CVE-2026-112178 Details
Description
MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes. - A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute's distribution level (levels 1-3 should restrict visibility) - The owning organisation could not view proposals on its own org-only attributes Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions. Affected: <2.5.48
An access control vulnerability has been identified in MISP versions prior to 2.5.48. This flaw arises in the proposal visibility logic related to shadow attributes. The issue allows users in sharing groups to access proposals on attributes or objects within that group, without proper regard for the attribute's distribution level. Conversely, organizations are unable to view proposals on their own organization-only attributes. This misalignment in access control leads to unauthorized disclosure of proposed attribute changes to users who should not have access, based on distribution level restrictions.
Users can update to MISP version 2.5.50, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026Supplier
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MISP/MISP/commit/9c5af321f | CIRCL | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | CIRCL |
Affected Products
| Product | Versions |
|---|---|
| MISP | < 2.5.48 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | CIRCL |