CVE-2026-88915
Deferred Deferred - Pending Action

Authorization Bypass in MISP Event Template Instantiation

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: CIRCL

Description
Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates. For templates using distribution = 4, the template can specify a sharing_group_id. The instantiation path passed that value into event creation without verifying that the user instantiating the template was actually permitted to use the selected sharing group. The commit notes that Event::_add() only performed its own sharing-group authorization in another code path, leaving template instantiation able to write the identifier directly. The same instantiation path also attached template-specified tags without checking the user's normal tagging permissions. In addition, it hardcoded local => 0, meaning tags marked local_only could be attached globally and consequently propagate through synchronization or export, contrary to their intended restriction. The fix adds explicit SharingGroup::canUse() authorization for the acting user, applies the same tag-modification checks used by normal event tagging, and ensures local_only tags are attached locally. Version affected: ≤2.5.45

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88915
EUVD
EUVD-2026-75409

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp to 2.5.45 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MISP (≤2.5.45) occurs during event template instantiation. When users create events from templates, the system fails to verify if they are authorized to use specified sharing groups or attach certain tags. This allows unauthorized data sharing or tag propagation, bypassing intended restrictions.

Detection Guidance

To detect this vulnerability, check if your MISP instance is running a version ≤2.5.45. Use the command: grep -r 'version' /var/www/MISP/app/Config/Config.php or check the web interface under Administration > Server Settings. If the version is ≤2.5.45, the system is vulnerable.

Impact Analysis

An attacker with limited privileges could exploit this to share sensitive data with unauthorized groups or attach globally restricted tags to events. This could lead to data leaks, compliance violations, or privilege escalation within the MISP system.

Compliance Impact

This vulnerability could violate GDPR or HIPAA by enabling unauthorized data sharing or tag propagation. Improper sharing group enforcement may expose sensitive data to unintended recipients, while incorrect tag handling could lead to improper data classification or export.

Mitigation Strategies

Immediately upgrade MISP to version 2.5.46 or later to apply the security fix. If upgrading is not possible, restrict access to event template instantiation features and review sharing group permissions for all users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88915. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart