CVE-2026-95671: MISP Auth Bypass Vulnerability

CVE-2026-95671 Overview

CVE-2026-95671 is an authorization bypass vulnerability in MISP (Malware Information Sharing Platform). The CollectionsController::add() method enforces sharing-group authorization checks only when the HTTP request method is POST. The underlying CRUDComponent::add() method persists data on both POST and PUT requests. An authenticated user can submit a PUT request to the collections/add endpoint to bypass the sharing-group check entirely. This allows the creation of a collection with distribution=4 targeting a sharing group the user is not authorized to access. The flaw is classified under [CWE-285] Improper Authorization.

Critical Impact

An authenticated attacker can place collection data into an unauthorized sharing group, exposing that data to all members of that group and violating MISP access-control boundaries.

Affected Products

• MISP (Malware Information Sharing Platform) — versions prior to commit c20f5a836
• Deployments exposing the collections/add endpoint to authenticated users
• MISP instances relying on sharing-group segmentation for data compartmentalization

Discovery Timeline

• 2026-09-22 - CVE-2026-95671 published to NVD
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95671

Vulnerability Analysis

The vulnerability resides in the add() action of app/Controller/CollectionsController.php. The controller wraps the sharing-group usability check and element capture inside a conditional that fires only when $this->request->is('post') returns true. The CRUDComponent::add() helper, however, treats POST and PUT as equivalent write verbs and persists the submitted collection either way. When a request arrives with method PUT, the controller skips the authorization block and hands an empty $params array to the save routine. The record is written with attacker-supplied sharing_group_id and distribution=4 values that were never validated against the caller's group membership.

Root Cause

The root cause is a mismatch between the HTTP verbs handled by the controller's authorization guard and those handled by the persistence layer. The guard checks only POST, while the persistence layer accepts both POST and PUT. This gap in verb coverage produces an authorization-check-omission condition [CWE-285].

Attack Vector

Exploitation requires an authenticated MISP session and a valid target sharing_group_id. The attacker sends a PUT request to /collections/add with a JSON or form body specifying distribution=4 and the target sharing group identifier. No special tooling, chained vulnerabilities, or user interaction are required.

         $attachElementUuid = !empty($attachElementUuids) ? $attachElementUuids[0] : null;
         $params = [];
         $this->loadModel('Event');
-        if ($this->request->is('post')) {
+        // Accept PUT as well as POST: CRUDComponent::add() persists on either verb, so the
+        // sharing-group authorisation check and element capture below must run for both -
+        // otherwise a PUT reaches the save with an empty $params and skips the SG guard.
+        if ($this->request->is('post') || $this->request->is('put')) {
             $data = $this->request->data;
             $params = [
                 'beforeSave' => function (array $collection) use ($currentUser) {
// Source: https://github.com/MISP/MISP/commit/c20f5a836 (upstream patch)

The patch expands the verb check to include PUT, ensuring the sharing-group authorization guard executes for both write methods. See the MISP upstream commit for full context.

Detection Methods for CVE-2026-95671

Indicators of Compromise

• HTTP PUT requests to the /collections/add endpoint in MISP web server access logs
• Newly created collections with distribution=4 whose sharing_group_id does not match the creating user's group memberships
• Audit log entries showing collection creation without a preceding sharing-group authorization event

Detection Strategies

• Parse MISP access logs for the request pattern PUT /collections/add and correlate the source user to sharing-group membership tables.
• Query the MISP database for collections created after the vulnerable version was deployed and validate sharing_group_id against the creator's authorized groups.
• Alert on any non-POST write verbs targeting endpoints historically expected to receive only POST.

Monitoring Recommendations

• Enable verbose HTTP method logging on the reverse proxy or web server fronting MISP.
• Forward MISP application and access logs to a centralized analytics platform for retrospective analysis.
• Baseline normal collection-creation activity per user and flag deviations in sharing-group targeting.

How to Mitigate CVE-2026-95671

Immediate Actions Required

• Apply the upstream MISP patch corresponding to commit c20f5a836 on all production instances.
• Audit existing collections for unauthorized sharing_group_id assignments and remove or reassign as needed.
• Rotate or review API keys for accounts that could have submitted PUT requests to /collections/add.

Patch Information

The fix is published in the MISP repository at commit c20f5a836. The patch extends the verb check in CollectionsController::add() to include PUT, so the sharing-group authorization guard runs for both write methods. Upgrade to the MISP release that includes this commit.

Workarounds

• Block PUT requests to /collections/add at the reverse proxy or web application firewall until the patch is applied.
• Restrict access to the MISP web interface and API to trusted networks using IP allowlisting.
• Reduce user privileges so that fewer accounts hold sharing-group creation rights on the instance.

# Example nginx rule blocking PUT to the vulnerable endpoint
location = /collections/add {
    limit_except POST GET {
        deny all;
    }
    proxy_pass http://misp_backend;
}