{"id":"CVE-2026-86351","title":"Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /","summary":"Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolv…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-20","CWE-601"],"vendor":"misp-project","product":"misp","affected":["misp <= 2.5.45"],"published":"2026-09-07","updated":"2026-09-09","sourceUpdated":"2026-09-09T15:26:26.730","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86351","references":[{"url":"https://github.com/MISP/MISP/commit/bd454f65a","label":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}],"tags":["nvd","cve.org"],"epss":0.00189,"epssPercentile":0.0874,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-08T14:49:13.991856Z"},"scores":{"nvd":6.1,"cna":5.1},"ingestedAt":"2026-09-08T15:33:26.976Z","slug":"CVE-2026-86351","body":"## Overview\n\nAffected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers.\n\n\nThe vulnerable homepage value can be stored as a user setting and later used by the post-login routing logic. The commit explicitly identifies //attacker.example as a payload that passed validation and was emitted to the Location header after login.\n\nThe fix introduces a shared InternalRedirectValidator that rejects URLs containing a host, scheme, userinfo, unsafe leading // or /\\, malformed URLs, and control characters. It also revalidates homepage settings on read so legacy or internally written unsafe values cannot bypass the new storage-time validation.\n\nVersion affected: ≤2.5.45\n\n## Affected\n\n- `misp <= 2.5.45`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":202128,"id":"CVE-2026-86351","ts":1789400063199,"field":"cvss","old":"5.1","new":"6.1"},{"seq":200855,"id":"CVE-2026-86351","ts":1789397617146,"field":"cvss","old":"6.1","new":"5.1"},{"seq":199548,"id":"CVE-2026-86351","ts":1789395529729,"field":"cvss","old":"5.1","new":"6.1"},{"seq":198793,"id":"CVE-2026-86351","ts":1789392244957,"field":"cvss","old":"6.1","new":"5.1"},{"seq":197126,"id":"CVE-2026-86351","ts":1789384293069,"field":"cvss","old":"5.1","new":"6.1"},{"seq":194255,"id":"CVE-2026-86351","ts":1789378783783,"field":"cvss","old":"6.1","new":"5.1"},{"seq":193042,"id":"CVE-2026-86351","ts":1789376516055,"field":"cvss","old":"5.1","new":"6.1"},{"seq":191829,"id":"CVE-2026-86351","ts":1789373631822,"field":"cvss","old":"6.1","new":"5.1"},{"seq":190614,"id":"CVE-2026-86351","ts":1789369476728,"field":"cvss","old":"5.1","new":"6.1"},{"seq":189401,"id":"CVE-2026-86351","ts":1789368429309,"field":"cvss","old":"6.1","new":"5.1"},{"seq":188184,"id":"CVE-2026-86351","ts":1789365231506,"field":"cvss","old":"5.1","new":"6.1"},{"seq":186971,"id":"CVE-2026-86351","ts":1789363472027,"field":"cvss","old":"6.1","new":"5.1"},{"seq":185757,"id":"CVE-2026-86351","ts":1789361229852,"field":"cvss","old":"5.1","new":"6.1"},{"seq":184544,"id":"CVE-2026-86351","ts":1789358364539,"field":"cvss","old":"6.1","new":"5.1"},{"seq":182794,"id":"CVE-2026-86351","ts":1789354317919,"field":"cvss","old":"5.1","new":"6.1"},{"seq":181587,"id":"CVE-2026-86351","ts":1789353318450,"field":"cvss","old":"6.1","new":"5.1"},{"seq":180380,"id":"CVE-2026-86351","ts":1789350285507,"field