Executive brief
MISP is an open-source platform used by organizations to share threat intelligence and security information. A security flaw in the platform's 'sharing group' feature allows an authorized user to modify or take control of existing sharing groups they should not have access to. This could lead to unauthorized access to sensitive threat data or the manipulation of how information is distributed among partner organizations.
Technical details
A mass assignment vulnerability exists in the 'add' action of the SharingGroupsController in MISP. The application fails to sanitize user-supplied data by removing the 'id' field before performing a save operation. In the underlying CakePHP framework, providing a primary key (id) during a create() and save() sequence causes the application to update an existing record rather than creating a new one. An authenticated attacker with permissions to create sharing groups can exploit this to modify any existing sharing group, bypassing edit-level access control checks. This vulnerability is addressed in commit 687e7cb by explicitly unsetting the 'id' field from the input data.
Affected products
- MISP MISP All versions prior to commit 687e7cb
Timeline
- 2026-06-12: advisory: CVE-2026-54360 published by CIRCL/NVD
- 2026-06-12: patched: Fix committed to MISP repository