PT-2026-56818 · Misp · Misp

Andras Iklody + 1 · Publicado 2026-07-09 · Atualizado 2026-07-09 · CVE-2026-61474

NVD

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

An improper authorization check in MISP’s attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharing group id without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly set to 4 — “sharing group”.

As a result, a user could reference or associate an attribute with a sharing group they were not authorized to use. This could lead to an access-control bypass affecting the integrity of attribute sharing metadata and potentially expose or misuse restricted sharing group relationships.

The patch changes the authorization logic so that the sharing group permission check is performed whenever a non-empty sharing group id is provided, regardless of the selected distribution value.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-61474

Produtos afetados

Misp

Referências · 2

• https://github.com/MISP/MISP/commit/df612166538e2979fae9f7eda88345ccc8fee761 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-61474 · Nota de Segurança