":"cvss","old":"5.1","new":"6.1"},{"seq":179173,"id":"CVE-2026-86351","ts":1789348293655,"field":"cvss","old":"6.1","new":"5.1"},{"seq":177966,"id":"CVE-2026-86351","ts":1789346370765,"field":"cvss","old":"5.1","new":"6.1"},{"seq":176759,"id":"CVE-2026-86351","ts":1789343185245,"field":"cvss","old":"6.1","new":"5.1"},{"seq":174876,"id":"CVE-2026-86351","ts":1789334876412,"field":"cvss","old":"5.1","new":"6.1"},{"seq":173671,"id":"CVE-2026-86351","ts":1789333701554,"field":"cvss","old":"6.1","new":"5.1"},{"seq":172485,"id":"CVE-2026-86351","ts":1789331093796,"field":"cvss","old":"5.1","new":"6.1"},{"seq":171299,"id":"CVE-2026-86351","ts":1789328781591,"field":"cvss","old":"6.1","new":"5.1"},{"seq":170094,"id":"CVE-2026-86351","ts":1789327197887,"field":"cvss","old":"5.1","new":"6.1"},{"seq":168889,"id":"CVE-2026-86351","ts":1789323840885,"field":"cvss","old":"6.1","new":"5.1"},{"seq":167684,"id":"CVE-2026-86351","ts":1789319703427,"field":"cvss","old":"5.1","new":"6.1"},{"seq":166479,"id":"CVE-2026-86351","ts":1789318776896,"field":"cvss","old":"6.1","new":"5.1"},{"seq":165274,"id":"CVE-2026-86351","ts":1789315794220,"field":"cvss","old":"5.1","new":"6.1"},{"seq":164069,"id":"CVE-2026-86351","ts":1789313634988,"field":"cvss","old":"6.1","new":"5.1"},{"seq":162864,"id":"CVE-2026-86351","ts":1789311904210,"field":"cvss","old":"5.1","new":"6.1"},{"seq":161659,"id":"CVE-2026-86351","ts":1789308733921,"field":"cvss","old":"6.1","new":"5.1"},{"seq":159772,"id":"CVE-2026-86351","ts":1789300471297,"field":"cvss","old":"5.1","new":"6.1"},{"seq":156761,"id":"CVE-2026-86351","ts":1789294756417,"field":"cvss","old":"6.1","new":"5.1"},{"seq":155556,"id":"CVE-2026-86351","ts":1789292968666,"field":"cvss","old":"5.1","new":"6.1"},{"seq":154351,"id":"CVE-2026-86351","ts":1789289798312,"field":"cvss","old":"6.1","new":"5.1"},{"seq":151602,"id":"CVE-2026-86351","ts":1789277630564,"field":"cvss","old":"5.1","new":"6.1"},{"seq":150563,"id":"CVE-2026-86351","ts":1789276252734,"field":"cvss","old":"6.1","new":"5.1"},{"seq":149530,"id":"CVE-2026-86351","ts":1789273825448,"field":"cvss","old":"5.1","new":"6.1"},{"seq":148497,"id":"CVE-2026-86351","ts":1789271349557,"field":"cvss","old":"6.1","new":"5.1"},{"seq":146528,"id":"CVE-2026-86351","ts":1789269398756,"field":"cvss","old":"5.1","new":"6.1"},{"seq":145333,"id":"CVE-2026-86351","ts":1789266340963,"field":"cvss","old":"6.1","new":"5.1"},{"seq":144237,"id":"CVE-2026-86351","ts":1789262617435,"field":"cvss","old":"5.1","new":"6.1"},{"seq":143141,"id":"CVE-2026-86351","ts":1789261534154,"field":"cvss","old":"6.1","new":"5.1"},{"seq":141972,"id":"CVE-2026-86351","ts":1789258832596,"field":"cvss","old":"5.1","new":"6.1"},{"seq":140813,"id":"CVE-2026-86351","ts":1789256727843,"field":"cvss","old":"6.1","new":"5.1"},{"seq":139615,"id":"CVE-2026-86351","ts":1789254832782,"field":"cvss","old":"5.1","new":"6.1"},{"seq":138417,"id":"CVE-2026-86351","ts":1789251934926,"field":"cvss","old":"6.1","new":"5.1"},{"seq":137219,"id":"CVE-2026-86351","ts":1789247833510,"field":"cvss","old":"5.1","new":"6.1"},{"seq":136021,"id":"CVE-2026-86351","ts":1789247056802,"field":"cvss","old":"6.1","new":"5.1"}]}