CVE-2026-95659: MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread
MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim's browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.
The vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme's AnalystData thread element.
Version affected: <2.5.47
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.47
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authenticated MISP users who can be persuaded to open a crafted URL are exposed. The injected JavaScript runs in the victim's browser in the MISP application context.
What must an attacker do to exploit it?
The attacker must be authenticated and must induce an authenticated victim to actively visit an attacker-supplied URL containing a crafted parent object type parameter. No exploit occurs unless the victim navigates to that URL.
Which installations are affected?
MISP versions earlier than 2.5.47 are affected. The vulnerable path involves AnalystDataController::viewForObject and the Overmind-themed AnalystData thread element.
How can teams reduce risk before updating?
The provided information identifies exploitation as requiring a victim to follow a crafted URL while authenticated. Until updating, reduce exposure to untrusted links and treat unexpected MISP URLs as potentially malicious.