CVE-2026-85533 in MISP
Summary
by MITRE • 09/04/2026
An authorization flaw in MISP allowed an authenticated user to submit a sharing_group_id without verifying that the user was authorized to use the referenced Sharing Group.
In several attribute and Galaxy Cluster creation and editing workflows, validation of the submitted Sharing Group was performed only when the request explicitly set the distribution field to 4 ("Sharing Group"). An attacker could therefore craft a request containing a sharing_group_id while omitting the distribution parameter, or otherwise avoiding the distribution == 4 condition, causing the Sharing Group authorization check to be skipped.
This could allow a user with permission to create or modify the affected MISP objects to associate data with a Sharing Group that they are not authorized to use. Depending on the affected object's existing distribution settings and subsequent processing, this could bypass intended information-sharing boundaries and result in unauthorized placement or distribution of data to members of another Sharing Group.
The issue affected attribute attachment and editing operations as well as Galaxy Cluster creation and editing. The fix ensures that authorization is performed whenever a non-empty sharing_group_id is submitted, independently of the distribution parameter. It also centralizes the authorization decision in SharingGroup::canUse() and explicitly rejects empty Sharing Group identifiers rather than allowing them to be interpreted as an unrestricted query.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified within the MISP platform represents a critical authorization bypass flaw that undermines the integrity of its information-sharing mechanisms. This issue stems from insufficient access control validation during the creation and modification workflows for attributes and Galaxy Clusters. Specifically, the system failed to verify whether an authenticated user possessed the necessary permissions to utilize a referenced Sharing Group when submitting requests containing a sharing_group_id parameter. The core technical defect lies in the conditional logic governing this verification process; authorization checks were only triggered if the request explicitly set the distribution field to four, which corresponds to the "Sharing Group" option. By exploiting this conditional dependency, an attacker could craft malicious requests that either omitted the distribution parameter entirely or utilized alternative values for it, thereby circumventing the security check designed to prevent unauthorized association with specific sharing groups.
From a technical perspective, this flaw allows users who have permission to create or modify affected objects in MISP to associate sensitive data with Sharing Groups they are not authorized to access. The vulnerability affects multiple operational areas including attribute attachment and editing operations as well as Galaxy Cluster creation and editing processes. When the distribution parameter is manipulated to avoid triggering the sharing group validation, the system proceeds without verifying user entitlements against the target sharing group's membership list or policy constraints. This logic error effectively neutralizes the intended access control boundaries that are fundamental to MISP’s design for secure threat intelligence exchange among trusted organizations and communities of interest.
The operational impact of this vulnerability is significant as it enables the unauthorized placement and distribution of data across organizational boundaries defined by sharing groups. Depending on the existing distribution settings of the affected objects and subsequent processing workflows, an attacker could leak sensitive indicators of compromise or other threat intelligence to members of a different sharing group who should not have access to such information. This breach of confidentiality compromises the trust model inherent in MISP deployments where data sensitivity is strictly controlled by these hierarchical sharing structures. The ability to bypass these controls can lead to regulatory non-compliance, exposure of proprietary research, and potential operational security risks for organizations relying on accurate segmentation of their threat intelligence feeds.
This vulnerability aligns with CWE-269 Improper Privilege Management as it involves a failure to enforce proper authorization checks before allowing actions that require elevated privileges or specific permissions. Furthermore, the exploitation technique relates to ATT&CK T1078 Valid Accounts since it leverages legitimate authenticated credentials but abuses flawed logic within those accounts to perform unauthorized actions. The remediation implemented in subsequent updates addresses this by ensuring that authorization is performed whenever a non-empty sharing_group_id is submitted regardless of the distribution parameter value. Additionally, the fix centralizes the authorization decision-making process within the SharingGroup::can() method and explicitly rejects empty identifiers rather than allowing them to be interpreted as unrestricted queries, thereby closing the logic gap that previously allowed for this bypass.