CVE-2026-10868
A critical vulnerability in the MISP user edit feature allows an attacker to change another user's account by supplying a different User.id in the request. The flaw arises from insufficient filtering of user-supplied data, enabling unauthorized modifications of account attributes. The issue has been fixed by removing the User.id field from the request before processing edits.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
The vulnerability affects the MISP platform’s user editing functionality, regardless of specific version, as the flaw exists in the UsersController::edit() method.
Real-world impact
An attacker who can authenticate to the system could craft a request that updates another user's account, potentially altering permissions, email addresses, or other sensitive settings, thereby compromising account integrity.
Why this severity
The CVSS score of 9 reflects a network-based attack with low complexity, no privileges required, and no user interaction. The vulnerability allows an attacker to modify user data, which is a high-impact action, leading to a critical rating.
What to do about it
- 01Apply the vendor-provided patch that removes the User.id field from request data before processing user edits.
NVD-referenced vendor advisory
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.
- Jul 24, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.