CVE-2026-103239

Executive Summary

CVE-2026-103239 is a privilege escalation vulnerability in the tag collection creation and editing functionality of MISP (Malware Information Sharing Platform). An authenticated user holding only the tag editor permission (perm_tag_editor) can craft a request that injects additional associated model data — such as User or Organisation records — into a bulk-association save operation, writing attacker-controlled records to the database. Successful exploitation allows unauthorized creation or modification of User and Organisation records and escalation from tag editor to site administrator.

Technical Analysis

The vulnerability resides in MISP's tag collection creation and editing actions. According to the NVD description, the affected actions "accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any associated model data present in the payload."

This is a mass-assignment / improper input validation flaw (classified under CWE-284, Improper Access Control). The root cause is that the save logic does not constrain which associated models may be written from a tag-collection request context. Instead of binding only the fields relevant to the TagCollection model, the bulk-association save operation processes all associated models indiscriminately. As a result, sibling records included in the same payload — such as User or Organisation records — are persisted to the database alongside the tag collection.

The critical security gap is the absence of an authorization boundary between a low-privileged action (tag editor) and the models that the underlying save routine can write. A user with perm_tag_editor is intended only to manage tag collections, but because the save operation honors arbitrary associated model data in the request body, that user can effectively drive writes to higher-privileged models. No specific function names, class names, endpoint paths, or parameter names beyond perm_tag_editor are provided in the source data, so the exact implementation identifiers cannot be stated with confidence.

Affected versions are those below 2.5.48. No CVSS score or vector was assigned in the provided data; no EPSS score has been published by FIRST.org, and the CVE is not listed in CISA KEV. No public proof-of-concept, Nuclei template, or exploit code was observed at the time of reporting, though the low complexity of crafting an authenticated HTTP request makes private exploitation plausible.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (mass assignment / improper access control via bulk association save).

1. Reconnaissance / target identification: The attacker identifies a reachable MISP instance (typically exposed web interface) and obtains an authenticated account provisioned with the tag editor permission (perm_tag_editor). This level of access is commonly granted to analysts or contributors who are not full administrators.

2. Triggering the flaw class: The attacker navigates to the tag collection creation or editing functionality and inspects the request payload structure. Because the affected actions accept the full HTTP request payload, the attacker determines that additional associated model fields can be appended to the request body beyond the intended tag collection fields.

3. Payload / execution: The attacker crafts a request that contains the legitimate tag collection fields plus injected sibling model data referring to User and/or Organisation records. The payload is submitted to the tag collection create/edit action. The bulk-association save operation, which processes all associated models indiscriminately, writes the injected sibling records to the database. At the vulnerability-class level, this is mass assignment: unauthorized model attributes are bound and persisted because the save routine does not restrict writable associations to the TagCollection scope.

4. Post-exploitation impact: The injected User/Organisation writes enable the attacker to create or modify privileged accounts — for example, altering an existing account or creating a new one with elevated privileges — escalating from tag editor to site administrator. Once administrative access is achieved, the attacker can control MISP configuration, data sharing, and user management across the platform.

Impact Assessment

The impact is a vertical privilege escalation from a constrained role (perm_tag_editor) to site administrator, with unauthorized creation or modification of User and Organisation records. This yields full compromise of the MISP instance's integrity and confidentiality controls: an attacker can create administrator accounts, modify existing users and organisations, and thereby access or manipulate shared threat intelligence data.

Because the provided data assigns no CVSS score, subscores cannot be cited from an authoritative vector; the estimated vector in METADATA (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network reachability, low attack complexity, low privileges required, and high confidentiality and integrity impact, with no availability impact assumed. Blast radius is bounded by the sharing communities and connected MISP instances synchronized with the compromised server. MISP is widely deployed in CERTs, SOCs, and ISACs, so a compromised instance can expose sensitive indicators and sharing relationships to the attacker.

Detection Guidance

Sigma Rule

title: Potential MISP Tag Collection Privilege Escalation via Bulk-Association Payload
id: 8f3c1a2e-5b7d-4c9e-9a11-0d2e6f4b7c31
status: experimental
description: Detects requests to MISP tag collection create/edit actions whose payloads contain injected associated model data (User or Organisation records), indicative of CVE-2026-103239.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103239
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: misp
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/tag_collections/add'
      - '/tag_collections/edit'
  selection_payload:
    cs-uri-query|contains|all:
      - 'User'
      - 'Organisation'
  condition: selection_endpoint and selection_payload
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate administrative maintenance of tag collections
level: high
tags:
  - attack.t1068
  - cve.2026.103239

YARA Rule

rule CVE_2026_103239_MISP_TagCollection_Injection
{
    meta:
        description = "Detects HTTP request bodies targeting MISP tag collection actions with injected associated model data (CVE-2026-103239)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103239"
        cve = "CVE-2026-103239"

    strings:
        $ep1 = "tag_collections/add" ascii nocase
        $ep2 = "tag_collections/edit" ascii nocase
        $model1 = "User" ascii
        $model2 = "Organisation" ascii

    condition:
        any of ($ep*) and any of ($model*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103239 MISP Tag Collection Privilege Escalation Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"tag_collections"; nocase; http.uri; content:"add" nocase; http.request_body; content:"User"; nocase; http.request_body; content:"Organisation"; nocase; classtype:attempted-admin; reference:cve,2026-103239; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-103239; sid:2026103239; rev:1;)

Elastic Detection

sequence by process.entity_id
  [network where http.request.method == "POST" and
    stringContains(http.request.uri, "tag_collections") and
    (stringContains(http.request.uri, "add") or stringContains(http.request.uri, "edit"))]
  [network where stringContains(http.request.body, "User") and
    stringContains(http.request.body, "Organisation")]

Splunk SPL Query

index=web sourcetype=misp OR sourcetype=access_combined
| search (uri_path="*tag_collections*add*" OR uri_path="*tag_collections*edit*")
| eval body_lower=lower(_raw)
| search body_lower="user" AND body_lower="organisation"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri_path
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="misp,web,">
  <rule id="100239" level="12">
    <if_sid>31100</if_sid>
    <url>tag_collections/(add|edit)</url>
    <match>User</match>
    <match>Organisation</match>
    <description>CVE-2026-103239: Potential MISP tag collection privilege escalation via injected associated model payload</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>cve_2026_103239,privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Restrict or audit who holds the tag editor permission (perm_tag_editor); remove it from accounts that do not strictly require it.
• Review and minimize exposure of the MISP web interface to untrusted networks; enforce network access controls and VPN-only access where feasible.
• Treat tag collection create/edit activity as a sensitive operation and enable detailed request logging at the reverse proxy to capture POST bodies for the affected actions.

2. Patch/upgrade steps:

• No patch is confirmed from tracked sources. The affected-version boundary indicates remediation is expected in MISP 2.5.48 or later; validate against the official MISP release and advisory channels before deploying and confirm the boundary against vendor documentation.
• Until a verified fix is available, apply compensating controls (permission minimization and monitoring) rather than assuming the instance is safe.

3. Long-term hardening:

• Harden the bulk-association save logic to operate on an explicit allowlist of writable model associations constrained to the TagCollection scope, rejecting sibling model data in tag collection requests.
• Enforce server-side authorization checks that verify the requesting user's permission against the specific model being written.
• Adopt a parameter/field allowlist pattern for all controller actions that accept full request payloads to eliminate mass-assignment risk across the application.
• Regularly review permission grants and monitor MISP release notes for the version addressing CVE-2026-103239.

References

• NVD — CVE-2026-103239: https://nvd.nist.gov/vuln/detail/CVE-2026-103239
• CWE-284: Improper Access Control — https://cwe.mitre.org/data/definitions/284.html
• MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• MISP Project (official site and release notes): https://www.misp-project.org/
• FIRST.org EPSS: not yet scored for this CVE (no value available)

No threat actor campaigns or exploit-in-the-wild evidence were identified in the provided data; CISA KEV status is NO and no public PoC, Nuclei template, or exploit code was observed.