CVE-2026-54361: MISP Auth Bypass Vulnerability

CVE-2026-54361 Overview

CVE-2026-54361 describes multiple mass assignment vulnerabilities in MISP (Malware Information Sharing Platform) affecting collections, tag collections, event delegations, and shadow attributes. Several controller actions accepted user-supplied fields that should have remained server-controlled, including record identifiers and ownership fields such as id, org_id, orgc_id, and user_id. An authenticated attacker reaching the affected endpoints could craft requests that alter object ownership, redirect updates to other records, overwrite event delegation requests, or modify shadow attribute proposals belonging to another organization. The flaw is classified as Authorization Bypass Through User-Controlled Key [CWE-639].

Critical Impact
Authenticated attackers can transfer ownership of MISP objects across organizations and access or modify sensitive threat intelligence data.

Affected Products

MISP (Malware Information Sharing Platform) - CollectionsController::edit()
MISP - EventDelegationsController::delegateEvent() and ShadowAttributesController::edit()
MISP - TagCollectionsController::edit() and TagCollectionsController::editWithTags()

Discovery Timeline

2026-06-12 - CVE-2026-54361 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-54361

Vulnerability Analysis

The vulnerabilities stem from controller actions in MISP that pass user-supplied request data directly into model save operations without filtering protected fields. The CRUDComponent::edit() helper copies every supplied field onto the loaded record. When ownership keys such as org_id, orgc_id, or user_id appear in the request body, those values overwrite the stored values during save. An authenticated user can therefore reassign object ownership to another organization or user by injecting these fields.

A related class of flaws affects create-only paths. EventDelegationsController::delegateEvent() invokes create() followed by save(). When the attacker supplies an id field in the request body, the save converts from an insert into an update of an arbitrary existing delegation record. Authorization checks validated only the event referenced in the URL, not the delegation identifier injected through the body.

Depending on sharing configuration and object visibility, exploitation enables unauthorized access to or transfer of threat intelligence data between organizations using a shared MISP instance.

Root Cause

The root cause is missing field allow-lists during save operations. The affected controllers did not pin identity and ownership fields to their stored values, and they did not strip primary keys from create paths. This is a classic mass assignment pattern tracked under [CWE-639] (Authorization Bypass Through User-Controlled Key).

Attack Vector

The attacker must be authenticated and able to reach the affected MISP endpoints. No user interaction is required. The attacker submits an edit or delegation request that includes additional fields such as id, org_id, orgc_id, or user_id in the request body, causing the server to overwrite ownership data or redirect the save to a different record.

php

                 }
             }
             $params = [
+                // Identity and ownership fields must never be reassigned through edit. The model only
+                // forces these on create (Collection::beforeValidate runs its ownership block only when
+                // the id is empty), and CRUDComponent::edit() copies every supplied field onto the loaded
+                // record. Without pinning them here a user could hand the collection to another org/user,
+                // or redirect the save onto a different collection via an injected id (mayModify only
+                // checked the id from the route). Force them back to the stored values.
+                'override' => [
+                    'id' => $oldCollection['Collection']['id'],
+                    'orgc_id' => $oldCollection['Collection']['orgc_id'],
+                    'org_id' => $oldCollection['Collection']['org_id'],
+                    'user_id' => $oldCollection['Collection']['user_id'],
+                ],
                 'afterSave' => function (array &$collection) use ($data) {
                     $collection = $this->Collection->CollectionElement->captureElements($collection);
                     return $collection;

Source: MISP commit 9341690e

Detection Methods for CVE-2026-54361

Indicators of Compromise

POST or PUT requests to /collections/edit, /tag_collections/edit, /tag_collections/editWithTags, /shadow_attributes/edit, or /event_delegations/delegateEvent containing unexpected id, org_id, orgc_id, or user_id parameters in the body.
MISP audit log entries showing ownership changes (org_id or orgc_id modified) on collections, tag collections, or shadow attributes outside normal administrative workflows.
Event delegation records that were created or modified through delegateEvent calls where the request body contained a primary key.

Detection Strategies

Parse MISP application and web server logs for edit requests whose request bodies include ownership or identifier fields that are not part of the standard UI workflow.
Compare current org_id, orgc_id, and user_id values on collections and shadow attributes against historical database snapshots to identify unauthorized reassignments.
Alert on event delegation rows where the requester organization does not align with the originating event ownership.

Monitoring Recommendations

Enable verbose MISP audit logging and forward records to a central log platform for correlation across organizations sharing the instance.
Monitor authenticated API usage by low-privileged users for sudden interaction with delegation, collection, or shadow attribute endpoints.
Track changes to ownership columns on the affected tables and trigger alerts on cross-organization transitions.

How to Mitigate CVE-2026-54361

Immediate Actions Required

Apply the upstream MISP patch from commit 9341690e9b6dde7f0605edea5533e05ba7362e35, which pins ownership and identity fields during edits and removes user-supplied primary keys from create paths.
Audit recent edits to collections, tag collections, shadow attributes, and event delegations for unauthorized ownership changes, and restore correct values from backups where needed.
Restrict access to the affected endpoints to trusted users until the patch is deployed.

Patch Information

The issue was fixed by explicitly pinning id, org_id, orgc_id, and user_id to their stored values during edit operations in CollectionsController::edit(), ShadowAttributesController::edit(), TagCollectionsController::edit(), and TagCollectionsController::editWithTags(). The fix also unsets id before create() in EventDelegationsController::delegateEvent() to prevent injected primary keys from converting a create into an update. See the MISP security commit for the complete diff.

Workarounds

Place the MISP web interface behind a reverse proxy and block requests to the affected controller actions that include id, org_id, orgc_id, or user_id parameters in the request body.
Reduce the population of authenticated users with access to edit collections, tag collections, shadow attributes, and event delegations until the patch is applied.

bash

# Example NGINX rule blocking ownership fields on affected endpoints
location ~ ^/(collections|tag_collections|shadow_attributes|event_delegations)/ {
    if ($request_method ~ ^(POST|PUT)$) {
        if ($request_body ~* "(\"|&)(org_id|orgc_id|user_id|id)(\"|=)") {
            return 403;
        }
    }
    proxy_pass http://misp_backend;
}