Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112178— MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control

Quick assessment

Affected
MISP MISP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MISP 在提案（Shadow Attribute）的可见性逻辑中存在访问控制缺陷。授权检查仅接受携带用户所属共享组之一的属性或对象，而未验证其分发级别（distribution level），同时错误地阻止了拥有组织访问其自身“仅限组织”属性上的提案。 具体问题表现如下： 属于某个共享组的用户可以查看该共享组相关属性或对象上的提案，无论该属性的分发级别如何（分发级别 1 至 3 本应限制可见性）； 拥有组织无法查看其自身“仅限组织”属性上的提案。 安全影响：基于分发级别限制本应无权访问的用户，可能未经授权获取属性

CVSS 7.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112178

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control
Source: CVE Program / CVE List V5
Vulnerability Description
MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes. - A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute's distribution level (levels 1-3 should restrict visibility) - The owning organisation could not view proposals on its own org-only attributes Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions. Affected: <2.5.48
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MISP MISP 0 ~ 2.5.48 cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-112178

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112178

请登录查看更多情报信息。

Other References for CVE-2026-112178 (1)

Same Patch Batch · MISP · 2026-10-19 · 7 CVEs total

CVE-2026-112188 7.1 HIGH MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolutio
CVE-2026-112179 5.3 MEDIUM MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances
CVE-2026-112192 5.3 MEDIUM MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Setting
CVE-2026-112180 5.1 MEDIUM MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records
CVE-2026-112184 4.8 MEDIUM MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Lab
CVE-2026-112183 4.8 MEDIUM MISP CSS Injection via Remote Tag Colour in Event Preview

IV. Related Vulnerabilities

Same product: MISP
Same vendor: MISP
Same weakness: CWE-862

V. Comments for CVE-2026-112178

No comments yet

Leave a comment