CVE-2026-54397: MISP Auth Bypass Vulnerability

CVE-2026-54397 Overview

CVE-2026-54397 is an authorization vulnerability in MISP, the open-source Malware Information Sharing Platform. The flaw resides in the non-REST event editing path, where authenticated users with event edit permissions can tamper with form data to set an event's sharing_group_id to a sharing group they are not authorized to use. The REST edit path enforces sharing group authorization through Event::_edit(), but the non-REST save path wrote sharing_group_id directly from the submitted form without the same check. The issue is tracked under CWE-863: Incorrect Authorization.

Critical Impact
An authenticated editor can assign events to restricted or undisclosed sharing groups, leaking the sharing group name in event listings and modifying event distribution metadata without authorization.

Affected Products

MISP (Malware Information Sharing Platform) — non-REST event editing path
Versions prior to the fix in commit 609ff6c785d7dae41d22ef43dda9347d34cd2a58
Deployments where authenticated users hold event edit permissions

Discovery Timeline

2026-06-12 - CVE-2026-54397 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-54397

Vulnerability Analysis

The vulnerability exists in app/Controller/EventsController.php within MISP's non-REST event save logic. When an event's distribution is set to 4 (sharing group distribution), the controller accepted the submitted sharing_group_id value and persisted it directly. The REST path performs SharingGroup::checkIfCanBeUsed() to ensure the current user is permitted to use the selected sharing group. The non-REST path omitted this check entirely.

An authenticated user with event edit rights could intercept and modify the event edit POST request, substituting a sharing_group_id belonging to a restricted or undisclosed sharing group. MISP would then attach the event to that sharing group and surface the sharing group's name in event listings, revealing the existence and identity of sharing groups not intended for that user.

Root Cause

The root cause is inconsistent authorization enforcement between two code paths that share the same data model. The REST handler validated sharing group eligibility; the non-REST controller did not. Additionally, when distribution was not 4, the controller did not clear sharing_group_id, allowing stale or attacker-controlled values to persist on the event record.

Attack Vector

Exploitation requires an authenticated MISP account with event edit privileges. The attacker submits a tampered event edit form containing Event[distribution]=4 and an arbitrary Event[sharing_group_id] referencing a sharing group they cannot legitimately access.

php

             // say what fields are to be updated
             $fieldList = array('date', 'threat_level_id', 'analysis', 'info', 'published', 'distribution', 'timestamp', 'sharing_group_id', 'extends_uuid');
 
+            // If the distribution is set to a sharing group, validate that the user is actually allowed
+            // to use the chosen SG. The REST path enforces this via Event::_edit(), but the non-REST save
+            // below writes sharing_group_id straight from the submitted form, so without this guard an
+            // editor could tamper with the form to pick a sharing group they have no access to (leaking
+            // its name on the event index). Keeping the event's existing SG unchanged stays allowed.
+            if (isset($this->request->data['Event']['distribution']) && $this->request->data['Event']['distribution'] == 4) {
+                if (($this->request->data['Event']['sharing_group_id'] ?? 0) != $event['Event']['sharing_group_id']) {
+                    $canSGBeUsed = $this->Event->SharingGroup->checkIfCanBeUsed($this->Auth->user(), $this->_isRest(), $this->request->data, 'Event');
+                    if ($canSGBeUsed !== true) {
+                        throw new MethodNotAllowedException($canSGBeUsed);
+                    }
+                }
+            } else if (isset($this->request->data['Event']['distribution'])) {
+                // A non-sharing-group distribution must not carry a sharing group id.
+                $this->request->data['Event']['sharing_group_id'] = 0;
+            }
+
             // always force the org, but do not force it for admins
             if (!$this->_isSiteAdmin()) {
                 // set the same org as existed before

Source: MISP GitHub commit 609ff6c — patch adds checkIfCanBeUsed() validation and clears sharing_group_id when distribution is not set to sharing group distribution.

Detection Methods for CVE-2026-54397

Indicators of Compromise

Event audit log entries showing sharing_group_id changes to groups outside the editing user's membership.
Events with distribution=4 where the assigning user is not a member of the referenced sharing group.
Unexpected appearances of restricted sharing group names in event index responses returned to lower-privileged users.

Detection Strategies

Review MISP audit logs for edit actions on Event objects that include modifications to sharing_group_id.
Cross-reference each sharing_group_id assignment against the acting user's sharing group memberships in the sharing_group_orgs table.
Inspect web server access logs for POST requests to /events/edit/* containing both Event[distribution]=4 and a sharing_group_id parameter.

Monitoring Recommendations

Enable MISP's audit logging at the verbose level and forward logs to a central SIEM for correlation.
Alert on any non-administrative user assigning events to sharing groups they do not own or belong to.
Periodically reconcile event distribution metadata against authorized sharing group membership to detect historical tampering.

How to Mitigate CVE-2026-54397

Immediate Actions Required

Upgrade MISP to a release containing commit 609ff6c785d7dae41d22ef43dda9347d34cd2a58 or later.
Audit existing events for sharing_group_id values assigned by users who are not members of the referenced sharing group.
Review and tighten the user role assignments granting event edit privileges to only trusted personnel.

Patch Information

The fix is delivered in MISP commit 609ff6c785d7dae41d22ef43dda9347d34cd2a58. It adds a call to SharingGroup::checkIfCanBeUsed() whenever distribution equals 4 and the submitted sharing_group_id differs from the stored value. When distribution is not sharing group distribution, the patch forces sharing_group_id to 0 to prevent stale assignments.

Workarounds

Restrict event edit permissions to users who already have legitimate access to all relevant sharing groups.
Apply the patch hunk from the upstream commit as a local fix if a full upgrade is not yet possible.
Monitor and alert on changes to sharing_group_id until the upstream patch is deployed.

bash

# Apply the upstream security patch on a self-hosted MISP instance
cd /var/www/MISP
sudo -u www-data git fetch origin
sudo -u www-data git cherry-pick 609ff6c785d7dae41d22ef43dda9347d34cd2a58
sudo -u www-data /var/www/MISP/app/Console/cake Admin updateDatabase
sudo systemctl restart apache2