Access Control Flaw in MISP by The MISP Project

CVE-2026-112178

What is CVE-2026-112178?

MISP has identified an access control flaw that affects its proposal visibility logic. Specifically, the authorization mechanisms in place incorrectly allowed users who belong to certain sharing groups to view proposals that should have been restricted based on the attribute's distribution level. This flaw results in unauthorized access, whereby users can see proposal changes tied to attributes that they should not be privy to, compromising the confidentiality of organisation-specific data. As a result, the owning organisation itself is unable to access its own org-only attributes, leading to significant privacy concerns and potential data mishandling.

References