CVE-2026-54398

An authorization flaw in MISP’s object add/edit handling allowed an authenticated user with object editing permissions to assign a MISP object, or attributes contained within an object, to a sharing group that the user was not authorized to use or view. When editing objects, the sharing group validation was performed against the wrong request data structure after object fields had been merged to the top level, causing the check to be bypassed. In addition, attributes embedded in objects were not individually validated for authorized sharing group use. An attacker could craft a request with distribution set to 4 and an arbitrary sharing_group_id, potentially disclosing the existence or name of otherwise non-visible sharing groups and improperly modifying the distribution metadata of objects or contained attributes.

CVSS

No CVSS.

References

Link	Resource
https://github.com/MISP/MISP/commit/4fe48c523e66999d65f99fdec9508adb3aa1c0f3

Configurations

No configuration.

History

23 Jul 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) Una falla de autorización en el manejo de adición/edición de objetos de MISP permitió a un usuario autenticado con permisos de edición de objetos asignar un objeto MISP, o atributos contenidos dentro de un objeto, a un grupo de compartición que el usuario no estaba autorizado a usar o ver. Al editar objetos, la validación del grupo de compartición se realizó contra la estructura de datos de solicitud incorrecta después de que los campos del objeto se habían fusionado al nivel superior, lo que provocó que la verificación fuera eludida. Además, los atributos incrustados en los objetos no fueron validados individualmente para el uso autorizado del grupo de compartición. Un atacante podría elaborar una solicitud con la distribución establecida en 4 y un 'sharing_group_id' arbitrario, revelando potencialmente la existencia o el nombre de grupos de compartición que de otro modo no serían visibles y modificando indebidamente los metadatos de distribución de objetos o atributos contenidos.

12 Jun 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-12 22:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-54398

Mitre link : CVE-2026-54398

CVE.ORG link : CVE-2026-54398

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-54398", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54398", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T17:25:59.701775Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "affectedData": [{"repo": "https://github.com/misp/misp", "vendor": "misp", "product": "misp", "versions": [{"status": "affected", "version": "0", "lessThan": "2.5.40", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-12T22:16:56.370", "references": [{"url": "https://github.com/MISP/MISP/commit/4fe48c523e66999d65f99fdec9508adb3aa1c0f3", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An authorization flaw in MISP\u2019s object add/edit handling allowed an authenticated user with object editing permissions to assign a MISP object, or attributes contained within an object, to a sharing group that the user was not authorized to use or view. When editing objects, the sharing group validation was performed against the wrong request data structure after object fields had been merged to the top level, causing the check to be bypassed. In addition, attributes embedded in objects were not individually validated for authorized sharing group use.\n\nAn attacker could craft a request with distribution set to 4 and an arbitrary sharing_group_id, potentially disclosing the existence or name of otherwise non-visible sharing groups and improperly modifying the distribution metadata of objects or contained attributes."}, {"lang": "es", "value": "Una falla de autorizaci\u00f3n en el manejo de adici\u00f3n/edici\u00f3n de objetos de MISP permiti\u00f3 a un usuario autenticado con permisos de edici\u00f3n de objetos asignar un objeto MISP, o atributos contenidos dentro de un objeto, a un grupo de compartici\u00f3n que el usuario no estaba autorizado a usar o ver. Al editar objetos, la validaci\u00f3n del grupo de compartici\u00f3n se realiz\u00f3 contra la estructura de datos de solicitud incorrecta despu\u00e9s de que los campos del objeto se hab\u00edan fusionado al nivel superior, lo que provoc\u00f3 que la verificaci\u00f3n fuera eludida. Adem\u00e1s, los atributos incrustados en los objetos no fueron validados individualmente para el uso autorizado del grupo de compartici\u00f3n.\n\nUn atacante podr\u00eda elaborar una solicitud con la distribuci\u00f3n establecida en 4 y un 'sharing_group_id' arbitrario, revelando potencialmente la existencia o el nombre de grupos de compartici\u00f3n que de otro modo no ser\u00edan visibles y modificando indebidamente los metadatos de distribuci\u00f3n de objetos o atributos contenidos."}], "lastModified": "2026-07-23T09:10:00.113", "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}