CVE-2026-91825 MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit
Attackers can bypass authorization checks to assign unauthorized sharing groups to events by omitting the distribution field during edits.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-91825?
CVE-2026-91825 is a high-severity missing authorization vulnerability in MISP, published on 15 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path.
The vulnerable logic checked whether the acting user could use a sharing_group_id only when the request explicitly supplied distribution = 4. If the attacker instead omitted distribution but supplied a different sharing_group_id, that authorization branch was skipped. Later, MISP’s field-recovery logic restored the existing event distribution from storage. For events already configured with sharing-group distribution, the unauthorized sharing-group ID could therefore be saved.
The fix adds authorization checks in both the controller and Event::_edit() whenever a non-empty sharing_group_id is supplied without distribution. The model now calls SharingGroup::checkIfAuthorised() before persisting the change.
Version affected: ≤2.5.45
Weakness: CWE-862
Which versions are affected by CVE-2026-91825?
How do I fix CVE-2026-91825?
No fix has been published for CVE-2026-91825 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-91825 being exploited?
There is no known exploitation of CVE-2026-91825 in the wild and no public exploit code.
Sources
Also known as GHSA-f94m-4r58-rq9p.