CVE-2026-56422

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description Multiple core controllers and model capture paths accept client-controlled request fields, including primary keys (id) and ownership or scope foreign keys such as event id, org id, user id, sharing group id, galaxy cluster uuid, organisation uuid, and related nested object identifiers, without consistent stripping, pinning, or revalidation against server-authorized objects. An authenticated user with access to one authorized object can submit crafted REST or form payloads to save data against a different object than the one verified by authorization logic. This can lead to object overwrite, object re-parenting, ownership transfer, unauthorized sharing-group scoping, event or object injection, proposal retargeting, or stored attacker-controlled content appearing in another user's context. The issue stems from the CRUDComponent::edit() function copying supplied fields, including a payload primary key, onto the loaded record, which allows the CakePHP save() function to update an arbitrary row if the loaded ID is not re-pinned.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.