CVE-2026-103858 (GCVE-0-2026-103858)
Vulnerability from cvelistv5
Published
2026-10-01 11:31
Modified
2026-10-01 15:00
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-285 - Improper Authorization
Summary
MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization (org-only distribution). It did not enforce the full thread access control list, including sharing-group membership and event-level visibility.
As a result, an authenticated user who is outside the relevant sharing group or who does not have visibility on the associated event could:
- Read the thread title and the content of the quoted post
- Submit a new post into the discussion thread
This constitutes both an information disclosure (reading restricted thread and post content) and an integrity issue (injecting content into a thread the user is not authorized to participate in).
Affected: <2.5.48
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-103858",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T15:00:37.761849Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T15:00:57.587Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"PostsController (discussion/thread posting)"
],
"product": "MISP",
"programFiles": [
"app/Controller/PostsController.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "unspecified",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Bastien Bossiroy and C\u00e9lien Desteucq of NCIA"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization (org-only distribution). It did not enforce the full thread access control list, including sharing-group membership and event-level visibility.\u003c/p\u003e\u003cp\u003eAs a result, an authenticated user who is outside the relevant sharing group or who does not have visibility on the associated event could:\u003c/p\u003e\u003cp\u003e- Read the thread title and the content of the quoted post\u003c/p\u003e\u003cp\u003e- Submit a new post into the discussion thread\u003c/p\u003e\u003cp\u003eThis constitutes both an information disclosure (reading restricted thread and post content) and an integrity issue (injecting content into a thread the user is not authorized to participate in).\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48\u003c/p\u003e"
}
],
"value": "MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization (org-only distribution). It did not enforce the full thread access control list, including sharing-group membership and event-level visibility.\n\nAs a result, an authenticated user who is outside the relevant sharing group or who does not have visibility on the associated event could:\n\n- Read the thread title and the content of the quoted post\n\n- Submit a new post into the discussion thread\n\nThis constitutes both an information disclosure (reading restricted thread and post content) and an integrity issue (injecting content into a thread the user is not authorized to participate in).\n\nAffected: \u003c2.5.48"
}
],
"impacts": [
{
"capecId": "CAPEC-10",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-10 Parameter Tampering"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-01T11:16:47Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T11:31:32.840Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/79fbd4c75"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix replaces the limited org-only distribution check with a call to the thread\u0027s full authorization method (checkIfAuthorised), which enforces the complete access control list including sharing groups and event-level visibility. The thread is only read after successful authorization, preventing disclosure of the title and content to unauthorized users. An additional null-check on the post\u0027s thread_id was added to prevent referencing posts without a valid thread association.\u003c/p\u003e"
}
],
"value": "The fix replaces the limited org-only distribution check with a call to the thread\u0027s full authorization method (checkIfAuthorised), which enforces the complete access control list including sharing groups and event-level visibility. The thread is only read after successful authorization, preventing disclosure of the title and content to unauthorized users. An additional null-check on the post\u0027s thread_id was added to prevent referencing posts without a valid thread association."
}
],
"title": "MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The exact affected version range is uncertain; the tag boundary v2.5.48 with 42 commits after the fix suggests the fix landed around or before v2.5.48, but the precise first-affected and first-fixed versions are not stated in the patch.",
"The checkIfAuthorised() method is assumed to enforce the full thread ACL including sharing groups and event visibility, based on the commit message description; the method\u0027s implementation is not included in the patch.",
"CAPEC-10 (Parameter Tampering) is the closest available CAPEC mapping; no CAPEC specifically covers \u0027incomplete authorization check on a direct object reference\u0027 was identified in the catalog.",
"The CVSS assumes the attacker already possesses a valid MISP account (PR:L); unauthenticated access is not indicated by the patch.",
"The AI co-author (Claude Opus 5.5) is credited as a tool rather than a person, per the Co-Authored-By line."
],
"capecRationale": [
{
"capecId": "CAPEC-10",
"rationale": "The attacker manipulates the target_id parameter (thread_id or post_id) in the posts/add request to reference a thread or post they do not have full access to. The incomplete server-side authorization check then permits the operation. CAPEC-10 is the closest available pattern for exploiting a server\u0027s failure to properly validate the authorization context of a user-supplied resource identifier. Uncertainty: no CAPEC specifically named \u0027Insecure Direct Object Reference\u0027 or \u0027Broken Access Control via Incomplete ACL\u0027 exists in the CAPEC catalog, so Parameter Tampering is the best available match."
}
],
"commit": "79fbd4c7580adc0518581351c3d8c3d5b3ac7c97",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Bastien Bossiroy and C\u00e9lien Desteucq of NCIA"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
}
],
"cvssRationale": "AV:N: web application accessible over network. AC:L: attacker only needs a valid thread_id or post_id, no race conditions or special timing. AT:N: no special attack prerequisites beyond authentication. PR:L: requires an authenticated MISP user account. UI:N: no victim interaction needed; the attacker directly issues the request. VC:L: attacker can read thread titles and quoted post content they should not see. VI:L: attacker can inject posts into unauthorized threads. VA:N: no availability impact. SC/SI/SA:N: no impact on subsequent components. The impact is bounded to the MISP instance\u0027s data and does not compromise the server or other systems.",
"fixSummary": "The fix replaces the limited org-only distribution check with a call to the thread\u0027s full authorization method (checkIfAuthorised), which enforces the complete access control list including sharing groups and event-level visibility. The thread is only read after successful authorization, preventing disclosure of the title and content to unauthorized users. An additional null-check on the post\u0027s thread_id was added to prevent referencing posts without a valid thread association.",
"generatedAt": "2026-10-01T11:16:47.016611Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 5,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 7
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "04551eba9b017a1a2ccf05a79c21466f3fd7095a42750bd2704d57b2e3730938",
"patchSummary": "In PostsController.php add() method: (1) For the \u0027thread\u0027 target case, replaced the inline distribution==0 and org_id comparison with a call to Thread-\u003echeckIfAuthorised() before reading the thread; removed the separate _isSiteAdmin() bypass. (2) For the \u0027post\u0027 target case, added a check that the post has a non-empty thread_id, replaced the same limited distribution/org check with Thread-\u003echeckIfAuthorised(), and reordered the thread read to occur after the authorization check. Net: 8 insertions, 12 deletions in one file.",
"patchTruncated": false,
"patches": [
{
"commit": "79fbd4c7580adc0518581351c3d8c3d5b3ac7c97",
"date": "Wed, 23 Sep 2026 15:27:08 +0200",
"patchSha256": "04551eba9b017a1a2ccf05a79c21466f3fd7095a42750bd2704d57b2e3730938",
"source": "https://github.com/MISP/MISP/commit/79fbd4c75.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/79fbd4c75.patch",
"subject": "fix: [security] Apply the thread ACL when posting to a"
}
],
"source": "https://github.com/MISP/MISP/commit/79fbd4c75.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-01T11:16:47Z",
"version": "2.0.3"
},
"subject": "fix: [security] Apply the thread ACL when posting to a",
"tagVersionBoundary": {
"commits_after_fix": 42,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.48",
"version": "2.5.48",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-285",
"rationale": "The authorization check was present but incomplete: it only verified org-level distribution (distribution==0) and org_id match, failing to enforce sharing-group membership and event-level ACL. This is a classic case of insufficient authorization logic rather than a completely missing check, making CWE-285 more precise than CWE-862."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (79fbd4c7580adc0518581351c3d8c3d5b3ac7c97): fix: [security] Apply the thread ACL when posting to a",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/MISP/MISP/commit/79fbd4c75.patch"
],
"timestamp": "2026-09-23T13:27:08Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20244"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-103858",
"datePublished": "2026-10-01T11:31:32.840Z",
"dateReserved": "2026-10-01T11:31:31.101Z",
"dateUpdated": "2026-10-01T15:00:57.587Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-103858\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-01T15:00:37.761849Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-01T15:00:53.579Z\"}}], \"cna\": {\"title\": \"MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions\", \"x_gcve\": [{\"vulnId\": \"GCVE-1-2026-20244\", \"extensions\": {\"bcp-05-x-01\": {\"ai_annotations\": [{\"tags\": [\"ai-computer-assisted:llm-generated\", \"ai-computer-assisted:classification\"], \"scope\": \"record\", \"models\": [{\"name\": \"qwen3.8:27b\", \"source\": \"ollama\", \"gna_source\": 1, \"identifier\": \"qwen3.8:27b\"}], \"ai_level\": \"generated\", \"gna_source\": 1, \"description\": \"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.