A stored cross‑site scripting flaw exists in MISP when the Overmind theme is activated. The setHomePage endpoint allowed an authenticated user to store an arbitrary homepage path by writing it through setSettingInternal, bypassing the normal validation that enforces paths to begin with a slash. The saved value is later rendered inside the href attribute of a “Continue to homepage” link on the news page without any HTML escaping, permitting the execution of attacker‑controlled JavaScript in the browser context of the affected instance.

The vulnerability affects installations of the MISP platform that are using the Overmind theme. Any authenticated user who can change the homepage setting can exploit the flaw; the mechanism does not require any additional privileges beyond those needed to modify settings. The specific product is the MISP application; the impact applies to any version that has not incorporated the recent fix that enforces validation and proper escaping.

The CVSS score of 5.1 indicates a moderate severity. The EPSS value is not available, so the current exploitation likelihood cannot be quantified. The flaw is not listed in the CISA KEV catalog, suggesting no widespread exploitation as of the latest data. The attack vector is likely an authenticated user who intentionally stores a malicious homepage link and later triggers it by visiting the news page or by inviting other users to click the link. Successful exploitation would enable an attacker to run arbitrary scripts in the victim’s browser, potentially leading to defacement, information disclosure, session hijack, or further lateral movement within the same web application.