CVE-2026-95697
Deferred Deferred - Pending Action

Authorization Bypass in MISP Organisation Metadata

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: CIRCL

Description
MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group (SG) editor role can trigger this code path, allowing them to modify organization metadata that should be restricted to site administrators or users with sync permissions. According to the commit message, this could lead to blueprint-based sharing group manipulation, meaning an attacker with SG editor access could alter organizational attributes in ways that influence how sharing groups and blueprints behave across the MISP instance.  The vulnerability requires an authenticated user with at least SG editor privileges and network access to the MISP web interface. The impact is primarily on the integrity of organization records and, potentially, on the integrity of sharing group configurations derived from those records.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-95697
EUVD
EUVD-2026-84494

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp to 3.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MISP has an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying sufficient privileges. A user with a sharing group (SG) editor role can trigger this, allowing them to modify organization metadata that should be restricted to site administrators or users with sync permissions.

Detection Guidance

To detect this vulnerability, review MISP logs for unauthorized modifications to organization metadata by users with SG editor roles. Check for attempts to overwrite fields like type, date_created, or nationality without admin or sync permissions. Use commands like grep to search logs for 'captureOrg' calls with force=true by non-privileged users.

Impact Analysis

An attacker with SG editor access could alter organizational attributes, potentially influencing sharing group and blueprint behavior across the MISP instance. This impacts the integrity of organization records and sharing group configurations derived from those records.

Mitigation Strategies

Apply the patch from the referenced commit to enforce permission checks in the captureOrg function. Ensure only users with perm_site_admin or perm_sync roles can overwrite sensitive organization metadata. Temporarily restrict SG editor roles from modifying critical fields until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95697. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart