CVE-2026-95697 in MISP
Summary
by MITRE • 09/22/2026
MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group (SG) editor role can trigger this code path, allowing them to modify organization metadata that should be restricted to site administrators or users with sync permissions.
According to the commit message, this could lead to blueprint-based sharing group manipulation, meaning an attacker with SG editor access could alter organizational attributes in ways that influence how sharing groups and blueprints behave across the MISP instance.
The vulnerability requires an authenticated user with at least SG editor privileges and network access to the MISP web interface. The impact is primarily on the integrity of organization records and, potentially, on the integrity of sharing group configurations derived from those records.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The identified security flaw resides within the Organization model's captureOrg method in the MISP platform, representing a critical authorization bypass that undermines the principle of least privilege. This vulnerability specifically manifests when the $force parameter is set to true, triggering an unconditional overwrite of organization metadata fields without performing adequate verification of the invoking user's privileges. In a properly secured system, modifications to organizational attributes should be restricted to site administrators or users with explicit synchronization permissions due to the sensitive nature of this data. However, the current implementation allows any authenticated user possessing at least Sharing Group editor role to execute this code path effectively bypassing administrative controls. This design flaw creates a significant gap in access control logic where elevated privileges are not required for actions that should be reserved for higher-level administrators.
The operational impact of this vulnerability extends beyond simple data modification, as it directly affects the integrity of organizational records and potentially compromises the configuration of sharing groups derived from those records. According to analysis linked to the relevant commit message, an attacker with Sharing Group editor access can alter organizational attributes in ways that influence how sharing groups and blueprints behave across the entire MISP instance. This capability allows for blueprint-based sharing group manipulation, where changes to organization metadata propagate through dependent structures, potentially altering data distribution policies or visibility rules without authorization. Such manipulations can lead to unauthorized dissemination of sensitive threat intelligence or restriction of legitimate information sharing, thereby impacting the trustworthiness and reliability of the platform's core functionality.
From a technical classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management, as it involves an actor exercising privileges that are not explicitly authorized for their role. The attack vector is classified under MITRE ATT&CK technique T1078 Valid Accounts, specifically leveraging legitimate user credentials to perform unauthorized administrative actions within the application layer. Since the vulnerability requires network access to the MISP web interface and authentication with at least SG editor privileges, it represents a remote code execution risk that can be exploited by any authenticated insider or external attacker who has compromised such an account. The lack of server-side validation for the $force parameter's usage context is the primary technical deficiency enabling this exploitation.
Mitigation strategies must focus on implementing strict role-based access control checks within the captureOrg method before allowing metadata overwrites when the force flag is active. Developers should ensure that only users with site administrator or specific sync permissions can trigger operations that modify core organizational attributes, regardless of other elevated roles like sharing group editor. Additionally, input validation and logging mechanisms should be enhanced to detect and alert on unusual patterns of organization data modification. Regular security audits of authorization logic in critical models are essential to prevent similar privilege escalation flaws from being introduced during future development cycles or updates.