{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-91825", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "state": "PUBLISHED", "assignerShortName": "CIRCL", "dateReserved": "2026-09-15T08:06:29.530Z", "datePublished": "2026-09-15T08:06:32.511Z", "dateUpdated": "2026-09-15T08:06:32.511Z"}, "containers": {"cna": {"affected": [{"modules": ["EventsController (edit action)", "Event model (_edit method)"], "product": "MISP", "programFiles": ["app/Controller/EventsController.php", "app/Model/Event.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.46", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5 (1M context)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p></p><p>Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path.</p>\n<p>The vulnerable logic checked whether the acting user could use a <code>sharing_group_id</code> only when the request explicitly supplied <code>distribution = 4</code>. If the attacker instead omitted <code>distribution</code> but supplied a different <code>sharing_group_id</code>, that authorization branch was skipped. Later, MISP\u2019s field-recovery logic restored the existing event distribution from storage. For events already configured with sharing-group distribution, the unauthorized sharing-group ID could therefore be saved.</p>\n<p>The fix adds authorization checks in both the controller and <code>Event::_edit()</code> whenever a non-empty <code>sharing_group_id</code> is supplied without <code>distribution</code>. The model now calls <code>SharingGroup::checkIfAuthorised()</code> before persisting the change.</p><p></p><p>Version affected: \u22642.5.45<br></p>"}], "value": "Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path.\n\n\nThe vulnerable logic checked whether the acting user could use a sharing_group_id only when the request explicitly supplied distribution = 4. If the attacker instead omitted distribution but supplied a different sharing_group_id, that authorization branch was skipped. Later, MISP\u2019s field-recovery logic restored the existing event distribution from storage. For events already configured with sharing-group distribution, the unauthorized sharing-group ID could therefore be saved.\n\n\nThe fix adds authorization checks in both the controller and Event::_edit() whenever a non-empty sharing_group_id is supplied without distribution. The model now calls SharingGroup::checkIfAuthorised() before persisting the change.\n\n\n\nVersion affected: \u22642.5.45"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 7.1, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-09-15T08:06:32.511Z"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/cf3ee4026"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix adds an explicit authorization check for the sharing_group_id in the code path where the distribution field is omitted from the edit request. In the controller, if no distribution is submitted but a sharing_group_id is present and differs from the stored value, the user's access to that sharing group is verified via checkIfCanBeUsed before the edit proceeds. In the model's _edit method, a parallel check via checkIfAuthorised is added for the same condition, returning an error if the user is not authorized for the submitted sharing group. This closes the gap where omitting the distribution field bypassed the existing authorization gate.</p>"}], "value": "The fix adds an explicit authorization check for the sharing_group_id in the code path where the distribution field is omitted from the edit request. In the controller, if no distribution is submitted but a sharing_group_id is present and differs from the stored value, the user's access to that sharing group is verified via checkIfCanBeUsed before the edit proceeds. In the model's _edit method, a parallel check via checkIfAuthorised is added for the same condition, returning an error if the user is not authorized for the submitted sharing group. This closes the gap where omitting the distribution field bypassed the existing authorization gate."}], "title": "MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "review", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The affected version range is inferred from the tag_version_boundary (v2.5.46 with 216 commits after fix); no explicit fixed version tag is provided in the metadata, so the boundary is approximate.", "The attacker must already possess authenticated edit access to at least one event in MISP; the vulnerability does not grant access to users without any event edit permission.", "The impact assessment assumes the unauthorized sharing group contains other users who would gain visibility into the event data; if the target group is empty, the confidentiality impact is reduced.", "The patch was found during internal review per the commit message; no external reporter or finder is identified in the metadata."], "commit": "cf3ee40265ee102f28dae9ec313abe4162aff8e3", "confidence": "high", "credits": [{"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5 (1M context)"}], "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The attack requires only omitting a field from a standard edit request; no race condition or complex manipulation is needed. AT:N: No prior user interaction or attack preparation is required. PR:L: The attacker must be an authenticated user with edit access to at least one event. UI:N: No victim interaction is needed. VC:L: Event data may be exposed to members of the unauthorized sharing group. VI:H: The event's sharing group assignment is modified without authorization, directly compromising data integrity. VA:N: No availability impact. SC/SI/SA: No secondary system impact is evidenced; the impact is confined to the MISP instance's data integrity and the confidentiality of the affected event record.", "draft": false, "fixSummary": "The fix adds an explicit authorization check for the sharing_group_id in the code path where the distribution field is omitted from the edit request. In the controller, if no distribution is submitted but a sharing_group_id is present and differs from the stored value, the user's access to that sharing group is verified via checkIfCanBeUsed before the edit proceeds. In the model's _edit method, a parallel check via checkIfAuthorised is added for the same condition, returning an error if the user is not authorized for the submitted sharing group. This closes the gap where omitting the distribution field bypassed the existing authorization gate.", "generatedAt": "2026-09-15T07:50:41.743787Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 9, "assumptionCount": 4, "confidence": "high", "model": "qwen3.8:27b", "score": 7}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "5229e7ba08a4a77a41d8205ce51428ae17242c7dc7873bc4c087fb828631869e", "patchSummary": "Two files are modified with 25 lines of insertions. In EventsController.php (edit method), a new else-if branch is added after the existing distribution-handling logic: when distribution is not set, sharing_group_id is non-empty, and it differs from the stored value, the code calls SharingGroup->checkIfCanBeUsed() and throws MethodNotAllowedException on failure. In Event.php (_edit method), a new elseif branch is added for the case where distribution is not set in the submitted data but sharing_group_id is present; it calls SharingGroup->checkIfAuthorised() and returns an error array if the user lacks access. Both additions are narrowly scoped to the omitted-distribution path and do not alter behavior for explicitly stated non-4 distribution values.", "patchTruncated": false, "patches": [{"commit": "cf3ee40265ee102f28dae9ec313abe4162aff8e3", "patchSha256": "5229e7ba08a4a77a41d8205ce51428ae17242c7dc7873bc4c087fb828631869e", "source": "https://github.com/MISP/MISP/commit/cf3ee4026.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/cf3ee4026.patch", "subject": "fix: [security] Authorise the event sharing group when"}], "source": "https://github.com/MISP/MISP/commit/cf3ee4026.patch", "subject": "fix: [security] Authorise the event sharing group when", "tagVersionBoundary": {"commits_after_fix": 216, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.46", "version": "2.5.46", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-862", "rationale": "The authorization check for the sharing_group_id was conditionally executed only when the distribution field was explicitly set to 4. By omitting the distribution field, an attacker bypassed the authorization gate entirely, allowing an unauthorized sharing group assignment to be persisted. The check existed but was not applied to all code paths that could result in the sharing group being saved."}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20122"}]}}}

{}

{}

{}

{}