PT-2026-46254 · Misp · Misp

Andras Iklody + 1 · CVE-2026-10868 · Published 2026-06-04 · Updated 2026-06-08

Positive Technologies (AI Summary)

CVSS v4.0

9.0

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description A mass assignment issue exists in the user edit functionality. The application fails to sufficiently filter user-supplied fields in the UsersController::edit() function, allowing it to accept a user-controlled User.id value from request data. An authenticated attacker can craft a modified request containing a different user identifier to apply updates to an unintended account. This may lead to unauthorized modification of user account attributes and compromise account integrity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-10868

Affected Products

Misp

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10868.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-10868 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-10868 · Security Note
• https://github.com/MISP/MISP/commit/1be8c413b7104a889dfd30c5b1986e3ab17238e8 · Note
• https://twitter.com/CCBalert/status/2063902221574578536 · Twitter Post