PT-2026-56818

CVE-2026-61474

Published

2026-07-09

Updated

2026-07-09

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description An improper authorization check in the attribute creation endpoint allows an authenticated user with permissions to add attributes to submit a sharing group id without triggering the required authorization check, provided the attribute distribution value is not set to 4 (sharing group). This access-control bypass enables users to associate attributes with sharing groups they are not authorized to use, potentially compromising the integrity of sharing metadata and exposing restricted sharing group relationships.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Andras Iklody

Jeroen Pinoy

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization

Related identifiers