Executive Summary

CVE-2026-56422 is a mass assignment vulnerability in the MISP (Malware Information Sharing Platform) software. It occurs because multiple core controllers and model capture paths accepted client-controlled request fields such as primary keys and ownership or scope foreign keys without properly stripping, pinning, or revalidating them against server-authorized objects.

This flaw allows an authenticated user with access to one authorized object to craft REST or form payloads that cause MISP to save data against a different object than the one checked by authorization logic. This can lead to unauthorized overwrites, re-parenting, ownership transfers, sharing-group scoping bypasses, event or object injection, proposal retargeting, or stored attacker-controlled content appearing in another user's context.

The root cause is that the system trusted client-supplied IDs (like primary keys or foreign keys) in requests, which CakePHP then used to update arbitrary rows in the database. Fixes involved stripping client-supplied primary keys on create-only saves, re-pinning route- or database-authorized identifiers before save operations, validating sharing-group scope, and adding field whitelists to prevent editing of ownership fields.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized modification or overwriting of data objects within MISP that a user should not have access to.

• An attacker can overwrite or re-parent objects, effectively transferring ownership or changing the scope of data without authorization.
• It can allow injection of events or objects into contexts where the attacker has no permission, potentially corrupting data or misleading users.
• Unauthorized sharing-group scoping can occur, allowing attackers to assign data to sharing groups they do not belong to, bypassing access controls.
• Attackers with site-admin privileges can manipulate imports or server configurations, such as changing sync URLs or authentication keys, without proper authorization.
• Stored attacker-controlled content may appear in other users' contexts, potentially leading to data leakage or trust violations.

Useful 0 Not Useful 0

Detection Guidance

The CVE-2026-56422 vulnerability involves mass assignment issues in the MISP platform where client-controlled fields such as primary keys and ownership/scope foreign keys are accepted without proper validation. Detection involves monitoring for unusual or unauthorized modifications to objects such as events, attributes, servers, taxonomies, workflows, proposals, and sharing groups that could indicate exploitation attempts.

Specifically, detection can focus on identifying crafted REST or form payloads that include unexpected or manipulated fields like 'id', 'event_id', 'org_id', 'user_id', 'sharing_group_id', or 'galaxy_cluster_uuid' that cause unauthorized overwrites, re-parenting, or ownership transfers.

While the provided resources do not include explicit detection commands, network or system administrators can monitor HTTP request logs for suspicious API calls to endpoints such as '/attributes/import', '/servers/add', '/taxonomies/import', '/shadowAttributes/add', '/workflow/add', '/templates/add', and others mentioned in the fixes. Look for requests containing unexpected primary key fields or ownership identifiers in the request body.

Additionally, monitoring audit logs for unexpected changes in event ownership, sharing groups, or attribute assignments can help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps involve applying the security patches that address the mass assignment vulnerabilities in MISP. These patches harden the affected create/edit/import flows by:

• Stripping client-supplied primary keys (such as 'id') on create-only saves to prevent unauthorized updates.
• Re-pinning route- or database-authorized identifiers before save operations to ensure data is saved only to authorized objects.
• Validating effective sharing-group scope and ownership fields to prevent unauthorized sharing-group assignments or ownership transfers.
• Adding field whitelists where ownership fields must never be editable by clients.

Administrators should update their MISP installations to the fixed versions that include these patches, as described in the referenced commits. Until patches are applied, restrict access to MISP APIs and monitor for suspicious activity as a temporary measure.

Useful 0 Not Useful 0

Compliance Impact

The CVE-2026-56422 vulnerability in MISP involves mass assignment issues that allow authenticated users to manipulate data objects beyond their authorized scope. This can lead to unauthorized data overwrites, ownership transfers, event or object injections, and unauthorized sharing group re-scoping.

Such unauthorized data modifications and access control bypasses can undermine data integrity and confidentiality, which are critical requirements under common standards and regulations like GDPR and HIPAA. Specifically, the vulnerability could allow attackers to alter or expose sensitive information by injecting or overwriting data in objects they should not control.

Therefore, this vulnerability poses a risk to compliance with data protection regulations by potentially enabling unauthorized access, modification, or sharing of protected data, violating principles of data minimization, integrity, and access control.

Useful 0 Not Useful 0