CVE-2026-112178High· 7.1▾ TwilightMISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and de…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.
A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute's distribution level (levels 1-3 should restrict visibility)
The owning organisation could not view proposals on its own org-only attributes
Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.
Affected: <2.5.48
MISP < 2.5.48The fix enforces the distribution level constraint in the sharing group access check, requiring distribution level 4 (All communities) for the sharing group test to apply. Additionally, the owning organisation is now explicitly granted access to proposals on its own attributes regardless of distribution level, correcting the over-restrictive behavior.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112192Medium· 5.3MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings
CVE-2026-104914Medium· 5.3MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted attributes (e.g., via the deleted-attributes search or the paginated attribute l…
CVE-2026-104912High· 7.1MISP contains an authorization flaw in its correlation handling during attribute searches
CVE-2026-104910Medium· 5.3MISP contains an authorization bypass in the related events listing functionality
CVE-2026-103659High· 7.1MISP contains an authorization bypass in the event flattening feature
CVE-2026-103239High· 8.6MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality