MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread

published 2026-09-22 48 d ago modified 2026-09-22 47 d ago also EUVD-2026-84372

cvss: 4.8; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 33%
public exploits: 0; none known

MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim's browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.

The vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme's AnalystData thread element.

Version affected: <2.5.47

Patch / fix

fixed in 1 links 1

MISP MISP 2.5.47

github.com/MISP/MISP@23b8790 commit

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 47 d ago (2026-09-22)

Exploit prediction

0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	4.8	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CNA	4.0	4.8	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

MISP MISP

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation
CWE-116 Improper Encoding or Escaping of Output
CWE-20 Improper Input Validation

References

github.com /MISP/MISP/commit/23b879073
patch

Sources

CVE List CVE-2026-95659
NVD CVE-2026-95659

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary