Authorization Flaw in MISP Affects User Data Access

CVE-2026-95671

What is CVE-2026-95671?

A vulnerability in MISP allows an authenticated user to bypass sharing-group usability authorization checks when using PUT requests. The CollectionsController add() method only enforces checks for POST requests, enabling unauthorized users to associate collections with sharing groups they do not have access to. This flaw can lead to sensitive data exposure by allowing unauthorized access to collection data, compromising the intended access-control boundaries of the system. To exploit this vulnerability, an attacker requires an authenticated session and knowledge of a valid sharing group identifier but does not need any special tools aside from issuing a specific request.

References