Executive brief
MISP is an open-source threat intelligence platform that allows organizations to share and manage security data. An authenticated attacker can bypass sharing-group authorization checks by sending a PUT request instead of a POST request to the collections endpoint, allowing them to create collections in sharing groups they are not authorized to access. This could expose sensitive threat intelligence to unauthorized users within a sharing group.
Technical details
The CollectionsController add() method only enforced sharing-group authorization checks when the HTTP request method was POST, but the underlying CRUDComponent::add() method persists data on both POST and PUT requests. An authenticated attacker can issue a PUT request to bypass the authorization check and create a distribution=4 collection targeting a sharing group they lack access to. The fix extends the authorization guard to cover both POST and PUT methods.
Affected products
- MISP Project MISP
Timeline
- 2026-09-22: disclosed
- 2026-09-22: patched: Fix committed to repository