CVE-2026-91825: MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit
Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path.
The vulnerable logic checked whether the acting user could use a sharinggroupid only when the request explicitly supplied distribution = 4. If the attacker instead omitted distribution but supplied a different sharinggroupid, that authorization branch was skipped. Later, MISP’s field-recovery logic restored the existing event distribution from storage. For events already configured with sharing-group distribution, the unauthorized sharing-group ID could therefore be saved.
The fix adds authorization checks in both the controller and Event::edit() whenever a non-empty sharinggroupid is supplied without distribution. The model now calls SharingGroup::checkIfAuthorised() before persisting the change.
Version affected: ≤2.5.45
Affected Software
Event History
Frequently Asked Questions
Which deployments and events are exposed to this issue?
MISP versions up to and including 2.5.45 are affected. The vulnerable path applies to events that are already configured to use sharing-group distribution.
What does an attacker need to submit to reach the vulnerable edit path?
The edit request must include a non-empty sharing_group_id that the acting user is not authorized to use, while omitting the distribution field. Supplying distribution = 4 would invoke the existing authorization branch instead.
What should remediation change in the edit workflow?
The fix performs sharing-group authorization whenever a non-empty sharing_group_id is submitted without a distribution value. Authorization is enforced in both the controller and Event::_edit() before the changed sharing group is persisted.