CVE-2026-88915: MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization
Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates.
For templates using distribution = 4, the template can specify a sharinggroupid. The instantiation path passed that value into event creation without verifying that the user instantiating the template was actually permitted to use the selected sharing group. The commit notes that Event::add() only performed its own sharing-group authorization in another code path, leaving template instantiation able to write the identifier directly.
The same instantiation path also attached template-specified tags without checking the user's normal tagging permissions. In addition, it hardcoded local => 0, meaning tags marked localonly could be attached globally and consequently propagate through synchronization or export, contrary to their intended restriction.
The fix adds explicit SharingGroup::canUse() authorization for the acting user, applies the same tag-modification checks used by normal event tagging, and ensures localonly tags are attached locally.
Version affected: ≤2.5.45
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user who can instantiate event templates is the relevant attacker. Exploitation requires a template with distribution set to 4 that specifies a sharing_group_id, or template-specified tags that would normally require authorization.
What unauthorized actions could occur?
The user may create an event using a sharing group they are not permitted to use and attach tags without the normal tag-modification permission checks. Tags marked local_only may also be attached as non-local, allowing them to propagate through synchronization or export.
Are deployments affected by default?
The issue is reachable through event template instantiation, rather than ordinary event creation or tagging paths. Exposure depends on whether users can instantiate templates that specify sharing groups or tags.
What can be done before updating?
Restrict template instantiation to trusted users and review templates that use distribution 4 with a sharing_group_id. Also review templates containing tags, especially local_only tags, and avoid using them until the affected system is updated.
How can administrators look for possible impact?
Review events created from templates for sharing groups inconsistent with the creator's permissions and for tags the creator was not authorized to apply. Investigate template-created events carrying local_only tags that may have synchronized or been exported globally.