MISP security advisory (AV26-946)

Serial number: AV26-946
Date: September 21, 2026

As of September 21, 2026, MISP is affected by vulnerabilities in the following product:

• MISP
  • Prior to 2.5.47

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Strip the client id from module-result event reports
• Read only api keys can regain full role powers
• Refuse a MISP export upload whose content is a path or URL