CVE-2026-9136

A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action accepted user-controlled ShadowAttribute request data without removing the id field before saving the record. Because the underlying framework treats a supplied primary key as an instruction to update an existing record, an authenticated user able to submit shadow attribute proposals could provide the identifier of an existing ShadowAttribute and cause that record to be updated instead of creating a new proposal. This can result in unauthorized modification of existing shadow attributes, potentially affecting proposals associated with events the user should not be able to alter. Depending on deployment configuration and accessible API responses, the issue may also expose or move proposal data across event contexts. The vulnerability is caused by trusting a client-supplied primary key during object creation. The fix removes the id field from incoming ShadowAttribute data before processing, ensuring that the endpoint always creates a new proposal rather than updating an existing one. This has been fixed in MISP 2.5.38.

• CWE-639

• https://github.com/MISP/MISP/commit/49911b1d4b6e4517d803e50e3d980aaa4d37c16dPatch

Published

May 20, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9129A path traversal vulnerability exists in the Altium Enterpri…9.4
• CVE-2026-9130IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorizati…7.1
• CVE-2026-9132A missing authorization vulnerability was identified in GitH…6.5
• CVE-2026-9133Active debug code exists in the ARN resolver of amazon-mq ra…8.3
• CVE-2026-9134The FooGallery plugin for WordPress is vulnerable to Stored …6.4
• CVE-2026-9135IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up t…9.9
• CVE-2026-9137The CSP report endpoint in MISP intended to limit logged CSP…7.5
• CVE-2026-9139Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contain…9.8
• CVE-2026-9140A denial-of-service security issue exists in the 1719-AENTR.…8.7
• CVE-2026-9141Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contain…9.8
• CVE-2026-9142There is an insecure default credentials vulnerability in NI…9.3
• CVE-2026-9143There is an incorrect conversion between numeric types vulne…5.3