CVE-2026-112178: MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control
MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.
- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute's distribution level (levels 1-3 should restrict visibility)
- The owning organisation could not view proposals on its own org-only attributes
Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.
Affected: <2.5.48
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.48
Event History
Frequently Asked Questions
Who can exploit this issue?
A user who belongs to a sharing group associated with an attribute or object can view proposals on it even when the attribute's distribution level should restrict that visibility. Exploitation requires an authenticated low-privileged user account; no user interaction is required.
Which MISP deployments are affected?
MISP versions earlier than 2.5.48 are affected. The issue concerns proposal (shadow attribute) visibility where attributes or objects carry a sharing group and use distribution levels 1 through 3.
What information could be exposed?
Unauthorized users may see proposed changes to attributes or objects that they should not be able to access under the configured distribution-level restrictions. The described impact is confidentiality loss; no integrity or availability impact is specified.
How can administrators identify exposure before patching?
Review whether users belong to sharing groups attached to attributes or objects whose distribution level is 1, 2, or 3, and whether those users can access related proposals. Also check whether the owning organisation is unable to view proposals for its own organisation-only attributes.