CVE-2026-103662
Last modified
CVE-2026-103662 is a medium-severity vulnerability rated 5.1/10 on the CVSS scale. MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag). The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site administrator to visit a crafted URL containing a malicious tag name parameter can execute arbitrary JavaScript in the administrator's browser session. Preconditions: - The target must be running a MISP instance with the legacy taxonomy tag confirmation views enabled. - The victim must be an authenticated site administrator. - The victim must navigate to the attacker-crafted URL (e.g., via a phishing link). Security impact: - Execution of arbitrary client-side script in the context of the administrator's browser. - Potential theft of session tokens, CSRF tokens, or other sensitive data accessible from the page. - Potential for performing privileged actions on behalf of the administrator within the MISP interface. Affected versions: <2.5.48..
Description
MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag). The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site administrator to visit a crafted URL containing a malicious tag name parameter can execute arbitrary JavaScript in the administrator's browser session. Preconditions: - The target must be running a MISP instance with the legacy taxonomy tag confirmation views enabled. - The victim must be an authenticated site administrator. - The victim must navigate to the attacker-crafted URL (e.g., via a phishing link). Security impact: - Execution of arbitrary client-side script in the context of the administrator's browser. - Potential theft of session tokens, CSRF tokens, or other sensitive data accessible from the page. - Potential for performing privileged actions on behalf of the administrator within the MISP interface. Affected versions: <2.5.48.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-103662?
How severe is CVE-2026-103662?
How do I fix CVE-2026-103662?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-1036The Photo Gallery by 10Web – Mobile-Friendly Image Gallery p…5.3
- CVE-2026-103641A flaw was found in GEGL. The Radiance HDR loader reads past…5.5
- CVE-2026-103651MISP contains a vulnerability in its one-time password (OTP)…7.6
- CVE-2026-103655MISP contains a vulnerability in its two-factor authenticati…9.3
- CVE-2026-103656Rejected reason: this is rejected
- CVE-2026-103659MISP contains an authorization bypass in the event flattenin…7.1
- CVE-2026-103664MISP contains a reflected cross-site scripting (XSS) vulnera…4.8
- CVE-2026-103678A flaw was found in tnef. An attacker can exploit this vulne…5.4
- CVE-2026-103679A flaw was found in tnef. A remote attacker could exploit th…6.5
- CVE-2026-103680A flaw was found in tnef. A heap-based buffer overflow can o…3.1
- CVE-2026-103686A flaw has been found in rhukster dom-sanitizer up to 1.0.15…3.5
- CVE-2026-103687A vulnerability has been found in rhukster dom-sanitizer up …7.3
Are you affected by CVE-2026-103662?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST