CVE-2026-91825: MISP Auth Bypass Vulnerability

CVE-2026-91825 Overview

CVE-2026-91825 is a missing authorization vulnerability [CWE-862] in the Malware Information Sharing Platform (MISP). Affected versions fail to authorize a submitted sharing_group_id in a specific event-edit code path. The vulnerable logic only enforced sharing-group authorization when the request explicitly supplied distribution = 4. An authenticated attacker who omits the distribution field while supplying a different sharing_group_id bypasses the check entirely. MISP's field-recovery logic then restores the stored distribution, allowing the unauthorized sharing-group ID to persist on events already configured with sharing-group distribution.

Critical Impact
Authenticated users can assign events to sharing groups they are not authorized to use, corrupting integrity of threat intelligence distribution boundaries in MISP.

Affected Products

MISP (Malware Information Sharing Platform) versions ≤ 2.5.45
app/Controller/EventsController.php event-edit path
app/Model/Event.php_edit() save logic

Discovery Timeline

2026-09-15 - CVE-2026-91825 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91825

Vulnerability Analysis

The flaw resides in the event-edit workflow of the MISP controller and model layer. Authorization for the sharing_group_id field was gated exclusively on the presence of a submitted distribution value of 4. When a client submitted an event edit that omitted distribution entirely but included a sharing_group_id, the authorization branch was never reached. The subsequent field-recovery loop restored the stored distribution from the persisted event record. If the event was already configured with distribution 4, the restored value combined with the unauthorized sharing_group_id allowed the change to be saved.

The impact primarily affects data integrity: an authenticated user with low privileges can redirect events into sharing groups they should not access, breaking intended distribution semantics across MISP peers.

Root Cause

The root cause is a missing authorization check [CWE-862] keyed on a field the caller controls and can trivially omit. The controller relied on distribution being present to trigger SharingGroup::checkIfCanBeUsed(), and the model's _edit() similarly failed to validate a bare sharing_group_id submission. Because recoverFields restores omitted values from storage, the omission did not neutralize the change — it simply skipped the gate.

Attack Vector

An authenticated attacker with permission to edit an existing event (already configured with distribution 4) submits an edit request that omits the distribution field and supplies an arbitrary sharing_group_id. The controller skips authorization, the model saves the record, and recoverFields reinstates distribution 4, persisting the unauthorized sharing-group assignment.

php

// Patch: app/Controller/EventsController.php
} else if (isset($this->request->data['Event']['distribution'])) {
    // A non-sharing-group distribution must not carry a sharing group id.
    $this->request->data['Event']['sharing_group_id'] = 0;
} else if (
    !empty($this->request->data['Event']['sharing_group_id']) &&
    $this->request->data['Event']['sharing_group_id'] != $event['Event']['sharing_group_id']
) {
    // No distribution submitted at all, so the event keeps its stored one - and
    // an event already at distribution 4 will persist this id. Gating solely on
    // the submitted distribution let a form omit that field and skip the check.
    $canSGBeUsed = $this->Event->SharingGroup->checkIfCanBeUsed($this->Auth->user(), $this->_isRest(), $this->request->data, 'Event');
    if ($canSGBeUsed !== true) {
        throw new MethodNotAllowedException($canSGBeUsed);
    }
}

Source: MISP Commit cf3ee4026

Detection Methods for CVE-2026-91825

Indicators of Compromise

Event edit requests to /events/edit/* that include Event[sharing_group_id] but omit Event[distribution]
Audit-log entries showing sharing_group_id changes on events at distribution 4 by users lacking sharing-group membership
Unexpected propagation of events to MISP peers via sharing groups the acting user does not belong to

Detection Strategies

Review MISP audit logs for Event model updates where sharing_group_id changed without a corresponding distribution value in the submitted payload
Correlate the acting user's sharing-group memberships against the newly assigned sharing_group_id to identify unauthorized assignments
Inspect REST API access logs for PUT/POST requests to event endpoints that carry a bare sharing_group_id field

Monitoring Recommendations

Enable verbose audit logging in MISP and forward events to a centralized log platform for retrospective analysis
Alert on any sharing_group_id modification performed by non-admin, non-creator users
Baseline normal event-edit payloads and flag requests that mutate distribution-related fields outside expected client behavior

How to Mitigate CVE-2026-91825

Immediate Actions Required

Upgrade MISP to a version containing commit cf3ee4026 (versions above 2.5.45)
Audit recent event modifications for unauthorized sharing_group_id assignments and revert as required
Restrict event-edit permissions to trusted users pending patch deployment

Patch Information

The fix adds authorization checks in both the controller and Event::_edit() whenever a non-empty sharing_group_id is supplied without distribution. The model now calls SharingGroup::checkIfAuthorised() before persisting the change. Full patch details are available in the MISP GitHub commit cf3ee4026.

Workarounds

Limit event-edit privileges to a minimal set of trusted users until the patch is applied
Front the MISP instance with a reverse-proxy rule that rejects event-edit payloads containing sharing_group_id without distribution
Increase audit-log retention and review frequency for event-modification activity

php

// Patch: app/Model/Event.php
} elseif (!isset($data['Event']['distribution']) && !empty($data['Event']['sharing_group_id'])) {
    // A sharing group submitted with no distribution at all still reaches
    // the save: the recoverFields loop below restores distribution from the
    // stored event, so an event already at distribution 4 keeps that value
    // and this id is persisted. Authorise it rather than leaving the gate
    // keyed on a field the caller can simply omit.
    if (!$this->SharingGroup->checkIfAuthorised($user, $data['Event']['sharing_group_id'])) {
        return array('error' => 'Event could not be saved: Invalid sharing group or you don\'t have access to that sharing group.');
    }
}