Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-95659

MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread

CVSS 4.0 4.8 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-95659

Published

MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim's browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim. The vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme's AnalystData thread element. Version affected: <2.5.47

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-95659

Published

MISP

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "modules": [
                        "AnalystDataController",
                        "Overmind theme AnalystData thread element"
                    ],
                    "product": "MISP",
                    "programFiles": [
                        "app/Controller/AnalystDataController.php",
                        "app/View/Themed/Overmind/Elements/AnalystData/thread.ctp"
                    ],
                    "repo": "https://github.com/MISP/MISP",
                    "vendor": "MISP",
                    "versions": [
                        {
                            "lessThan": "2.5.47",
                            "status": "affected",
                            "version": "0",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON