Executive brief
MISP is an open-source platform used by organizations to share and analyze threat intelligence. A security flaw in how the platform handles object editing allowed authorized users to assign data to private sharing groups they should not have access to. This could lead to the unauthorized disclosure of private group names and the improper modification of data distribution settings.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in MISP's ObjectsController.php. When editing objects, sharing group validation was performed against an incorrect request data structure after object fields were merged to the top level, effectively bypassing the check. Additionally, attributes embedded within objects were not individually validated for authorized sharing group use. An authenticated attacker with object editing permissions could craft a request with distribution set to 4 and an arbitrary sharing_group_id to disclose the existence of restricted sharing groups or modify distribution metadata. A fix has been committed to the MISP repository.
Affected products
- MISP Project MISP Prior to commit 4fe48c523e66999d65f99fdec9508adb3aa1c0f3
Timeline
- 2026-06-12: disclosed
- 2026-06-12: advisory