CVE-2026-103239

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.48

Description A privilege escalation issue exists in the tag collection creation and editing functionality. The system accepts the full HTTP request payload and passes it to a bulk-association save operation, which writes both the intended tag collection record and any other associated model data included in the payload. An authenticated user with the perm tag editor permission can craft a request containing additional model data, such as User or Organisation records. Since the save operation processes all associated models indiscriminately, these injected records are written to the database, allowing the attacker to create or modify privileged accounts and escalate their privileges to site administrator.

Recommendations Update to version 2.5.48 or later.