CVE-2026-95697: MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata
MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group (SG) editor role can trigger this code path, allowing them to modify organization metadata that should be restricted to site administrators or users with sync permissions.
According to the commit message, this could lead to blueprint-based sharing group manipulation, meaning an attacker with SG editor access could alter organizational attributes in ways that influence how sharing groups and blueprints behave across the MISP instance.
The vulnerability requires an authenticated user with at least SG editor privileges and network access to the MISP web interface. The impact is primarily on the integrity of organization records and, potentially, on the integrity of sharing group configurations derived from those records.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
MISP instances are exposed where authenticated users have a sharing group editor role and can reach the MISP web interface. The issue affects organization metadata integrity and may also affect sharing group configurations derived from those records.
What does an attacker need to exploit it?
An attacker needs valid authentication, at least sharing group editor privileges, and network access to the MISP web interface. No unauthenticated exploitation is described.
How can defenders identify possible exploitation?
Review organization metadata changes and related sharing group or blueprint-derived configuration changes for actions performed by sharing group editor accounts. Such accounts should not normally be able to modify metadata restricted to site administrators or users with sync permissions.