Description
MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group (SG) editor role can trigger this code path, allowing them to modify organization metadata that should be restricted to site administrators or users with sync permissions.

According to the commit message, this could lead to blueprint-based sharing group manipulation, meaning an attacker with SG editor access could alter organizational attributes in ways that influence how sharing groups and blueprints behave across the MISP instance. 

The vulnerability requires an authenticated user with at least SG editor privileges and network access to the MISP web interface. The impact is primarily on the integrity of organization records and, potentially, on the integrity of sharing group configurations derived from those records.
Published: 2026-09-22
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Integrity compromise of organization metadata and sharing group configurations
Action: Patch Now
AI Analysis

Impact

MISP's Organisation model contains an authorization flaw. When the $force parameter is set to true, the captureOrg method overwrites organization metadata fields without checking user privileges. A user with sharing group editor rights can trigger this, allowing them to alter organization attributes that should be protected. The resulting integrity breach can change how sharing groups and blueprints behave across the MISP instance.

Affected Systems

This flaw affects the MISP platform, specifically the Organisation model used to store organization metadata. No version information is provided, so any installation of MISP where the captureOrg method is invoked with $force=true is potentially vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate impact. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Attack requires an authenticated user with at least sharing group editor permissions and network access to the MISP web interface, implying an internal or compromised account. The vulnerability primarily threatens data integrity, but could influence sharing group configurations, making it a concern for security and operational stability.

Generated by OpenCVE AI on September 22, 2026 at 15:35 UTC.

Remediation

Vendor Solution

The fix adds an authorization check to the captureOrg method so that the forced overwrite of organization metadata fields is only permitted when the invoking user holds either the site_admin permission or the sync permission. This ensures that low-privilege roles such as sharing group editors can no longer trigger the metadata overwrite path, closing the authorization gap.

OpenCVE Recommended Actions

  • Apply the vendor patch that adds the authorization check to captureOrg.
  • If the patch cannot be applied immediately, modify the code or configuration to prevent SG editors from setting the force parameter, effectively blocking the overwrite path.
  • Regularly audit role assignments to ensure only trusted users have sharing group editor rights and that the SG editor role does not have unnecessary permissions beyond its intended scope.

Generated by OpenCVE AI on September 22, 2026 at 15:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Misp
Misp misp
Vendors & Products Misp
Misp misp

Tue, 22 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Description MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group (SG) editor role can trigger this code path, allowing them to modify organization metadata that should be restricted to site administrators or users with sync permissions. According to the commit message, this could lead to blueprint-based sharing group manipulation, meaning an attacker with SG editor access could alter organizational attributes in ways that influence how sharing groups and blueprints behave across the MISP instance.  The vulnerability requires an authenticated user with at least SG editor privileges and network access to the MISP web interface. The impact is primarily on the integrity of organization records and, potentially, on the integrity of sharing group configurations derived from those records.
Title MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata
Weaknesses CWE-862
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N'}

Subscriptions

Misp Misp
cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-09-22T15:06:43.859Z

Reserved: 2026-09-22T14:31:23.351Z

Link: CVE-2026-95697

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-09-22T15:17:27.670

Modified: 2026-09-22T16:18:23.393

Link: CVE-2026-95697

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T15:45:17Z

Weaknesses