CVE-2026-91825 in MISP
Summary
by MITRE • 09/15/2026
Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path.
The vulnerable logic checked whether the acting user could use a sharing_group_id only when the request explicitly supplied distribution = 4. If the attacker instead omitted distribution but supplied a different sharing_group_id, that authorization branch was skipped. Later, MISP’s field-recovery logic restored the existing event distribution from storage. For events already configured with sharing-group distribution, the unauthorized sharing-group ID could therefore be saved.
The fix adds authorization checks in both the controller and Event::_edit() whenever a non-empty sharing_group_id is supplied without distribution. The model now calls SharingGroup::checkIfAuthorised() before persisting the change.
Version affected: ≤2.5.45
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
This vulnerability represents a critical authorization bypass within the Mission Information Sharing Platform, specifically affecting versions up to 2.5.45. The core issue stems from an incomplete implementation of access control checks during event modification operations. In secure software design, every action that modifies sensitive data or configuration must be rigorously validated against the user's permissions and the integrity constraints of the system state. Here, the application logic failed to enforce consistent authorization rules across all code paths involved in editing events, creating a gap that allows attackers to manipulate sharing configurations without proper approval.
The technical flaw is rooted in conditional logic within the event-editing workflow. The original implementation only performed an authorization check for sharing groups when the request explicitly included distribution level four, which corresponds to specific sharing group distributions. However, if an attacker submitted a request containing a different sharing_group_id while omitting the distribution parameter entirely, the application skipped this critical verification step. This oversight relied on the assumption that other parts of the system would prevent unauthorized changes, but instead, it triggered a field-recovery mechanism.
This recovery logic is designed to maintain data consistency by restoring existing event properties if they are not explicitly provided in an update request. While useful for partial updates, this feature became a vector for exploitation because it restored the previous distribution setting from storage without re-validating the newly supplied sharing_group_id against user permissions. Consequently, when editing events that were already configured with sharing-group distributions, an attacker could inject an unauthorized sharing group ID into the payload. The system would skip the authorization check due to the missing distribution parameter and then persist this invalid configuration by merging it with the restored existing state.
The operational impact of this vulnerability is severe in the context of threat intelligence sharing platforms like MISP. Sharing groups define which organizations or users can view specific pieces of sensitive cyber threat information. By bypassing these controls, an attacker could associate a restricted event with a broader or unauthorized sharing group. This effectively leaks confidential indicators of compromise, malware samples, or analysis reports to entities that should not have access. Such data leakage undermines the trust model of the platform and may violate compliance requirements regarding data handling and privacy in sectors like finance, healthcare, or government defense contracting.
From an industry standard perspective, this vulnerability aligns with CWE-284, which describes Improper Access Control. The failure to enforce consistent authorization checks across all input paths is a classic example of incomplete multi-step control flow. Furthermore, the exploitation technique maps to MITRE ATT&CK tactic T1078, specifically Valid Accounts or Default Accounts if exploited by an insider, but more accurately reflects unauthorized privilege escalation through logic flaws rather than credential theft. The attacker leverages valid credentials to perform actions outside their intended scope by manipulating request parameters to bypass security controls.
The remediation strategy implemented in the fixed versions addresses these gaps by enforcing authorization checks at multiple layers of the application stack. The fix introduces validation within both the controller layer and the Event::_edit() method whenever a non-empty sharing_group_id is present, regardless of whether the distribution parameter is explicitly supplied. This ensures that every attempt to modify or associate a sharing group undergoes rigorous permission verification before any state changes are committed to the database.
Additionally, the model now invokes SharingGroup::checkIfAuthorised() prior to persisting any changes involving sharing groups. This centralized validation point acts as a final gatekeeper, ensuring that business logic rules regarding who can manage which sharing groups are strictly enforced. By moving this check into the data access layer, the system protects against future vulnerabilities where controllers might inadvertently skip authorization steps due to evolving feature requirements or refactoring errors.
Organizations running affected versions of MISP should prioritize immediate patching to version 2.5.46 or later. In addition to updating software, administrators should review audit logs for any anomalous changes in sharing group associations during the window when vulnerable versions were active. Implementing strict input validation and ensuring that all code paths involving sensitive configuration updates include explicit authorization checks are essential practices for maintaining the integrity of threat intelligence platforms. Regular security assessments focusing on logic flaws rather than just injection vulnerabilities will help identify similar blind spots in complex web applications.