EUVD-2026-84380

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

CVE-2026-95671

CVE-2026-95671 affects MISP (Malware Information Sharing Platform). The CollectionsController add() method only enforced the sharing-group authorization check for POST requests, while the underlying CRUDComponent::add() persists data on both POST and PUT requests. An authenticated user could ther...

CVE-2026-95671 MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

CVE-2026-95671 MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

PT-2026-96726

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description An authenticated user can bypass sharing-group authorization checks by sending a PUT request instead of a POST request to the 'collections/add' endpoint. This occurs because the add method in th...