CVE-2026-10868

A mass assignment vulnerability exists in the MISP user edit functionality due to insufficient filtering of user-supplied fields in UsersController::edit(). When processing edit requests, the application accepted a user-controlled User.id value from request data. An authenticated attacker could craft a modified request containing another user identifier, potentially causing updates to be applied to an unintended user account. Depending on the editable fields and the attacker’s privileges, this could allow unauthorized modification of user account attributes and impact account integrity. The issue was addressed by explicitly removing the User.id field from request data before processing the user edit operation.

• CWE-269

• https://github.com/MISP/MISP/commit/1be8c413b7104a889dfd30c5b1986e3ab17238e8

Published

Jun 4, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10860A logic error in the MISP CRUD component delete handler allo…6.5
• CVE-2026-10861An open redirect vulnerability existed in MISP UsersControll…6.1
• CVE-2026-10862The Accordions plugin for WordPress is vulnerable to Stored …6.4
• CVE-2026-10863A security issue was fixed in the correlations over-correlat…8.1
• CVE-2026-10864A vulnerability in the MISP dashboard widgets allowed an aut…4.3
• CVE-2026-10865The Cost Calculator Builder plugin for WordPress is vulnerab…5.3
• CVE-2026-1087The Guardian News Feed plugin for WordPress is vulnerable to…4.3
• CVE-2026-10870A flaw has been found in Shibby Tomato 1.28.0000. This affec…7.3
• CVE-2026-10871A vulnerability has been found in Shibby Tomato 1.28.0000. T…7.3
• CVE-2026-10872A vulnerability was found in Shibby Tomato 1.28.0000. This i…7.3
• CVE-2026-10873A vulnerability was determined in Shibby Tomato 1.28.0000. I…7.3
• CVE-2026-10874A vulnerability was identified in projectworlds Online Art G…6.3