CVE-2026-85533
Received Received - Intake

Authorization Bypass in MISP via Sharing Group Manipulation

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: CIRCL

Description
An authorization flaw in MISP allowed an authenticated user to submit a sharing_group_id without verifying that the user was authorized to use the referenced Sharing Group. In several attribute and Galaxy Cluster creation and editing workflows, validation of the submitted Sharing Group was performed only when the request explicitly set the distribution field to 4 ("Sharing Group"). An attacker could therefore craft a request containing a sharing_group_id while omitting the distribution parameter, or otherwise avoiding the distribution == 4 condition, causing the Sharing Group authorization check to be skipped. This could allow a user with permission to create or modify the affected MISP objects to associate data with a Sharing Group that they are not authorized to use. Depending on the affected object's existing distribution settings and subsequent processing, this could bypass intended information-sharing boundaries and result in unauthorized placement or distribution of data to members of another Sharing Group. The issue affected attribute attachment and editing operations as well as Galaxy Cluster creation and editing. The fix ensures that authorization is performed whenever a non-empty sharing_group_id is submitted, independently of the distribution parameter. It also centralizes the authorization decision in SharingGroup::canUse() and explicitly rejects empty Sharing Group identifiers rather than allowing them to be interpreted as an unrestricted query.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85533
EUVD
EUVD-2026-70976

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization flaw in MISP where an authenticated user could submit a sharing_group_id without proper verification of their authorization to use that Sharing Group. The system only checked authorization when the distribution field was set to 4, allowing attackers to bypass this check by omitting the distribution parameter or avoiding the condition. This could let users associate data with unauthorized Sharing Groups, potentially bypassing information-sharing boundaries.

Detection Guidance

To detect this vulnerability, check MISP logs for unauthorized sharing_group_id submissions without the distribution parameter set to 4. Review attribute and Galaxy Cluster creation/modification requests where sharing_group_id is present but distribution is missing or not 4. Use MISP's admin interface to audit Sharing Group access logs for anomalies.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to place or distribute data to members of Sharing Groups they are not permitted to access. This may lead to sensitive information being shared with unintended parties, compromising data confidentiality and integrity within the MISP platform.

Compliance Impact

This vulnerability could lead to unauthorized data sharing, violating compliance requirements such as GDPR's data protection principles or HIPAA's access controls. It may result in improper disclosure of sensitive information, leading to legal penalties, reputational damage, and loss of trust in data handling practices.

Mitigation Strategies

Update MISP to the latest patched version to ensure proper authorization checks for sharing_group_id submissions. Review user permissions to confirm no unauthorized sharing group associations exist. Monitor logs for suspicious attribute or Galaxy Cluster creation/modification attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85533. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart