Improper Input Validation in MISP Affects Data Integrity
CVE-2026-103237

8.3HIGH

Key Information:

Vendor

Misp

Status
Misp
Vendor
CVE Published:
30 September 2026

What is CVE-2026-103237?

The MISP platform is impacted by an improper input validation vulnerability in its Object-Relational Mapping (ORM) save path. This issue allows authenticated users with basic write permissions to exploit the system by crafting requests that embed nested blocks under model alias keys. Despite the sanitization processes in place, which involve the removal of primary keys and pinning of identifiers to a caller’s context, the ORM incorrectly prioritizes nested keys. As a result, attackers can overwrite, re-parent, or soft-delete data belonging to other users or events, compromising data integrity across a range of entities such as Attributes, EventReports, and Sightings. This vulnerability underscores the risks of inadequate input validation, making it essential for users to upgrade to versions that have mitigated these flaws.

Affected Version(s)

MISP 0 < 2.5.48

References

https://github.com/MISP/MISP/commit/9485ae40d
patch

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jeroen Pinoy
iglocska
Claude Opus 5
.