Attributed metadata history

MISP 2.5.50 Released - Security hardening, Overmind improvements, and streamlined workflows

MISP 2.5.50 — Security hardening, Overmind improvements, and streamlined workflows Release date: 9 October 2026 MISP 2.5.50 brings a substantial set of security fixes, continued development of the Overmind user interface, and the consolidation of several legacy features into their modern replacements. The release also improves TAXII connectivity, object handling, event graphs, statistics, and day-to-day administration. Highlights Security hardening: Important access-control fixes, restrictions on sensitive server settings, and safer attachment download headers. Overmind improvements: A redesigned Server Settings interface, new workflow views, improved object and attribute handling, and numerous usability enhancements. Simplified data model: Legacy event discussions, templates, and signature allowedlists are migrated to analyst notes, event templates, and warninglists, respectively. Better integrations and data quality: A new phishing feed, fixes for TAXII connection management, and improved duplicate-attribute handling. New statistics: Object-relation usage reporting to help understand how MISP object templates are used in practice. Security improvements This release includes several security and privacy fixes. Upgrading is strongly recommended. Sensitive configuration settings are now CLI-only. The Redis host settings (MISP.redis_host, Plugin.ZeroMQ_redis_host, and SimpleBackgroundJobs.redis_host) can no longer be changed through the web interface or API. The download_attachments_on_load setting is also restricted. These changes reduce the risks associated with a compromised administrative session. Thanks to Logan Homolka and CERT.pl for reporting the relevant issues. Safer attachment downloads. Updates to the CakePHP dependency correctly escape quotes and backslashes and strip control characters from filenames in Content-Disposition headers. This prevents crafted filenames from manipulating download headers or causing unintended inline rendering. Thanks to Logan Homolka for the reports. Object search respects attribute visibility. Searches in the event view now consider only attributes that the user is authorised to see, avoiding information disclosure through organisation-only, sharing-group-restricted, or soft-deleted attributes. Event index access-control correction. An ACL-related information leak in the event index has been fixed. Thanks to Jeroen Pinoy for the report. Visibility-aware galaxy counts. Galaxy cluster views now count only tagged attributes visible to the current user. Modernisation and migration of legacy features Event discussions are replaced by analyst notes The legacy Thread and Post functionality has been removed in favour of analyst data notes. Existing discussions are migrated as follows: Posts attached to events become notes on those events. General discussions become notes attached to the originating organisation. Replies become notes attached to the note they answer. Author organisation, timestamps, and appropriate visibility information are preserved. The old discussion interfaces, related settings, notifications, workflow trigger, and ZMQ conversation topic have been removed. Records that cannot be migrated, and workflows using the removed trigger, are logged during migration. Legacy templates are replaced by event templates The older template system has been retired in favour of event templates. Organisation-authored legacy templates are converted to active event templates; the bundled legacy seed templates are superseded by the event template library. The migration logs definitions that cannot be saved or conflict with existing names. The perm_template permission remains in use for event templates. Behaviour change: Event templates create new events; the legacy ability to populate an existing event from a template is removed. Signature allowedlists are replaced by warninglists The legacy signature allowedlist is removed and its entries are migrated into an enabled custom regular-expre

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.