CVE-2026-85538 in MISP
Summary
by MITRE • 09/04/2026
An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required perm_modify or perm_modify_org permissions.
The affected attribute deletion paths relied on organization membership checks performed by MispAttribute::deleteAttribute() but did not consistently enforce MISP's event modification authorization rules. Consequently, a user belonging to the organization associated with an event could potentially delete individual attributes or perform bulk attribute deletion even when their assigned role was not authorized to modify the event.
This created an inconsistency between attribute editing and deletion: editing an attribute correctly used MISP's ACL::canModifyEvent() authorization logic, whereas the affected deletion operations could bypass these permission checks.
An authenticated attacker with access to an affected MISP instance and membership in the organization owning an event could exploit this flaw to remove attributes from that event, potentially causing unauthorized modification or loss of threat intelligence data.
The patch introduces a common authorization check for all affected deletion paths. Before deletion, MISP now resolves the associated events and verifies that the current user is authorized to modify each event using the same authorization mechanism used by normal event and attribute modification operations.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/04/2026
A critical access control vulnerability was identified within the Malware Information Sharing Platform (MISP), specifically affecting the logic governing the deletion of attributes from security events. This flaw represents a significant inconsistency in how MISP enforces its Access Control List (ACL) policies, allowing authenticated users to remove data they are not authorized to modify. The root cause lies in the implementation of the deleteAttribute function within the MispAttribute component, which relies on organization membership checks rather than comprehensive event-level modification permissions. While standard editing operations correctly invoke the ACL::canModifyEvent() method to verify that a user possesses either perm_modify or perm_modify_org privileges, the deletion pathways bypassed this rigorous check. Instead, they only verified if the requesting user was a member of the organization associated with the target event. This architectural oversight created a dangerous disparity where users could alter the integrity of threat intelligence data without holding the necessary administrative rights to do so.
The operational impact of this vulnerability is severe for organizations relying on MISP for accurate and trustworthy cyber threat intelligence sharing. An authenticated attacker who holds membership in an organization that owns or contributes to specific events can exploit this flaw to delete individual attributes or perform bulk deletions across multiple attributes within those events. This action effectively results in the unauthorized modification and potential loss of critical security data, such as indicators of compromise (IOCs), malware hashes, or contextual descriptions. By removing these elements, an attacker can degrade the quality of shared intelligence, potentially causing other organizations to miss active threats or waste resources investigating false negatives. Furthermore, this capability undermines the auditability and integrity of the platform, as changes are made without proper authorization trails that reflect true administrative intent.
From a technical classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Assignment, specifically where an actor is granted privileges they should not possess for a specific action. It also relates to CWE-862, Missing Authorization, as the application fails to enforce required access controls on sensitive operations. In terms of adversary behavior mapping under MITRE ATT&CK, this flaw facilitates techniques associated with Defense Evasion and Impact categories, particularly those involving data manipulation or destruction within collaborative security platforms. The vulnerability highlights a common pitfall in web application development where different CRUD (Create, Read, Update, Delete) operations are implemented by separate code paths that do not share identical validation logic, leading to inconsistent security postures across the application's functionality.
The remediation for this issue involves refactoring the deletion logic to enforce consistent authorization checks across all attribute modification actions. The patch introduces a unified authorization mechanism that resolves the associated events before any deletion takes place and verifies that the current user is authorized to modify each event using the same ACL::canModifyEvent() method employed by normal editing operations. This ensures that only users with explicit perm_modify or perm_modify_org privileges can delete attributes, thereby closing the gap between reading/viewing data and altering it. Organizations running affected versions of MISP should immediately apply this patch to restore proper access control integrity. Additionally, administrators are advised to review audit logs for any suspicious bulk deletion activities prior to the update and consider implementing stricter role-based access controls to minimize the risk of insider threats or compromised accounts causing significant damage to shared threat intelligence repositories.