?

MISP, the Malware Information Sharing Platform, is a specialized web-based application designed for organizations to share threat intelligence. It allows users and automated systems to securely exchange data about threats, such as indicators of compromise, to improve collaborative defense and incident response across networks.

What does CVE-2026-56422 mean in plain English?

This vulnerability is classified as CWE-639, or Authorization Bypass Through User-Controlled Key. It occurs because the software fails to re-verify which object a user is allowed to edit before saving changes. Consequently, an authenticated user can trick the system into modifying or overwriting data in records they are not authorized to access, effectively bypassing intended ownership and security boundaries.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending specially crafted REST or form payloads to the application. They must have existing authenticated access to at least one object in the system. The bug is triggered when the application accepts client-supplied identifiers—such as IDs for events or users—without re-pinning or validating them against the server-authorized record before performing a database save operation.

Why is this CVE considered relevant to my organization?

Halo Surface Signal indicates this is an external-facing risk because MISP is typically deployed as a web service accessible to remote users and partner organizations. Since the platform is designed to be reachable over the network, these sensitive internal data controls are effectively within the reachable surface, making the application's integrity critical for maintaining trusted intelligence sharing.

What is the first step to address this risk?

Platform administrators should begin by creating a comprehensive inventory of all deployed MISP instances within their environment. Once the instances are identified, assess the network reachability of each one and confirm the business owners responsible for them. This preparation allows security teams to prioritize and plan for the necessary software updates to harden the core controller logic.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.