MISP security advisory (AV26-986)
Canada's Cyber Centre urges updates to MISP 2.5.48 for authorization, data-write, and TOTP flaws.
The Canadian Centre for Cyber Security issued advisory AV26-986 on October 1, 2026, stating that MISP before 2.5.48 is affected by several vulnerabilities. The listed fixes keep delegation requests bound to the authorized event, stop a nested model alias from selecting the wrong save target, and prevent tag-collection saves from writing sibling user or organization rows. A previously used TOTP code is also refused for login. No CVE identifiers or active exploitation are mentioned.
- Advisory AV26-986 covers MISP versions before 2.5.48.
- Delegation requests must stay bound to the authorized event.
- Fixes stop wrong-row saves, sibling user or org writes, and TOTP reuse.
- The Cyber Centre urges administrators to review links and apply updates.
- Products
- MISP
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-986 Date: October 1, 2026 As of October 1, 2026, MISP is affected by vulnerabilities in the following product: MISP Prior to 2. 5. 48 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.