Executive brief
MISP is a threat intelligence sharing platform that organizations use to collaborate on security incidents and malware information. A flaw in the captureOrg method allows users with sharing group editor privileges to bypass authorization checks and modify sensitive organization metadata fields that should only be editable by administrators. An attacker could exploit this to manipulate how sharing groups and data sharing blueprints behave across the platform, affecting the integrity of collaborative threat intelligence sharing.
Technical details
The captureOrg method in the Organisation model fails to verify user privileges when the $force parameter is set to true, allowing it to unconditionally overwrite organization metadata fields. An authenticated user with sharing group (SG) editor role can trigger this code path through the MISP web interface, bypassing privilege checks that should restrict such modifications to site administrators or users with sync permissions. The vulnerability affects the integrity of organization records and potentially derived sharing group configurations, and is patched by adding appropriate authorization validation.
Affected products
- MISP MISP
Timeline
- 2026-09-22: disclosed: Vulnerability disclosed