CVE-2026-56422: MISP IDOR via Client-Controlled Object Identifiers in Save Paths
CVE-2026-56422 affects several MISP core controllers and model capture paths, where client-supplied primary keys and ownership or scope foreign keys were not consistently pinned to the authorized object. An authenticated user with access to one object could, in affected paths, cause MISP to save data against a different object. The record reports a CNA CVSS 4.0 score of 9.4, no KEV listing, and no affected or fixed version ranges.
Overview
CVE-2026-56422 is a broken object-level authorization issue classified as CWE-639 (authorization bypass through a user-controlled key). The record states that several MISP core controllers and model capture paths accepted client-supplied identifiers without consistently stripping, pinning or revalidating them against the object the server had authorized.
Impact
An authenticated user with access to one authorized object could, in affected paths, submit crafted REST or form requests that made MISP save data against a different object. Depending on the endpoint, the record lists possible outcomes such as object overwrite, re-parenting, ownership transfer, unauthorized sharing-group scoping, event or object injection, proposal retargeting and stored content appearing in another user's context.
Affected products and versions
The affected product is MISP. The record does not list affected or fixed version ranges, and it does not enumerate the specific vulnerable endpoints.
- Affected product: MISP
- Affected versions: unknown from the record
- Fixed versions: unknown from the record
The record links multiple MISP commits on GitHub. Operators should use those commits and the upstream project to determine exact version boundaries.
Exploitation status
The CISA KEV entry in the record is not listed. No confirmed exploitation appears in the sources consulted for this analysis. This status may change, so the entry should be rechecked as new information is published.
Remediation and mitigation
The record describes fixes that strip client-supplied primary keys on create-only saves, re-pin authorized identifiers before save operations, validate effective sharing-group scope and apply field whitelists to ownership fields. The upstream patch for the central CRUDComponent::edit() issue is referenced in the GitHub commit 7acf8220.
- Identify the MISP release that includes these commits and plan an update.
- Restrict account creation and access for users until the update is applied, since exploitation requires an authenticated account.
- Review the organisation and sharing-group configuration of users who hold broad edit rights.
Detection guidance
- Review audit logs for create and edit operations where the identifier in the saved record differs from the object the user was authorized to access.
- Look for unexpected changes to ownership, organisation, sharing-group or parent-event associations on existing objects.
- Watch for content appearing in one user's scope that was created or modified from another user's context.
Limitations of the available information
The record does not provide affected or fixed version numbers, a list of specific vulnerable endpoints, EPSS or SSVC data, or details of observed exploitation. The CVSS 4.0 score of 9.4 is provided by the CNA, and the environmental and threat metrics in the vector are set to X (not defined). This analysis relies only on the record and the cited references.
Frequently asked questions
What is CVE-2026-56422?
It is an authorization bypass (IDOR, CWE-639) in several MISP core controllers and model capture paths, where client-supplied identifiers were not consistently pinned to the authorized object.
Is CVE-2026-56422 known to be actively exploited?
The record shows no KEV listing, and no confirmed exploitation appears in the sources consulted for this analysis. The status should be rechecked as new information is published.
Which MISP versions are affected?
The record does not list affected or fixed version ranges. Use the linked MISP commits and the upstream project to determine exact boundaries.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.