Auth bypass in Misp

CVE-2026-54361

MISP contained multiple mass assignment vulnerabilities in the handling of collections, tag collections, event delegations, and shadow attributes. Several controller actions accepted user-supplied fields that should have remained server-co…

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.003 (17.8th percentile) — read the EPSS interpretation.