CVE-2026-112178

MISP versions prior to 2.5.48 are vulnerable to an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check fails to verify the distribution level when a user belongs to a sharing group, allowing unauthorized users to view proposals on attributes or objects...