CVE-2026-103662: MISP Reflected XSS in Taxonomy Tag Confirmation Forms

Q: Which deployments are exposed to this issue?

MISP versions earlier than 2.5.48 are affected only when the legacy taxonomy tag confirmation views are enabled. Exploitation also requires an authenticated site administrator to load an attacker-crafted URL.

Q: Does an attacker need an account or direct access to the MISP instance?

No attacker authentication is described as necessary. The attacker must be able to persuade an authenticated site administrator to navigate to a crafted URL containing a malicious tag name parameter.

Q: What could an attacker do if exploitation succeeds?

The attacker can execute JavaScript in the administrator's browser context. This may expose session or CSRF tokens and allow privileged actions to be performed through the MISP interface as that administrator.

Q: What is the immediate mitigation if an upgrade is not possible?

Disable the legacy taxonomy tag confirmation views if they are enabled. Administrators should also avoid opening untrusted links to the MISP instance, since exploitation relies on navigating to a crafted URL.

Published Oct 1, 2026

Updated

MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag).

The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site administrator to visit a crafted URL containing a malicious tag name parameter can execute arbitrary JavaScript in the administrator's browser session.

Preconditions:

- The target must be running a MISP instance with the legacy taxonomy tag confirmation views enabled.

- The victim must be an authenticated site administrator.

- The victim must navigate to the attacker-crafted URL (e.g., via a phishing link).

Security impact:

- Execution of arbitrary client-side script in the context of the administrator's browser.

- Potential theft of session tokens, CSRF tokens, or other sensitive data accessible from the page.

- Potential for performing privileged actions on behalf of the administrator within the MISP interface.

Affected versions: <2.5.48.

Affected Software

1 affected component

Misp Misp<2.5.48

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade MISP to a version that resolves this vulnerability.
Fixed in 2.5.48

Event History

Oct 1, 2026

CVE Published

via MITRE·08:48 AM

Data Sourced

via MITRE·08:48 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

MISP versions earlier than 2.5.48 are affected only when the legacy taxonomy tag confirmation views are enabled. Exploitation also requires an authenticated site administrator to load an attacker-crafted URL.

Does an attacker need an account or direct access to the MISP instance?

No attacker authentication is described as necessary. The attacker must be able to persuade an authenticated site administrator to navigate to a crafted URL containing a malicious tag name parameter.

What could an attacker do if exploitation succeeds?

The attacker can execute JavaScript in the administrator's browser context. This may expose session or CSRF tokens and allow privileged actions to be performed through the MISP interface as that administrator.

What is the immediate mitigation if an upgrade is not possible?

Disable the legacy taxonomy tag confirmation views if they are enabled. Administrators should also avoid opening untrusted links to the MISP instance, since exploitation relies on navigating to a crafted URL.

CVE-2026-103662: MISP Reflected XSS in Taxonomy Tag Confirmation Forms

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

Does an attacker need an account or direct access to the MISP instance?

What could an attacker do if exploitation succeeds?

What is the immediate mitigation if an upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

Does an attacker need an account or direct access to the MISP instance?

What could an attacker do if exploitation succeeds?

What is the immediate mitigation if an upgrade is not possible?