CVE-2026-112178
Deferred Deferred - Pending Action

Access Control Flaw in MISP Proposal Visibility

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: CIRCL

Description
MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes. - A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute's distribution level (levels 1-3 should restrict visibility) - The owning organisation could not view proposals on its own org-only attributes Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions. Affected: <2.5.48

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112178
EUVD
EUVD-2026-104127

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
MISP MISP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MISP has an access control flaw in proposal visibility logic. Users in a sharing group could view proposals on attributes or objects with that group regardless of distribution level restrictions. The owning organization also couldn't view proposals on its own org-only attributes.

Detection Guidance

This vulnerability can be detected by checking the MISP version and verifying if it is below 2.5.48. Use the command: misp --version to check the installed version. If the version is below 2.5.48, the system is vulnerable.

Impact Analysis

This vulnerability allows unauthorized users to see proposed attribute changes they shouldn't access, potentially exposing sensitive information before it's officially shared.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive data, potentially violating GDPR's data protection principles and HIPAA's confidentiality requirements. Unauthorized access to proposals on organization-only attributes may result in non-compliance with access control and data sharing regulations.

Mitigation Strategies

Upgrade MISP to version 2.5.48 or later to apply the security fix addressing the proposal ACL flaw.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112178. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart