CVE-2026-88915 Details
Description
Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates. For templates using distribution = 4, the template can specify a sharing_group_id. The instantiation path passed that value into event creation without verifying that the user instantiating the template was actually permitted to use the selected sharing group. The commit notes that Event::_add() only performed its own sharing-group authorization in another code path, leaving template instantiation able to write the identifier directly. The same instantiation path also attached template-specified tags without checking the user's normal tagging permissions. In addition, it hardcoded local => 0, meaning tags marked local_only could be attached globally and consequently propagate through synchronization or export, contrary to their intended restriction. The fix adds explicit SharingGroup::canUse() authorization for the acting user, applies the same tag-modification checks used by normal event tagging, and ensures local_only tags are attached locally. Version affected: ≤2.5.45
A vulnerability exists in MISP versions through 2.5.45, where the authorization of users is not properly enforced when event templates are instantiated. This issue allows users to bypass sharing group permissions and tagging restrictions. Specifically, for templates distributed publicly, the sharing group ID can be applied without verifying if the user is authorized to use it. Additionally, the vulnerability allows template-specified tags to be added without checking tagging permissions. Local-only tags could be attached globally, contradicting their intended restriction, and could propagate through synchronization or export. The vulnerability arises because the event addition function only applies sharing group authorization in certain contexts, leaving template instantiation unchecked.
Users can update to MISP version 2.5.47 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 10, 2026CISA-ADP
Assessed Sep 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MISP/MISP/commit/3aa3a9a97 | CIRCL | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | CIRCL |
Affected Products
| Product | Versions |
|---|---|
| MISP | <= 2.5.45 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | CISA-ADP |
| Sep 10, 2026 | New CVE Received | CIRCL |