CVE-2026-103858: MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions
MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization (org-only distribution). It did not enforce the full thread access control list, including sharing-group membership and event-level visibility.
As a result, an authenticated user who is outside the relevant sharing group or who does not have visibility on the associated event could:
- Read the thread title and the content of the quoted post
- Submit a new post into the discussion thread
This constitutes both an information disclosure (reading restricted thread and post content) and an integrity issue (injecting content into a thread the user is not authorized to participate in).
Affected: <2.5.48
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.48
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated MISP user can exploit it if they can target a discussion thread but are not a member of the relevant sharing group or do not have visibility of the associated event. The issue applies where access is restricted through sharing-group membership or event-level visibility rather than only an org-only thread restriction.
What information and actions are exposed through a successful exploit?
An unauthorized user can read the discussion thread title and the content of a quoted post. They can also submit a new post or reply to the restricted discussion thread.
Are versions prior to the fixed release affected?
MISP versions earlier than 2.5.48 are affected. The provided data does not identify any other affected version ranges or configuration prerequisites.