\", \"review_status\": \"full\"}]}, \"bcp-05-x-02\": {\"x_patch2vuln\": {\"ssvc\": {\"role\": \"Supplier\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-01T11:16:47Z\"}, \"model\": \"qwen3.8:27b\", \"commit\": \"79fbd4c7580adc0518581351c3d8c3d5b3ac7c97\", \"source\": \"https://github.com/MISP/MISP/commit/79fbd4c75.patch\", \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Bastien Bossiroy and C\\u00e9lien Desteucq of NCIA\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"iglocska\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Claude Opus 5.5 (1M context)\"}], \"patches\": [{\"date\": \"Wed, 23 Sep 2026 15:27:08 +0200\", \"commit\": \"79fbd4c7580adc0518581351c3d8c3d5b3ac7c97\", \"source\": \"https://github.com/MISP/MISP/commit/79fbd4c75.patch\", \"subject\": \"fix: [security] Apply the thread ACL when posting to a\", \"sourceUrl\": \"https://github.com/MISP/MISP/commit/79fbd4c75.patch\", \"patchSha256\": \"04551eba9b017a1a2ccf05a79c21466f3fd7095a42750bd2704d57b2e3730938\"}], \"subject\": \"fix: [security] Apply the thread ACL when posting to a\", \"generator\": \"patch2vuln.py\", \"confidence\": \"medium\", \"fixSummary\": \"The fix replaces the limited org-only distribution check with a call to the thread\u0027s full authorization method (checkIfAuthorised), which enforces the complete access control list including sharing groups and event-level visibility. The thread is only read after successful authorization, preventing disclosure of the title and content to unauthorized users. An additional null-check on the post\u0027s thread_id was added to prevent referencing posts without a valid thread association.\", \"assumptions\": [\"The exact affected version range is uncertain; the tag boundary v2.5.48 with 42 commits after the fix suggests the fix landed around or before v2.5.48, but the precise first-affected and first-fixed versions are not stated in the patch.\", \"The checkIfAuthorised() method is assumed to enforce the full thread ACL including sharing groups and event visibility, based on the commit message description; the method\u0027s implementation is not included in the patch.\", \"CAPEC-10 (Parameter Tampering) is the closest available CAPEC mapping; no CAPEC specifically covers \u0027incomplete authorization check on a direct object reference\u0027 was identified in the catalog.\", \"The CVSS assumes the attacker already possesses a valid MISP account (PR:L); unauthenticated access is not indicated by the patch.\", \"The AI co-author (Claude Opus 5.5) is credited as a tool rather than a person, per the Co-Authored-By line.\"], \"generatedAt\": \"2026-10-01T11:16:47.016611Z\", \"patchSha256\": \"04551eba9b017a1a2ccf05a79c21466f3fd7095a42750bd2704d57b2e3730938\", \"patchSummary\": \"In PostsController.php add() method: (1) For the \u0027thread\u0027 target case, replaced the inline distribution==0 and org_id comparison with a call to Thread-\u003echeckIfAuthorised() before reading the thread; removed the separate _isSiteAdmin() bypass. (2) For the \u0027post\u0027 target case, added a check that the post has a non-empty thread_id, replaced the same limited distribution/org check with Thread-\u003echeckIfAuthorised(), and reordered the thread read to occur after the authorization check. Net: 8 insertions, 12 deletions in one file.\", \"cvssRationale\": \"AV:N: web application accessible over network. AC:L: attacker only needs a valid thread_id or post_id, no race conditions or special timing. AT:N: no special attack prerequisites beyond authentication. PR:L: requires an authenticated MISP user account. UI:N: no victim interaction needed; the attacker directly issues the request. VC:L: attacker can read thread titles and quoted post content they should not see. VI:L: attacker can inject posts into unauthorized threads. VA:N: no availability impact. SC/SI/SA:N: no impact on subsequent components. The impact is bounded to the MISP instance\u0027s data and does not compromise the server or other systems.\", \"capecRationale\": [{\"capecId\": \"CAPEC-10\", \"rationale\": \"The attacker manipulates the target_id parameter (thread_id or post_id) in the posts/add request to reference a thread or post they do not have full access to. The incomplete server-side authorization check then permits the operation. CAPEC-10 is the closest available pattern for exploiting a server\u0027s failure to properly validate the authorization context of a user-supplied resource identifier. Uncertainty: no CAPEC specifically named \u0027Insecure Direct Object Reference\u0027 or \u0027Broken Access Control via Incomplete ACL\u0027 exists in the CAPEC catalog, so Parameter Tampering is the best available match.\"}], \"patchTruncated\": false, \"modelComparison\": {\"rankings\": [{\"model\": \"qwen3.8:27b\", \"score\": 7, \"confidence\": \"medium\", \"agreementScore\": 11, \"assumptionCount\": 5}], \"selectedModel\": \"qwen3.8:27b\", \"selectionMethod\": \"deterministic-consensus-v1\", \"selectionNotice\": \"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.\"}, \"weaknessRationale\": [{\"cweId\": \"CWE-285\", \"rationale\": \"The authorization check was present but incomplete: it only verified org-level distribution (distribution==0) and org_id match, failing to enforce sharing-group membership and event-level ACL. This is a classic case of insufficient authorization logic rather than a completely missing check, making CWE-285 more precise than CWE-862.\"}], \"tagVersionBoundary\": {\"tag\": \"v2.5.48\", \"version\": \"2.5.48\", \"repository\": \"https://github.com/MISP/MISP\", \"version_type\": \"semver\", \"commits_after_fix\": 42}}}, \"bcp-05-x-03\": {\"x_timeline\": {\"events\": [{\"id\": \"evt-fix-developed-1\", \"type\": \"fix-developed\", \"timestamp\": \"2026-09-23T13:27:08Z\", \"references\": [\"https://github.com/MISP/MISP/commit/79fbd4c75.patch\"], \"description\": \"Corrective change authored (79fbd4c7580adc0518581351c3d8c3d5b3ac7c97): fix: [security] Apply the thread ACL when posting to a\"}]}}}, \"recordType\": \"advisory\"}], \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Bastien Bossiroy and C\\u00e9lien Desteucq of NCIA\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"iglocska\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Claude Opus 5.5 (1M context)\"}], \"impacts\": [{\"capecId\": \"CAPEC-10\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-10 Parameter Tampering\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 5.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"other\": {\"type\": \"SSVC\", \"content\": {\"role\": \"Supplier\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-01T11:16:47Z\"}}, \"format\": \"SSVC\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/MISP/MISP\", \"vendor\": \"MISP\", \"modules\": [\"PostsController (discussion/thread posting)\"], \"product\": \"MISP\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"2.5.48\", \"versionType\": \"semver\"}], \"programFiles\": [\"app/Controller/PostsController.php\"]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The fix replaces the limited org-only distribution check with a call to the thread\u0027s full authorization method (checkIfAuthorised), which enforces the complete access control list including sharing groups and event-level visibility. The thread is only read after successful authorization, preventing disclosure of the title and content to unauthorized users. An additional null-check on the post\u0027s thread_id was added to prevent referencing posts without a valid thread association.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe fix replaces the limited org-only distribution check with a call to the thread\u0027s full authorization method (checkIfAuthorised), which enforces the complete access control list including sharing groups and event-level visibility. The thread is only read after successful authorization, preventing disclosure of the title and content to unauthorized users. An additional null-check on the post\u0027s thread_id was added to prevent referencing posts without a valid thread association.\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://github.com/MISP/MISP/commit/79fbd4c75\", \"name\": \"Security patch\", \"tags\": [\"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization (org-only distribution). It did not enforce the full thread access control list, including sharing-group membership and event-level visibility.\\n\\nAs a result, an authenticated user who is outside the relevant sharing group or who does not have visibility on the associated event could:\\n\\n- Read the thread title and the content of the quoted post\\n\\n- Submit a new post into the discussion thread\\n\\nThis constitutes both an information disclosure (reading restricted thread and post content) and an integrity issue (injecting content into a thread the user is not authorized to participate in).\\n\\nAffected: \u003c2.5.48\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eMISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization (org-only distribution). It did not enforce the full thread access control list, including sharing-group membership and event-level visibility.\u003c/p\u003e\u003cp\u003eAs a result, an authenticated user who is outside the relevant sharing group or who does not have visibility on the associated event could:\u003c/p\u003e\u003cp\u003e- Read the thread title and the content of the quoted post\u003c/p\u003e\u003cp\u003e- Submit a new post into the discussion thread\u003c/p\u003e\u003cp\u003eThis constitutes both an information disclosure (reading restricted thread and post content) and an integrity issue (injecting content into a thread the user is not authorized to participate in).\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-285\", \"description\": \"CWE-285 Improper Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"5a6e4751-2f3f-4070-9419-94fb35b644e8\", \"shortName\": \"CIRCL\", \"dateUpdated\": \"2026-10-01T11:31:32.840Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-103858\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-01T15:00:57.587Z\", \"dateReserved\": \"2026-10-01T11:31:31.101Z\", \"assignerOrgId\": \"5a6e4751-2f3f-4070-9419-94fb35b644e8\", \"datePublished\": \"2026-10-01T11:31:32.840Z\", \"assignerShortName\": \"CIRCL\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…