CVE-2026-54360: MISP sharing group creation mass assignment allows unauthorized takeover of existing sharing groups
A mass assignment vulnerability exists in MISP’s sharing group creation endpoint. When creating a new sharing group, the controller did not remove a user-supplied id field before saving the submitted data. In CakePHP, supplying a primary key in the save data can cause a create() followed by save() operation to update an existing record instead of creating a new one.
An authenticated user with permission to add sharing groups could therefore submit the identifier of an existing sharing group and modify that sharing group without passing the normal edit access-control checks. This may allow the attacker to take over or alter sharing groups they do not otherwise have access to, potentially affecting the confidentiality and integrity of information shared through those groups.
Affected component: app/Controller/SharingGroupsController.php, add() action
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the add() action removes or ignores any user-supplied 'id' in the incoming request data prior to calling create()/save() so that supplying a primary key cannot cause create() to update an existing record.
app/Controller/SharingGroupsController.php (add action) id parameter handling = unset or ignore user-supplied 'id' field before save - Configuration
If submitted data includes an identifier that corresponds to an existing sharing group, perform the normal edit access-control checks and deny the operation unless the user is authorized to edit that sharing group.
app/Controller/SharingGroupsController.php (add action) authorization on referenced id = validate edit permissions when payload references an existing id - Compensating control
Temporarily restrict the permission to add sharing groups to a small, trusted set of users (via ACL/role configuration) until the code is fixed to reduce the risk of unauthorized takeover.
- Operational
Audit recent sharing-group creations and modifications for signs of unauthorized changes, revert any unauthorized modifications from backups or known-good state, and review application logs to determine if the vulnerability was exploited.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54360?
The severity of CVE-2026-54360 is high, with a CVSS score of 8.4.
How do I fix CVE-2026-54360?
To fix CVE-2026-54360, ensure the id field is properly sanitized and removed from user-supplied data during the sharing group creation process.
What systems are affected by CVE-2026-54360?
CVE-2026-54360 affects MISP's sharing group creation functionality.
What type of vulnerability is CVE-2026-54360?
CVE-2026-54360 is a mass assignment vulnerability that allows unauthorized takeover of existing sharing groups.
When was CVE-2026-54360 published?
CVE-2026-54360 was published on June 12, 2026.