---
id: CVE-2026-86351
title: >-
  Affected versions of MISP validate the user-configurable homepage by checking
  only whether the supplied path begins with /
summary: >-
  Affected versions of MISP validate the user-configurable homepage by checking
  only whether the supplied path begins with /. That check is insufficient
  because protocol-relative URLs such as //attacker.example also begin with /
  but resolv…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-20
  - CWE-601
vendor: misp-project
product: misp
affected:
  - misp <= 2.5.45
published: '2026-09-07'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T15:26:26.730'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86351'
references:
  - url: 'https://github.com/MISP/MISP/commit/bd454f65a'
    label: 5a6e4751-2f3f-4070-9419-94fb35b644e8
tags:
  - nvd
  - cve.org
epss: 0.00259
epssPercentile: 0.15704
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-08T14:49:13.991856Z'
scores:
  nvd: 6.1
  cna: 5.1
ingestedAt: '2026-09-08T15:33:26.976Z'
---

## Overview

Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers.


The vulnerable homepage value can be stored as a user setting and later used by the post-login routing logic. The commit explicitly identifies //attacker.example as a payload that passed validation and was emitted to the Location header after login.

The fix introduces a shared InternalRedirectValidator that rejects URLs containing a host, scheme, userinfo, unsafe leading // or /\, malformed URLs, and control characters. It also revalidates homepage settings on read so legacy or internally written unsafe values cannot bypass the new storage-time validation.

Version affected: ≤2.5.45

## Affected

- `misp <= 2.5.45`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.