CVE-2026-85538
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required perm_modify or perm_modify_org permissions. The affected attribute deletion paths relied on organization membership checks performed by MispAttribute::deleteAttribute() but did not consistently enforce MISP's event modification authorization rules. Consequently, a user belonging to the organization associated with an event could potentially delete individual attributes or perform bulk attribute deletion even when their assigned role was not authorized to modify the event.
Risk Assessment
An authenticated attacker with membership in the organization owning an event can delete attributes, potentially leading to unauthorized modification or loss of threat intelligence data.
Recommendation
Upgrade MISP to a version containing the patch that introduces a common authorization check for all affected deletion paths.
Other vulnerabilities in MISP
See all- CVE-2026-95806High
MISP registers PHP's phar stream wrapper in both its web and console entry points. This causes filesystem operations on caller-influenced paths to trigger implicit unserialize() (a deserialization sink), and a relocated application root can reach executable code inside an uploaded phar file, enabling code execution as the web user.
- CVE-2026-95805Medium
A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'theming_enabled*' (with a trailing asterisk) instead of the correct 'theming_enabled'. The malformed key does not match any valid permission identifier, causing the access control check for previewEventAttributes to malfunction — potentially resulting in either an authorization bypass or denial of access for legitimate users.
- CVE-2026-95754Medium
In MISP's UsersController login(), the pre-auth query for TOTP verification did not include the User.disabled column, so the disabled flag was not checked in that branch. Although later identify() validation still rejects disabled accounts, a TOTP-enabled user can proceed to the verification step.
- CVE-2026-95703Medium
In MISP, the __uploadLogo method in OrganisationsController processes a caller-supplied tmp_name with filesystem probes before verifying it is a real upload. An authenticated site-admin can supply an arbitrary server file path, allowing to check for file existence and determine image types.
- CVE-2026-95701Medium
In MISP, the __statisticsOrgs method uses the organization name directly as a file path component when checking for logo existence. Although the target directory does not exist, the pattern is a path traversal weakness that could allow probing arbitrary files if the directory existed.
- CVE-2026-95698Medium
The findOrgImage method in MISP constructs a file path from an organization identifier without validation, allowing path traversal. An authenticated user with ability to create or import events can set an organization name with traversal sequences, enabling arbitrary file existence probing and limited file read for .png or .svg extensions.
- CVE-2026-95697Medium
MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group (SG) editor role can trigger this code path, allowing them to modify organization metadata that should be restricted to site administrators or users with sync permissions.
- CVE-2026-95693Medium
In MISP, the EventReport::uploadPicture method processes a caller-supplied tmp_name field by invoking file_exists(), mime_content_type(), and exif_imagetype() on the supplied path before verifying that the value was a genuine PHP upload via is_uploaded_file(). An authenticated user holding the perm_add permission could supply an arbitrary filesystem path as the tmp_name value. The application would then probe that path and return distinct validation error messages depending on whether the file existed, its MIME type, or its image format, allowing enumeration of file existence and type.
- CVE-2026-95685Medium
MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of suggestion content within an event report, was incorrectly mapped to the wildcard permission ('*') in the ACLComponent, making it accessible to any authenticated user regardless of their assigned permissions. All analogous report-modification actions correctly required the perm_add permission, while read-only actions such as downloadAsPDF appropriately used the wildcard.
- CVE-2026-95683Medium
In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event's distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed.
Original NVD description (English source)
An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required perm_modify or perm_modify_org permissions. The affected attribute deletion paths relied on organization membership checks performed by MispAttribute::deleteAttribute() but did not consistently enforce MISP's event modification authorization rules. Consequently, a user belonging to the organization associated with an event could potentially delete individual attributes or perform bulk attribute deletion even when their assigned role was not authorized to modify the event. This created an inconsistency between attribute editing and deletion: editing an attribute correctly used MISP's ACL::canModifyEvent() authorization logic, whereas the affected deletion operations could bypass these permission checks. An authenticated attacker with access to an affected MISP instance and membership in the organization owning an event could exploit this flaw to remove attributes from that event, potentially causing unauthorized modification or loss of threat intelligence data. The patch introduces a common authorization check for all affected deletion paths. Before deletion, MISP now resolves the associated events and verifies that the current user is authorized to modify each event using the same authorization mechanism used by normal event and attribute modification operations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS