CVE-2026-10868: MISP user edit endpoint mass assignment vulnerability allows unauthorized user account modification
A mass assignment vulnerability exists in the MISP user edit functionality due to insufficient filtering of user-supplied fields in UsersController::edit(). When processing edit requests, the application accepted a user-controlled User.id value from request data. An authenticated attacker could craft a modified request containing another user identifier, potentially causing updates to be applied to an unintended user account. Depending on the editable fields and the attacker’s privileges, this could allow unauthorized modification of user account attributes and impact account integrity.
The issue was addressed by explicitly removing the User.id field from request data before processing the user edit operation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In UsersController::edit(), explicitly unset/remove the 'User.id' field from the incoming request data before applying user edits, so the server does not accept a user-controlled User.id from the request.
MISP (UsersController::edit()) Request data filtering for user edit = Remove User.id from request data before processing edit operation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10868?
CVE-2026-10868 has a risk rating of 47.
How do I fix CVE-2026-10868?
To fix CVE-2026-10868, ensure proper validation and filtering of user-supplied fields in the UsersController::edit() method.
What application is affected by CVE-2026-10868?
CVE-2026-10868 affects the MISP Project (MISP) application.
Can an attacker exploit CVE-2026-10868 without authentication?
No, an attacker needs to be authenticated to exploit CVE-2026-10868.
What type of vulnerability is CVE-2026-10868?
CVE-2026-10868 is a mass assignment vulnerability that allows unauthorized user account modification.