Description
An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required perm_modify or perm_modify_org permissions.

The affected attribute deletion paths relied on organization membership checks performed by MispAttribute::deleteAttribute() but did not consistently enforce MISP's event modification authorization rules. Consequently, a user belonging to the organization associated with an event could potentially delete individual attributes or perform bulk attribute deletion even when their assigned role was not authorized to modify the event.

This created an inconsistency between attribute editing and deletion: editing an attribute correctly used MISP's ACL::canModifyEvent() authorization logic, whereas the affected deletion operations could bypass these permission checks.

An authenticated attacker with access to an affected MISP instance and membership in the organization owning an event could exploit this flaw to remove attributes from that event, potentially causing unauthorized modification or loss of threat intelligence data.

The patch introduces a common authorization check for all affected deletion paths. Before deletion, MISP now resolves the associated events and verifies that the current user is authorized to modify each event using the same authorization mechanism used by normal event and attribute modification operations.
Published: 2026-09-04
Score: 8.3 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

MISP suffered an incorrect authorization flaw that permitted authenticated users to delete attributes from events even when they lacked the required perm_modify or perm_modify_org permissions. The deletion functionality, which relied on organization membership checks in MispAttribute::deleteAttribute(), did not enforce the standard event modification rules. Consequently, a user who belongs to the organization owning an event could remove individual or bulk attributes, disrupting or erasing threat intelligence data without proper authorization.

Affected Systems

The vulnerability affects the open source MISP platform. No specific version ranges are supplied, so any install that has not applied the relevant patch is potentially vulnerable.

Risk and Exploitability

The CVSS score is 8.3, indicating high severity. Abuse requires an authenticated session and membership in the event’s organization, but the exploit does not necessitate elevated privileges beyond that. EPSS data is unavailable, and the flaw is not listed in CISA’s KEV catalog. Attackers could leverage the bypass to alter or delete intelligence, leading to data integrity loss and compromised situational awareness.

Generated by OpenCVE AI on September 4, 2026 at 10:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest MISP release that contains the authorization check patch to all affected instances.
  • Revoke or adjust membership for users who do not possess modify permissions and verify that ACL enforcement is operational for all attribute deletion paths.
  • Enable or review audit logging for attribute deletion events to detect any unauthorized removal attempts, and investigate suspicious activities promptly.

Generated by OpenCVE AI on September 4, 2026 at 10:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Misp
Misp misp
Vendors & Products Misp
Misp misp

Fri, 04 Sep 2026 09:15:00 +0000

Type Values Removed Values Added
Description An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required perm_modify or perm_modify_org permissions. The affected attribute deletion paths relied on organization membership checks performed by MispAttribute::deleteAttribute() but did not consistently enforce MISP's event modification authorization rules. Consequently, a user belonging to the organization associated with an event could potentially delete individual attributes or perform bulk attribute deletion even when their assigned role was not authorized to modify the event. This created an inconsistency between attribute editing and deletion: editing an attribute correctly used MISP's ACL::canModifyEvent() authorization logic, whereas the affected deletion operations could bypass these permission checks. An authenticated attacker with access to an affected MISP instance and membership in the organization owning an event could exploit this flaw to remove attributes from that event, potentially causing unauthorized modification or loss of threat intelligence data. The patch introduces a common authorization check for all affected deletion paths. Before deletion, MISP now resolves the associated events and verifies that the current user is authorized to modify each event using the same authorization mechanism used by normal event and attribute modification operations.
Title MISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete Attributes
Weaknesses CWE-863
References
Metrics cvssV4_0

{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:N'}

Subscriptions

Misp Misp
cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-09-04T09:05:41.350Z

Reserved: 2026-09-04T09:05:38.255Z

Link: CVE-2026-85538

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T09:17:11.997

Modified: 2026-09-04T09:17:11.997

Link: CVE-2026-85538

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T10:30:17Z

Weaknesses