CVE-2026-95671
Deferred Deferred - Pending Action

Authorization Bypass in MISP Collections via PUT Request

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: CIRCL

Description
In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add() method persists data on both POST and PUT requests. As a result, an authenticated user could issue a PUT request to the collections/add endpoint, bypassing the sharing-group authorization check entirely. This allowed the creation of a collection with distribution=4 (shared with a specific sharing group) targeting a sharing group that the user was not authorized to use. The bypassed check would normally verify that the current user has access to the specified sharing group before allowing the collection to be associated with it. The security impact is that an authenticated user can place collection data into a sharing group context they do not have legitimate access to, potentially exposing that data to all members of the unauthorized sharing group and violating the intended access-control boundaries of the MISP instance. The vulnerability requires an authenticated session and knowledge of a valid sharing group identifier; no user interaction or special tooling is needed beyond sending a PUT request instead of a POST request to the same endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-95671
EUVD
EUVD-2026-84380

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp to 4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MISP allows an authenticated user to bypass sharing-group authorization checks by using a PUT request instead of a POST request to the collections/add endpoint. Normally, the system checks if the user can access a specific sharing group before creating a collection with distribution=4 (shared with that group). However, the check only ran for POST requests, not PUT requests, letting users create collections in unauthorized sharing groups.

Detection Guidance

To detect this vulnerability, monitor HTTP requests to the MISP collections/add endpoint. Look for PUT requests with distribution=4 and sharing group IDs that the user is not authorized to access. Check server logs for unusual PUT requests to this endpoint.

Impact Analysis

An attacker with valid credentials could place sensitive collection data into a sharing group they are not authorized to access. This could expose the data to unintended recipients within that group, violating access-control boundaries and potentially leading to data leaks or unauthorized sharing.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating principles of data minimization and access control required by GDPR and HIPAA. If sensitive data is shared with unauthorized groups, it may result in non-compliance with these regulations, potentially leading to legal penalties or data breach notifications.

Mitigation Strategies

Apply the patch from the MISP commit c20f5a836 to ensure authorization checks run for both POST and PUT requests. Temporarily restrict PUT requests to the collections/add endpoint if immediate patching is not possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95671. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart