CVE-2026-54360
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A mass assignment vulnerability exists in MISP’s sharing group creation endpoint. The controller did not remove a user-supplied id field before saving the submitted data, which may lead to unauthorized modification of existing sharing groups.
Risk Assessment
An authenticated user with permission to add sharing groups could modify sharing groups they do not otherwise have access to, potentially affecting the confidentiality and integrity of information shared through those groups.
Recommendation
It is recommended to remove the id field from the data before saving and to review user permissions for creating sharing groups.
Original NVD description (English source)
A mass assignment vulnerability exists in MISP’s sharing group creation endpoint. When creating a new sharing group, the controller did not remove a user-supplied id field before saving the submitted data. In CakePHP, supplying a primary key in the save data can cause a create() followed by save() operation to update an existing record instead of creating a new one. An authenticated user with permission to add sharing groups could therefore submit the identifier of an existing sharing group and modify that sharing group without passing the normal edit access-control checks. This may allow the attacker to take over or alter sharing groups they do not otherwise have access to, potentially affecting the confidentiality and integrity of information shared through those groups. Affected component: app/Controller/SharingGroupsController.php, add() action