CVE-2026-54360: MISP Auth Bypass Vulnerability

CVE-2026-54360 Overview

CVE-2026-54360 is a mass assignment vulnerability in the Malware Information Sharing Platform (MISP) sharing group creation endpoint. The add() action in app/Controller/SharingGroupsController.php failed to strip a user-supplied id field before persisting submitted data. In CakePHP, supplying a primary key in save data converts a create() followed by save() call into an update of an existing record. An authenticated user with permission to add sharing groups can submit the identifier of an existing sharing group and modify it, bypassing the normal edit access-control checks. This affects the confidentiality and integrity of information shared through those groups [CWE-639].

Critical Impact
Authenticated low-privilege users can take over arbitrary MISP sharing groups, altering membership and access to threat intelligence shared through those groups.

Affected Products

MISP (Malware Information Sharing Platform) — app/Controller/SharingGroupsController.php, add() action
MISP deployments using the CakePHP framework prior to the referenced security commit
Any MISP instance permitting non-administrative users to create sharing groups

Discovery Timeline

2026-06-12 - CVE-2026-54360 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-54360

Vulnerability Analysis

The flaw is a classic mass assignment issue rooted in CakePHP ORM behavior. When a controller invokes $this->SharingGroup->create() followed by save($data), the framework treats an id key in $data as a directive to update the row with that primary key rather than to insert a new one. The add() action of SharingGroupsController passed user-controlled payloads to the model without stripping the id field, allowing the create path to silently mutate existing records.

The access-control logic for the edit path is never executed in this flow, because the request is routed through the add endpoint. As a result, ownership and membership of any existing sharing group can be rewritten by a user who only has the right to create new ones. Sharing groups in MISP govern which organizations see which events and attributes, so unauthorized modification directly impacts intelligence confidentiality and distribution integrity.

Root Cause

The controller trusted client-supplied keys in the sharing group payload. CakePHP's save() semantics make the id field privileged metadata, not user data. Without an explicit unset($sg['id']), the request body could redirect persistence to any existing record.

Attack Vector

An authenticated attacker with the sharing-group-add permission submits a crafted POST to the add endpoint. The body includes the id of a target sharing group the attacker does not own. The save operation updates the target record with attacker-controlled fields, bypassing edit ACL checks.

php

                }
            }
            $this->SharingGroup->create();
+            // Never allow an id to be supplied on add: a primary key in the save data turns
+            // create() + save() into an update of an arbitrary existing sharing group, bypassing
+            // the edit ACL and letting a user take over a SG they have no access to.
+            unset($sg['id']);
            if (!$canModifyUuid) {
                unset($sg['uuid']);
            }

Source: MISP security patch commit 687e7cb5

Detection Methods for CVE-2026-54360

Indicators of Compromise

POST requests to /sharing_groups/add containing an id field in the body or form payload.
MISP audit log entries showing modifications to a sharing group whose created_by user differs from the actor performing the change.
Unexpected changes in sharing group membership, organisation lists, or roaming and active flags without a corresponding edit event in the audit log.

Detection Strategies

Parse MISP application logs and web server access logs for POST /sharing_groups/add requests whose payload includes SharingGroup[id] or a JSON id key.
Correlate sharing group modified timestamps against the audit log; updates occurring through the add controller will not have matching edit entries.
Alert on any sharing group whose record is updated by a user lacking the Sharing group editor role.

Monitoring Recommendations

Forward MISP audit logs and HTTP access logs to a centralized analytics platform and retain at least 90 days for retrospective hunting.
Build queries that join sharing group change events with the originating controller action to surface mismatches between intended and actual operations.
Track baseline rates of sharing group creation per user and alert on anomalies that could indicate scripted abuse of the add endpoint.

How to Mitigate CVE-2026-54360

Immediate Actions Required

Update MISP to a build that includes commit 687e7cb530ae0e2faaadf5e3e44712258fb3ef1b or later.
Audit recent modifications to sharing groups and revert unauthorized changes using backups or the MISP audit log.
Review which users hold the perm_sharing_group permission and restrict it to trusted accounts until patching is complete.

Patch Information

The MISP project fixed the issue by calling unset($sg['id']) immediately after $this->SharingGroup->create() in app/Controller/SharingGroupsController.php. This prevents a client-supplied primary key from converting an insert into an update. Apply the patch from the MISP GitHub commit 687e7cb5 and restart the MISP workers.

Workarounds

Temporarily revoke the sharing-group-add permission (perm_sharing_group) from non-administrator roles until the patch is applied.
Place a reverse-proxy rule in front of MISP that rejects POST bodies to /sharing_groups/add containing an id parameter.
Increase audit log review cadence for sharing group changes during the exposure window.

bash

# Example NGINX rule to block 'id' fields in sharing group add requests
location = /sharing_groups/add {
    if ($request_method = POST) {
        if ($request_body ~* "(\"id\"\s*:|SharingGroup\[id\])") {
            return 403;
        }
    }
    proxy_pass http://misp_backend;
}