Executive brief
MISP is a threat intelligence sharing platform used by organizations to collaborate on security incident data. An authenticated user could bypass authorization checks to associate threat data (attributes and Galaxy Clusters) with a Sharing Group they were not authorized to access, potentially exposing sensitive intelligence to unintended recipients within the platform.
Technical details
An authorization bypass vulnerability exists in MISP's Sharing Group validation logic. When users submit a sharing_group_id during attribute or Galaxy Cluster creation/editing, the authorization check was only performed if the distribution field was explicitly set to 4 ("Sharing Group"). An authenticated attacker could omit or set the distribution parameter to a different value, causing the Sharing Group authorization check to be skipped entirely. This allowed association of data with unauthorized Sharing Groups, bypassing intended information-sharing boundaries. The fix centralizes authorization checks via SharingGroup::canUse() and enforces validation whenever any non-empty sharing_group_id is submitted, regardless of the distribution parameter.
Affected products
- MISP MISP
Timeline
- 2026-09-04: disclosed
- 2026-08-25: patched