CVE-2026-54398: MISP Authorization Bypass Vulnerability

CVE-2026-54398 Overview

CVE-2026-54398 is an authorization flaw in the Malware Information Sharing Platform (MISP) object add/edit handling. The vulnerability allows an authenticated user with object editing permissions to assign a MISP object, or attributes contained within an object, to a sharing group the user is not authorized to use or view. The sharing group validation runs against the wrong request data structure after object fields have been merged to the top level, so the authorization check is bypassed. Attributes embedded in objects are also not individually validated for authorized sharing group use. This issue is tracked under [CWE-863: Incorrect Authorization].

Critical Impact
An attacker with object editing rights can craft a request with distribution set to 4 and an arbitrary sharing_group_id, disclosing the existence or name of non-visible sharing groups and improperly modifying distribution metadata of objects or attributes.

Affected Products

MISP (Malware Information Sharing Platform) prior to the commit referenced in the upstream patch
MISP ObjectsController object add/edit code paths
MISP deployments accepting authenticated object edits from non-administrative users

Discovery Timeline

2026-06-12 - CVE-2026-54398 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-54398

Vulnerability Analysis

The flaw resides in MISP's object add and edit logic inside app/Controller/ObjectsController.php. When an authenticated user submits an object payload, the controller merges object fields to the top level of the request data before performing sharing group authorization checks. The validation routine inspects the pre-merge structure, so the check effectively operates on absent or empty data and returns success regardless of the supplied sharing_group_id.

A second defect compounds the issue. Attributes embedded inside an object are not individually validated against the user's authorized sharing groups. An attacker can therefore submit an object with distribution set to 4 (sharing group) and any chosen sharing_group_id, including identifiers of sharing groups the user is neither a member of nor permitted to view.

The consequences are twofold. First, the server's response or downstream behavior can confirm the existence and name of otherwise hidden sharing groups, producing an information disclosure primitive. Second, the distribution metadata of objects and their attributes can be altered in ways that misrepresent which communities are entitled to view the data.

Root Cause

The root cause is incorrect authorization sequencing. Sharing group validation is performed against the wrong request data structure, and embedded attributes lack per-element authorization checks. Both gaps map to [CWE-863].

Attack Vector

Exploitation requires an authenticated MISP account with permission to add or edit objects. The attacker sends a crafted HTTP request to the object add/edit endpoint with distribution=4 and an arbitrary sharing_group_id, optionally including attribute entries with their own unauthorized sharing group references. No user interaction is required, and the attack is performed over the network.

php

                            throw new MethodNotAllowedException($canSGBeUsed);
                        }
                    }
+                    if (!empty($object['Attribute'])) {
+                        $this->__validateAttributeSharingGroups($object['Attribute']);
+                    }
                    $result = $this->MispObject->saveObject($object, $eventId, $template, $this->Auth->user(), 'halt', $breakOnDuplicate);
                    if (is_numeric($result)) {
                        $this->MispObject->Event->unpublishEvent($event);

Source: MISP/MISP commit 4fe48c5. The patch adds a __validateAttributeSharingGroups call so attributes embedded inside an object are individually validated against the authenticated user's authorized sharing groups before saveObject persists the data.

Detection Methods for CVE-2026-54398

Indicators of Compromise

Object or attribute records whose distribution value is 4 and whose sharing_group_id references a sharing group the editing user is not a member of.
Audit log entries showing object add or edit operations performed by users who lack visibility into the referenced sharing group.
Sharing groups appearing in object metadata that were previously restricted to a different community.

Detection Strategies

Compare each object's sharing_group_id against the editing user's authorized sharing group memberships in the MISP database and flag mismatches.
Review MISP audit logs for objects/add and objects/edit requests containing Object.distribution=4 or Attribute.distribution=4 with unexpected sharing group identifiers.
Inspect application logs for repeated probing of incrementing sharing_group_id values from a single account, which suggests enumeration of hidden sharing groups.

Monitoring Recommendations

Enable verbose audit logging for the Objects controller and forward events to a SIEM for correlation against user-to-sharing-group membership data.
Alert on accounts that suddenly create or edit objects referencing sharing groups outside their historical activity baseline.
Track API request volume to objects/add and objects/edit endpoints and flag anomalous spikes from low-privileged users.

How to Mitigate CVE-2026-54398

Immediate Actions Required

Update MISP to a release that includes commit 4fe48c523e66999d65f99fdec9508adb3aa1c0f3 or later.
Audit existing objects and attributes for unauthorized sharing_group_id assignments and restore correct distribution metadata where required.
Review object editing privileges and remove the role from users who do not need it.

Patch Information

The upstream fix is delivered in the MISP repository via commit 4fe48c5. The patch routes embedded attributes through __validateAttributeSharingGroups and corrects the sharing group validation to operate on the merged object data before saveObject is invoked. Apply the patched MISP version across all instances, including synchronization peers.

Workarounds

Restrict the object add/edit permission to trusted users until the patch is applied.
Limit use of distribution=4 (sharing group distribution) on the instance and prefer organization-level or community-level distribution where feasible.
Periodically reconcile object and attribute sharing group assignments against user membership tables to detect tampering.

bash

# Update a self-hosted MISP deployment to include the security commit
cd /var/www/MISP
sudo -u www-data git fetch --all
sudo -u www-data git checkout 2.4
sudo -u www-data git pull
sudo -u www-data git log --oneline | grep 4fe48c5
sudo systemctl restart apache2