Executive brief
MISP is an open-source threat intelligence platform used by security teams to share and analyze threat data. A logic flaw in event editing allows unauthorized users to reassign events to sharing groups they should not have access to, potentially exposing sensitive threat intelligence to unintended recipients or enabling unauthorized data exfiltration.
Technical details
This is an authorization bypass vulnerability in MISP's event editing logic. The vulnerable code only verified authorization for sharing_group_id when the distribution parameter was explicitly set to 4; if an attacker omitted distribution and supplied a different sharing_group_id, the authorization check was skipped. Subsequent field-recovery logic then restored the event's original distribution from storage, allowing the unauthorized sharing group ID to be persisted. The fix adds authorization checks in both the controller and Event::_edit() method whenever a non-empty sharing_group_id is supplied without distribution, ensuring SharingGroup::checkIfAuthorised() is called before persistence. No authentication bypass is required; an authenticated user with event-edit privileges can exploit this by crafting a malformed request.
Affected products
- MISP MISP ≤2.5.45
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched