Is CVE-2026-95697 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-95697 being exploited in the wild.

How severe is CVE-2026-95697?

Informational severity, published 22 September 2026.

Is there a fix for CVE-2026-95697?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-95697 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-95697?

Check whether you run Misp. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-95697: MISP authorization flaw in captureOrg method

CVE-2026-95697 · Severity: info · Published 2026-09-22

MISP is a threat intelligence sharing platform that organizations use to collaborate on security incidents and malware information. A flaw in the captureOrg method allows users with sharing group editor privileges to bypass authorization checks and modify sensitive organization metadata fields that should only be editable by administrators. An attacker could exploit this to manipulate how sharing groups and data sharing blueprints behave across the platform, affecting the integrity of collaborative threat intelligence sharing.

Technologies: Misp. Vendors: Misp.

Quick answers

Is CVE-2026-95697 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-95697 being exploited in the wild.
How severe is CVE-2026-95697?: Informational severity, published 22 September 2026.
Which products and versions are affected?: MISP MISP.
Is there a fix for CVE-2026-95697?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-95697 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-95697?: Check whether you run Misp. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The captureOrg method in the Organisation model fails to verify user privileges when the $force parameter is set to true, allowing it to unconditionally overwrite organization metadata fields. An authenticated user with sharing group (SG) editor role can trigger this code path through the MISP web interface, bypassing privilege checks that should restrict such modifications to site administrators or users with sync permissions. The vulnerability affects the integrity of organization records and potentially derived sharing group configurations, and is patched by adding appropriate authorization validation.

Affected products

MISP MISP

Timeline

2026-09-22: disclosed: Vulnerability disclosed

References

https://github.com/MISP/MISP/commit/f3ec974ee

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.