CVE-2026-61474: MISP: Improper sharing group authorization check when adding attributes
An improper authorization check in MISP’s attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharinggroupid without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly set to 4 — “sharing group”.
As a result, a user could reference or associate an attribute with a sharing group they were not authorized to use. This could lead to an access-control bypass affecting the integrity of attribute sharing metadata and potentially expose or misuse restricted sharing group relationships.
The patch changes the authorization logic so that the sharing group permission check is performed whenever a non-empty sharinggroupid is provided, regardless of the selected distribution value.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Patch MISP: Improper sharing group authorization check when adding attributes
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61474?
CVE-2026-61474 has a risk score of 40, indicating a moderate level of severity.
How do I fix CVE-2026-61474?
To fix CVE-2026-61474, ensure that sharing group authorization checks are correctly implemented in the attribute creation endpoint.
What kind of vulnerability is CVE-2026-61474?
CVE-2026-61474 is an improper authorization check vulnerability affecting the MISP attributes creation process.
Who is affected by CVE-2026-61474?
Authenticated users in MISP with permission to add attributes are affected by CVE-2026-61474.
What impact does CVE-2026-61474 have on MISP users?
CVE-2026-61474 allows users to bypass sharing group authorization checks, potentially leading to unauthorized data sharing.