CVE-2026-54397

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description An issue in the non-REST event editing path allows an authenticated user with event edit permissions to manipulate submitted form data. By tampering with the event edit request, a user can set the sharing group id variable to a sharing group they are not authorized to use. This occurs because the non-REST save path fails to perform the sharing group authorization check that is enforced by the REST edit path when distribution is set to sharing group distribution. This could lead to the unauthorized use of restricted sharing groups, disclosure of sharing group names in event listings, and unintended modification of event distribution metadata.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.