CVE-2026-91825
Received Received - Intake

Authorization Bypass in MISP via Sharing Group ID

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: CIRCL

Description
Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path. The vulnerable logic checked whether the acting user could use a sharing_group_id only when the request explicitly supplied distribution = 4. If the attacker instead omitted distribution but supplied a different sharing_group_id, that authorization branch was skipped. Later, MISP’s field-recovery logic restored the existing event distribution from storage. For events already configured with sharing-group distribution, the unauthorized sharing-group ID could therefore be saved. The fix adds authorization checks in both the controller and Event::_edit() whenever a non-empty sharing_group_id is supplied without distribution. The model now calls SharingGroup::checkIfAuthorised() before persisting the change. Version affected: ≤2.5.45

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91825
EUVD
EUVD-2026-78324

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp to 2.5.45 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MISP (≤2.5.45) allows an attacker to bypass authorization checks for sharing groups by omitting the distribution field during an event edit. The system only verified sharing group permissions when distribution was explicitly set to 4, enabling unauthorized sharing group IDs to be saved if the event already used sharing-group distribution.

Impact Analysis

An attacker could gain unauthorized access to sensitive event data by setting a sharing group ID without proper authorization. This could lead to data leaks or improper data sharing if the attacker manipulates event configurations.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data, potentially breaching GDPR (data protection) or HIPAA (health information privacy) if the affected data falls under those regulations.

Mitigation Strategies

Upgrade MISP to a version higher than 2.5.45 where the authorization checks for sharing_group_id are properly enforced in all event-edit paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91825. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart