CVE-2026-54398

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description An authorization flaw exists in the object add/edit handling. An authenticated user with object editing permissions can assign a MISP object, or attributes within an object, to a sharing group they are not authorized to use or view. This occurs because sharing group validation is performed against an incorrect request data structure after object fields are merged to the top level, bypassing the check. Additionally, attributes embedded in objects are not individually validated for authorized sharing group use. An attacker can craft a request with distribution set to 4 and an arbitrary sharing group id, which may disclose the existence or name of non-visible sharing groups and improperly modify the distribution metadata of objects or attributes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.