CVE-2026-95682

MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = "<?php echo $org;?>";. Because the value was placed inside a double-quoted JavaScript string without any encoding, an organization name containing a double-quote character (or a backslash) could terminate the string literal and inject arbitrary JavaScript into the page. The injected script would execute in the context of any authenticated user who subsequently loads the admin email page, potentially allowing session hijacking, data exfiltration, or privileged actions performed on behalf of the victim. Exploitation requires the ability to set or modify the MISP.org organization name and a second authenticated user visiting the affected admin email view. The vulnerability is a classic instance of insufficient output encoding in a JavaScript context.

• CWE-79

• https://github.com/MISP/MISP/commit/5d6ace65e

Published

Sep 22, 2026

Last Modified

Sep 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-95671In MISP, the CollectionsController add() method enforced the…5.3
• CVE-2026-95674In MISP, the queryEnrichment method in EventsController.php …5.3
• CVE-2026-95675D-Link DAP-1360 firmware version 6.14 and earlier contains a…9.8
• CVE-2026-95676A missing/improper authentication vulnerability in the Watch…7.4
• CVE-2026-95679MISP's RequestHandlerComponent automatically decodes XML req…6.9
• CVE-2026-9568A weakness has been identified in ThingsBoard up to 4.3.1.1.…5
• CVE-2026-95683In MISP, the Overmind event view enriches an event with its …5.3
• CVE-2026-95685MISP contains an access control flaw in the EventReports fun…5.3
• CVE-2026-95693In MISP, the EventReport::uploadPicture method in processed …5.3
• CVE-2026-95697MISP contains an authorization flaw in the Organisation mode…5.3
• CVE-2026-95698The findOrgImage method in MISP's OrgImgHelper constructs a …5.3
• CVE-2026-9570The Taskbuilder WordPress plugin before 5.0.8 does not prop…7.1