CVE-2026-112178 in MISP
Summary
by MITRE • 10/19/2026
MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.
- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute's distribution level (levels 1-3 should restrict visibility)
- The owning organisation could not view proposals on its own org-only attributes
Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.
Affected: <2.5.48
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in MISP versions prior to 2.5.48 represents a critical failure in the implementation of role-based and attribute-level access control mechanisms, specifically within the proposal or shadow attribute workflow. This flaw stems from an incomplete authorization check that prioritizes sharing group membership over distribution level constraints. In a properly secured system, visibility into sensitive data must be evaluated against multiple security layers simultaneously, including user roles, organizational boundaries, and specific attribute distribution policies. However, in this affected version, the logic governing who can view proposed changes to attributes or objects was flawed. The system incorrectly accepted any proposal where the requesting user belonged to a sharing group associated with that attribute or object, without verifying whether the current state of the attribute's distribution level would normally restrict access for such users. This oversight creates a significant gap in data confidentiality controls, allowing information intended for restricted audiences to be exposed to unauthorized parties during the review phase of attribute modifications.
From a technical perspective, MISP utilizes sharing groups and distribution levels to manage the dissemination of threat intelligence indicators. Distribution levels typically range from local-only to globally shared, with intermediate levels restricting visibility based on trust relationships or specific organizational scopes. The vulnerability arises because the proposal visibility logic bypassed these granular restrictions. When an attribute is marked for a change that requires review via a shadow attribute mechanism, the system should ensure that only users authorized by both their role and the target distribution level can view the proposed content. Instead, the code checked if the user was part of any sharing group linked to the object or attribute. If such a link existed, access was granted regardless of whether the specific distribution level (such as levels 1 through 3) would normally prohibit that user from seeing the data in its current state. This logic error effectively nullifies the protective intent of restrictive distribution settings during the proposal review process, leading to unauthorized disclosure of sensitive threat intelligence components.
The operational impact of this vulnerability is severe for organizations relying on MISP for secure information sharing. Unauthorized users can view proposed changes to attributes that are meant to be kept within a smaller trust circle or restricted entirely from certain groups. This exposure allows attackers or competitors with access to the platform but outside the intended distribution scope to infer sensitive details about an organization's security posture, infrastructure, or ongoing investigations based on the content of these proposals. Furthermore, the flaw also includes a reverse inequity where the owning organization is denied visibility into proposals concerning its own attributes if those attributes are marked as org-only and managed through sharing groups that do not explicitly include the owner in a way that bypasses this specific bug. This hinders operational efficiency and creates confusion regarding data ownership and control, potentially leading to missed critical updates or unauthorized modifications going unnoticed by the rightful owners of the intelligence.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, as it involves a failure to enforce proper access controls for elevated functions like reviewing sensitive proposals. It also relates closely to CWE-862, Missing Authorization, because the system failed to verify that the user had the specific permission required by the distribution policy before granting visibility. In terms of adversary tactics, this flaw could be leveraged within the ATT&CK framework under T1530, Data from Information Repositories, where an attacker accesses data stored in online repositories or collaborative platforms without proper authorization. The ability to view restricted proposals provides valuable reconnaissance material that can aid in further targeting and exploitation activities against vulnerable organizations.
To mitigate this risk, administrators must upgrade MISP to version 2.5.48 or later immediately, as the vendor has released a patch that corrects the access control logic for shadow attributes. The fix ensures that visibility checks now properly account for both sharing group membership and distribution level restrictions simultaneously. Until the upgrade is performed, organizations should review their user permissions carefully and consider restricting direct database access to prevent exploitation if possible. Additionally, auditing logs for unusual proposal view activities may help identify potential abuse of this flaw in environments where immediate patching is not feasible. Regular security assessments and penetration testing focused on role-based access control are recommended to ensure that such logic errors do not persist in custom deployments or future updates.