Description
Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates.


For templates using distribution = 4, the template can specify a sharing_group_id. The instantiation path passed that value into event creation without verifying that the user instantiating the template was actually permitted to use the selected sharing group. The commit notes that Event::_add() only performed its own sharing-group authorization in another code path, leaving template instantiation able to write the identifier directly.


The same instantiation path also attached template-specified tags without checking the user's normal tagging permissions. In addition, it hardcoded local => 0, meaning tags marked local_only could be attached globally and consequently propagate through synchronization or export, contrary to their intended restriction.


The fix adds explicit SharingGroup::canUse() authorization for the acting user, applies the same tag-modification checks used by normal event tagging, and ensures local_only tags are attached locally.

Version affected: ≤2.5.45
Published: 2026-09-10
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Unauthorized Access – Sharing Group and Tagging Privileges Escalation
Action: Patch Immediately
AI Analysis

Impact

A flaw in MISP event template instantiation allows a user to bind a created event to any sharing group ID and to attach arbitrary tags, including those marked local_only, without proper authorization checks. This bypasses the intended permission model and leads to misuse of sharing groups and propagation of tags across synchronized feeds. The vulnerability is a classic privilege escalation scenario driven by missing authorization (CWE-862).

Affected Systems

The vulnerability affects all versions of MISP up to and including 2.5.45; no other product versions are documented as impacted.

Risk and Exploitability

The CVSS score of 7.1 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a normal user action within the MISP web interface, requiring an authenticated user to trigger template instantiation. Successful exploitation would permit the attacker to create events that belong to arbitrary sharing groups and carry tags they would normally be prohibited from attaching, potentially expanding their visibility and causing broader data leakage or unintended tag synchronization.

Generated by OpenCVE AI on September 10, 2026 at 16:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade MISP to version 2.5.46 or later where the sharing group and tag checks have been corrected.
  • Limit the ability to instantiate event templates to administrators or a specifically defined privileged role.
  • Replace the current template instantiation endpoint with a custom flow that performs explicit sharing group and tag permission checks before event creation.

Generated by OpenCVE AI on September 10, 2026 at 16:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 10 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 10 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates. For templates using distribution = 4, the template can specify a sharing_group_id. The instantiation path passed that value into event creation without verifying that the user instantiating the template was actually permitted to use the selected sharing group. The commit notes that Event::_add() only performed its own sharing-group authorization in another code path, leaving template instantiation able to write the identifier directly. The same instantiation path also attached template-specified tags without checking the user's normal tagging permissions. In addition, it hardcoded local => 0, meaning tags marked local_only could be attached globally and consequently propagate through synchronization or export, contrary to their intended restriction. The fix adds explicit SharingGroup::canUse() authorization for the acting user, applies the same tag-modification checks used by normal event tagging, and ensures local_only tags are attached locally. Version affected: ≤2.5.45
Title MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization
Weaknesses CWE-862
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-09-10T17:33:00.129Z

Reserved: 2026-09-10T13:04:01.032Z

Link: CVE-2026-88915

cve-icon Vulnrichment

Updated: 2026-09-10T17:32:56.367Z

cve-icon NVD

Status : Deferred

Published: 2026-09-10T14:17:19.193

Modified: 2026-09-10T18:18:15.663

Link: CVE-2026-88915

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-10T16:45:17Z

Weaknesses