Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-91825— MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit

Quick assessment

Affected
MISP MISP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

受影响版本的 MISP 在特定的事件编辑路径中，未能对提交的共享组（sharing group）进行授权检查。 具体而言，漏洞逻辑仅在请求中显式提供 时，才会检查操作用户是否有权使用所提交的 。如果攻击者省略了 字段，但提供了另一个 ，那么该授权检查分支就会被跳过。随后，MISP 的字段恢复逻辑会从存储中读取事件原有的分布（distribution）值。对于已经配置为“共享组分布”（即 distribution = 4）的事件，未被授权的共享组 ID 可能会被保存下来，从而导致越权访问或数据泄露风险。 修复方案：

CVSS 7.1 · High

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1090 · Proxy
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-91825

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit
Source: CVE Program / CVE List V5
Vulnerability Description
Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path. The vulnerable logic checked whether the acting user could use a sharing_group_id only when the request explicitly supplied distribution = 4. If the attacker instead omitted distribution but supplied a different sharing_group_id, that authorization branch was skipped. Later, MISP’s field-recovery logic restored the existing event distribution from storage. For events already configured with sharing-group distribution, the unauthorized sharing-group ID could therefore be saved. The fix adds authorization checks in both the controller and Event::_edit() whenever a non-empty sharing_group_id is supplied without distribution. The model now calls SharingGroup::checkIfAuthorised() before persisting the change. Version affected: ≤2.5.45
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MISP MISP 0 ~ 2.5.46 -

II. Public POCs for CVE-2026-91825

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-91825

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-91825 (1)

Same Patch Batch · MISP · 2026-09-15 · 6 CVEs total

CVE-2026-91846 7.1 HIGH MISP Collection Element Add Missing Authorization on Referenced Object UUID
CVE-2026-91819 6.9 MEDIUM MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent
CVE-2026-91851 5.3 MEDIUM MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission F
CVE-2026-91857 5.3 MEDIUM MISP: State-changing actions accessible via GET request enabling CSRF
CVE-2026-91859 5.3 MEDIUM MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass

IV. Related Vulnerabilities

Same product: MISP
Same vendor: MISP
Same weakness: CWE-862

V. Comments for CVE-2026-91825

No comments yet

Leave a comment