CVE-2026-103858 in MISP
Summary
by MITRE • 10/01/2026
MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization (org-only distribution). It did not enforce the full thread access control list, including sharing-group membership and event-level visibility.
As a result, an authenticated user who is outside the relevant sharing group or who does not have visibility on the associated event could:
- Read the thread title and the content of the quoted post
- Submit a new post into the discussion thread
This constitutes both an information disclosure (reading restricted thread and post content) and an integrity issue (injecting content into a thread the user is not authorized to participate in).
Affected: <2.5.48
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified within MISP versions prior to 2.5.48 represents a critical failure in access control logic, specifically categorized under CWE-269 Improper Privilege Management and CWE-732 Incorrect Permission Assignment for Critical Resource. The core technical flaw resides in the discussion posting functionality where the application performs an incomplete authorization check during user interactions such as submitting new posts or replying to existing threads. Instead of validating the full thread access control list, which includes complex attributes like sharing group membership and event-level visibility permissions, the system only verifies whether the target thread is restricted to a single organization distribution model known as org-only. This partial validation creates a significant security gap that allows authenticated users who are not members of the relevant sharing groups or lack proper event visibility to bypass intended restrictions.
From an operational perspective, this flaw leads to two distinct adverse outcomes affecting both confidentiality and integrity. First, it results in information disclosure where unauthorized users can read thread titles and the content of quoted posts within restricted discussions. This exposure violates the principle of least privilege by revealing sensitive intelligence data that should be confined to specific organizational boundaries or sharing groups. Second, the vulnerability enables an integrity violation wherein malicious actors can inject new posts into discussion threads they are not authorized to access. This capability allows for potential misinformation campaigns, disruption of collaborative analysis workflows, and contamination of shared threat intelligence datasets with unverified or hostile content.
In terms of industry mapping, this behavior aligns with MITRE ATT&CK technique T1078 Valid Accounts, as the exploitation relies on legitimate authentication credentials to perform unauthorized actions. The lack of proper authorization checks also reflects patterns associated with CWE-284 Improper Access Control, where the system fails to enforce appropriate access levels for users against their own data or restricted resources. Such flaws are particularly dangerous in threat intelligence sharing platforms like MISP because they undermine trust among participating organizations and compromise the integrity of shared indicators of compromise and tactical analyses.
To mitigate this vulnerability, immediate action is required by upgrading all affected instances of MISP to version 2.5.48 or later where these access control checks have been corrected. Administrators should ensure that their deployment processes include rigorous testing of sharing group permissions and event visibility settings after any upgrade. Additionally, implementing robust logging and monitoring for discussion thread activities can help detect potential exploitation attempts in environments where the patch has not yet been applied. Regular security audits focusing on role-based access control configurations are recommended to prevent similar authorization bypasses in other modules of the platform.