PT-2026-107497

MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified. When a user edits an existing event and changes its distribution or sharing group id, the internal before-save ho...

CVE-2026-103858 MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions

MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization org-only distribution. It did not enforce...

CVE-2026-103659

MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distributi...

EUVD-2026-90575

MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distributi...

CVE-2026-95697 MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group SG edit...

CVE-2026-95697 MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group SG edit...

CVE-2026-95671

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

CVE-2026-95671 MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

EUVD-2026-84380

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

CVE-2026-95671

CVE-2026-95671 affects MISP (Malware Information Sharing Platform). The CollectionsController add() method only enforced the sharing-group authorization check for POST requests, while the underlying CRUDComponent::add() persists data on both POST and PUT requests. An authenticated user could ther...

CVE-2026-95671 MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

PT-2026-96726

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description An authenticated user can bypass sharing-group authorization checks by sending a PUT request instead of a POST request to the 'collections/add' endpoint. This occurs because the add method in th...

CVE-2026-95671: Missing Authorization

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

CVE-2026-94394 MISP ObjectReferencesController: Granular Distribution and Sharing Group Restrictions Bypassed When Adding Object References

When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user. Because of this, someone who can view an event could potentially access...

CVE-2026-94394 MISP ObjectReferencesController: Granular Distribution and Sharing Group Restrictions Bypassed When Adding Object References

When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user. Because of this, someone who can view an event could potentially access...

CVE-2026-94394

CVE-2026-94394 affects the MISP threat intelligence platform, specifically the ObjectReferencesController . When a regular user adds a reference between objects or attributes, MISP verifies access to the parent event but does not always enforce granular sharing group or distribution-level restric...

EUVD-2026-83912

When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user. Because of this, someone who can view an event could potentially access...

CVE-2026-91825

Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path. The vulnerable logic checked whether the acting user could use a sharinggroupid only when the request explicitly supplied distribution = 4. If the attacker instead omitted distribution but supplie...

CVE-2026-91825 MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit

Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path. The vulnerable logic checked whether the acting user could use a sharinggroupid only when the request explicitly supplied distribution = 4. If the attacker instead omitted distribution but supplie...

CVE-2026-91825

MISP versions ≤2.5.45 contain an authorization bypass in the event-edit path. When a request supplied a non-empty sharing_group_id but omitted the distribution field , the authorization check (which only fired for distribution = 4) was skipped. MISP's field-recovery logic then restored the existi...