PT-2026-117270

CVE-2026-112178

Published

2026-10-19

Updated

2026-10-19

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.48

Description An access control flaw exists in the proposal visibility logic for shadow attributes. The authorization check fails to verify the distribution level, allowing any user belonging to a sharing group to view proposals on attributes or objects associated with that group, even when distribution levels 1-3 should restrict such visibility. Additionally, the owning organization is denied access to proposals on its own organization-only attributes. This leads to the unauthorized disclosure of proposed attribute changes.

Recommendations Update MISP to version 2.5.48 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Elhoim

Iglocska

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization