CVE-2026-95671

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description An authenticated user can bypass sharing-group authorization checks by sending a PUT request instead of a POST request to the 'collections/add' endpoint. This occurs because the add() method in the CollectionsController only enforces authorization and element capture for POST requests, while the underlying CRUDComponent::add() function persists data for both POST and PUT requests. Consequently, a user can create a collection with distribution=4 (shared with a specific sharing group) for a group they are not authorized to use. This allows the placement of collection data into an unauthorized sharing group context, potentially exposing information to unauthorized members and violating access-control boundaries. The issue requires an authenticated session and a valid sharing group identifier.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.