Authorization Flaw in MISP Affects Organization Model

CVE-2026-95697

What is CVE-2026-95697?

An authorization flaw exists in the captureOrg method of MISP's Organisation model, allowing an authenticated user with SG editor privileges to overwrite critical organization metadata without sufficient privilege checks. This could potentially enable unauthorized manipulation of organizational characteristics, affecting how sharing groups operate within the MISP system. Attackers could exploit this flaw to compromise the integrity of organization records and the configurations of sharing groups. Proper security measures and access controls are essential to mitigate the risk posed by this issue.

References