CVE-2026-54398: MISP object edit authorization bypass allows unauthorized sharing group assignment
An authorization flaw in MISP’s object add/edit handling allowed an authenticated user with object editing permissions to assign a MISP object, or attributes contained within an object, to a sharing group that the user was not authorized to use or view. When editing objects, the sharing group validation was performed against the wrong request data structure after object fields had been merged to the top level, causing the check to be bypassed. In addition, attributes embedded in objects were not individually validated for authorized sharing group use.
An attacker could craft a request with distribution set to 4 and an arbitrary sharinggroupid, potentially disclosing the existence or name of otherwise non-visible sharing groups and improperly modifying the distribution metadata of objects or contained attributes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify object-editing logic so sharing-group authorization is performed against the original nested object/request data (before object fields are merged to the top level). Additionally, individually validate the sharing_group_id for each attribute embedded in an object to ensure the editing user is authorized to use or view that sharing group.
MISP object add/edit handling sharing_group_validation = validate against original nested object/request data and validate per-attribute sharing_group_id before merging - Configuration
Enforce authorization checks on distribution and sharing_group_id fields when objects or attributes are created or edited. Specifically ensure users who are not authorized cannot set distribution to 4 or assign an arbitrary sharing_group_id.
MISP object distribution handling distribution enforcement = prevent unauthorized assignment of distribution=4 and arbitrary sharing_group_id - Compensating control
Restrict object/attribute edit permissions to trusted roles and, where feasible, limit access to object-editing API endpoints to trusted networks or IP ranges (firewall/ACL) until a code fix is deployed.
- Operational
Audit existing objects and embedded attributes for sharing_group_id assignments and distribution=4 values that may have been set by unauthorized users. Revert or correct unauthorized assignments, investigate any disclosure of sharing-group existence or names, and notify/stage remediation for affected records and stakeholders.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54398?
CVE-2026-54398 has a medium severity rating of 5.3.
What does CVE-2026-54398 affect?
CVE-2026-54398 affects the MISP software allowing unauthorized sharing group assignment.
How do I fix CVE-2026-54398?
To fix CVE-2026-54398, update to the latest version of MISP that addresses the authorization flaw.
What is the impact of CVE-2026-54398?
The impact of CVE-2026-54398 is the potential unauthorized sharing of sensitive data among groups.
Who is affected by CVE-2026-54398?
Authenticated users with object editing permissions in MISP may be affected by CVE-2026-54398.