CVE-2026-112178
7.1HighPublished 19 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-862
Impact
Authenticated users can view unauthorized shadow attribute proposals across sharing groups regardless of distribution level restrictions. Attackers only need network access and valid credentials to an account in any sharing group.
Root cause
The authorization logic verified user sharing group membership for proposal visibility but failed to check the attribute's actual distribution level.
Affected systems
MISP prior to version 2.5.48
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade MISP to version 2.5.48 or later. No interim configuration mitigation is documented.
$ git -C /var/www/MISP fetch && git -C /var/www/MISP checkout v2.5.48 && git -C /var/www/MISP submodule update --init --recursiveAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes. - A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute's distribution level (levels 1-3 should restrict visibility) - The owning organisation could not view proposals on its own org-only attributes Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions. Affected: <2.5.48