CVE-2026-85538

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description An incorrect authorization flaw allows authenticated users to delete attributes from events without possessing the required perm modify or perm modify org permissions. The issue occurs because the MispAttribute::deleteAttribute() function performs organization membership checks but fails to consistently enforce event modification authorization rules. This creates a discrepancy where attribute editing is correctly restricted via ACL::canModifyEvent(), but deletion operations can bypass these checks. An authenticated attacker who is a member of the organization owning an event can exploit this to remove individual or bulk attributes, leading to unauthorized modification or loss of threat intelligence data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.