CVE-2026-95682
Deferred Deferred - Pending Action

Stored XSS in MISP Admin Email Composition

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: CIRCL

Description
MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = "<?php echo $org;?>";. Because the value was placed inside a double-quoted JavaScript string without any encoding, an organization name containing a double-quote character (or a backslash) could terminate the string literal and inject arbitrary JavaScript into the page. The injected script would execute in the context of any authenticated user who subsequently loads the admin email page, potentially allowing session hijacking, data exfiltration, or privileged actions performed on behalf of the victim. Exploitation requires the ability to set or modify the MISP.org organization name and a second authenticated user visiting the affected admin email view. The vulnerability is a classic instance of insufficient output encoding in a JavaScript context.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-95682
EUVD
EUVD-2026-84399

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MISP has a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The organization name setting was directly inserted into a JavaScript string without proper escaping. If the organization name contains a double quote or backslash, it could break out of the string and inject malicious JavaScript code. This code would run when any authenticated user views the admin email page.

Detection Guidance

To detect this vulnerability, check if the MISP admin email composition screen reflects the organization name in JavaScript without proper escaping. Inspect the page source for code like 'var org = "<?php echo $org;?>";' where $org is not encoded. Also review the commit history for changes related to org name handling in admin email scripts.

Impact Analysis

An attacker could set a malicious organization name to inject JavaScript. When an authenticated user visits the admin email page, the script executes in their session. This could allow session hijacking, stealing sensitive data, or performing actions on behalf of the victim.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection principles or HIPAA's security requirements for protected health information. The stored XSS could allow attackers to exfiltrate data or perform privileged actions, potentially resulting in non-compliance with these regulations.

Mitigation Strategies

Apply the patch from the MISP commit that uses json_encode with HTML-safe flags to escape the organization name before including it in JavaScript. Ensure no untrusted input is directly echoed into JavaScript string literals without proper encoding.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95682. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart