CVE-2026-10868
A mass assignment vulnerability exists in the MISP user edit functionality due to insufficient filtering of user-supplied fields in Users...
Published: 2026-06-04 · Last updated: 2026-06-04
Severity and scoring
- CWE
- CWE-269
Description
A mass assignment vulnerability exists in the MISP user edit functionality due to insufficient filtering of user-supplied fields in UsersController::edit(). When processing edit requests, the application accepted a user-controlled User.id value from request data. An authenticated attacker could craft a modified request containing another user identifier, potentially causing updates to be applied to an unintended user account. Depending on the editable fields and the attacker’s privileges, this could allow unauthorized modification of user account attributes and impact account integrity. The issue was addressed by explicitly removing the User.id field from request data before processing the user edit operation.
Source: NVD
References
Related CVEs
Same CWE
- CVE-2024-38487 — api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unint... (7.0 HIGH)
- CVE-2026-12313 — Information disclosure, sandbox escape in the Security: Process Sandboxing component (4.7 MEDIUM)
- CVE-2026-12289 — Privilege escalation in the Graphics: WebRender component (8.8 HIGH)
- CVE-2026-8176 — The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Adminis... (7.5 HIGH)
- CVE-2025-9912 — Nokia SR Linux is vulnerable to a local privilege escalation vulnerability (6.3 MEDIUM)