MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints (attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit), the application sanitizes the flat record by stripping the primary key and pinning the event_id or object_id to the caller's context. However, the underlying ORM's set() method gives priority to a nested key whose name matches the model alias and discards the outer scalar fields. An authenticated user with basic write permissions can exploit this by embedding a nested block under the model alias key inside their request. The sanitization logic (id removal, event_id pinning) is applied to the outer record, but the ORM binds to the inner record instead, which carries an attacker-chosen id and event_id. This allows the attacker to overwrite, re-parent, or soft-delete rows belonging to other organizations or events they have no read access to. Impact: - Cross-tenant data integrity compromise (attribute values rewritten, objects re-parented to attacker events, rows soft-deleted) - Affects multiple entity types: Attribute, Object, EventReport, Sighting, AttributeTag, ShadowAttribute - Requires only a low-privilege authenticated account with perm_add Affected versions: <2.5.48
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA MISP (MISP) Fixed in 2.5.48
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
MISP 2.5.48
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2026-65615 MISP Tag Collection Save Allows Privilege Escalation via Sibling Model InjectionPriority LOW 39
- TI-2026-65613 MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary EventsPriority LOW 39
- TI-2026-65668 MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview ImagePriority LOW 36
Timeline
- 2026-10-02 Threatist record created from CVE-2026-103237
- 2026-10-03 Alias added: GHSA-52c6-qg88-jh84
References
Patch 1
More MISP vulnerabilities
- TI-2025-41517 In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. CVSS 3.1CRITICAL 9.0
- TI-2026-65744 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period CVSS 4.0CRITICAL 9.3
- TI-2026-54145 Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library CVSS 4.0HIGH 8.8
- TI-2020-10250 MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case. CVSS 3.1CRITICAL 9.8
- TI-2026-59159 MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding CVSS 4.0HIGH 8.7
- TI-2026-58541 MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials CVSS 4.0CRITICAL 9.5
Sources
- CVE-2026-103237 · CVE Program
- CVE-2026-103237 · NVD
- FIRST EPSS
- GHSA-52c6-qg88-jh84 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences