CVE-2026-112178 (GCVE-0-2026-112178)
Vulnerability from cvelistv5
Published
2026-10-19 08:50
Modified
2026-10-19 17:20
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.
- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute's distribution level (levels 1-3 should restrict visibility)
- The owning organisation could not view proposals on its own org-only attributes
Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.
Affected: <2.5.48
References
| URL | Tags | |
|---|---|---|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112178",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:20:26.843308Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:20:40.642Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"ShadowAttribute (proposal/shadow attribute handling)"
],
"product": "MISP",
"programFiles": [
"app/Model/ShadowAttribute.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
},
{
"lang": "en",
"type": "reporter",
"value": "elhoim"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user\u0027s sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.\u003c/p\u003e\u003cp\u003e- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute\u0027s distribution level (levels 1-3 should restrict visibility)\u003c/p\u003e\u003cp\u003e- The owning organisation could not view proposals on its own org-only attributes\u003c/p\u003e\u003cp\u003eSecurity impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48\u003c/p\u003e"
}
],
"value": "MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user\u0027s sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.\n\n- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute\u0027s distribution level (levels 1-3 should restrict visibility)\n\n- The owning organisation could not view proposals on its own org-only attributes\n\nSecurity impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.\n\nAffected: \u003c2.5.48"
}
],
"impacts": [
{
"capecId": "CAPEC-2",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-2 Parameter Tampering"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-19T08:49:14Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:50:52.402Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/9c5af321f"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix enforces the distribution level constraint in the sharing group access check, requiring distribution level 4 (All communities) for the sharing group test to apply. Additionally, the owning organisation is now explicitly granted access to proposals on its own attributes regardless of distribution level, correcting the over-restrictive behavior.\u003c/p\u003e"
}
],
"value": "The fix enforces the distribution level constraint in the sharing group access check, requiring distribution level 4 (All communities) for the sharing group test to apply. Additionally, the owning organisation is now explicitly granted access to proposals on its own attributes regardless of distribution level, correcting the over-restrictive behavior."
}
],
"title": "MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The CAPEC mapping (CAPEC-2, Parameter Tampering) is the closest available match but is uncertain; the vulnerability is more accurately a missing authorization check (incomplete ACL evaluation) rather than active parameter manipulation by the attacker.",
"The affected version boundary is inferred from the tag v2.5.48 and the commit position (35 commits after the fix); exact version boundaries are not explicitly stated in the patch metadata.",
"The second aspect of the vulnerability (owner organisation denied access to its own proposals) is primarily a functional/availability defect rather than a security vulnerability, but is included as part of the same fix and the same root cause (incomplete ACL logic).",
"CVSS PR:L assumes the attacker must be an authenticated MISP user with membership in a relevant sharing group; no evidence supports unauthenticated access.",
"The Co-Authored-By line credits an AI assistant (Claude Opus 5.5) as a remediation developer; this is recorded as-is from the commit metadata."
],
"capecRationale": [
{
"capecId": "CAPEC-2",
"rationale": "The user\u0027s sharing group membership (a parameter of their identity/session) was leveraged by the flawed authorization logic to grant access to proposals without the required distribution level check. This is the closest available CAPEC pattern; the user is not actively tampering with parameters, but the system improperly treats group membership as a sufficient access parameter without enforcing the additional distribution constraint. The mapping is uncertain because the vulnerability is more accurately a missing authorization check than active parameter manipulation."
}
],
"commit": "9c5af321fe8f1d2209c8b3c35f4d570d47e9af9e",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
},
{
"lang": "en",
"type": "reporter",
"value": "elhoim"
}
],
"cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The user only needs to be a member of a sharing group; no special conditions or race conditions are required. AT:N: No active attack requirements beyond normal API usage. PR:L: The attacker must be an authenticated user with membership in a relevant sharing group. UI:N: No user interaction is required; the check is server-side. VC:H: The user can view proposals (proposed attribute changes) that should be restricted by distribution level, disclosing sensitive information about proposed changes. VI:N: No integrity impact; the user cannot modify proposals. VA:N: No availability impact. SC/SI/SA:N: No impact on subsequent components.",
"fixSummary": "The fix enforces the distribution level constraint in the sharing group access check, requiring distribution level 4 (All communities) for the sharing group test to apply. Additionally, the owning organisation is now explicitly granted access to proposals on its own attributes regardless of distribution level, correcting the over-restrictive behavior.",
"generatedAt": "2026-10-19T08:49:14.568262Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 5,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 7
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "c50a0b040ef7da05d8dffbdc10599991ce441f3fe965e1025620e2e0581b7166",
"patchSummary": "In the shadow attribute model\u0027s condition builder, the sharing group check for both objects and attributes now includes an AND condition requiring distribution = 4 alongside the sharing_group_id IN check. The attribute distribution condition was changed from a simple sharing_group_id IN clause to a compound AND condition with distribution = 4. A new OR condition (Event.org_id matching the user\u0027s org_id) was added to grant the owning organisation access to proposals on its own attributes.",
"patchTruncated": false,
"patches": [
{
"commit": "9c5af321fe8f1d2209c8b3c35f4d570d47e9af9e",
"date": "Thu, 24 Sep 2026 16:23:08 +0200",
"patchSha256": "c50a0b040ef7da05d8dffbdc10599991ce441f3fe965e1025620e2e0581b7166",
"source": "https://github.com/MISP/MISP/commit/9c5af321f.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/9c5af321f.patch",
"subject": "fix: [proposals] Apply the attribute ACL rules to proposals"
}
],
"source": "https://github.com/MISP/MISP/commit/9c5af321f.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-19T08:49:14Z",
"version": "2.0.3"
},
"subject": "fix: [proposals] Apply the attribute ACL rules to proposals",
"tagVersionBoundary": {
"commits_after_fix": 35,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.48",
"version": "2.5.48",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-862",
"rationale": "The authorization check for proposal visibility was missing the distribution level constraint. The system evaluated sharing group membership as sufficient for access without also requiring the distribution level to be 4 (All communities), resulting in an incomplete authorization check that allowed access to proposals on more restrictively distributed attributes."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (9c5af321fe8f1d2209c8b3c35f4d570d47e9af9e): fix: [proposals] Apply the attribute ACL rules to proposals",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/MISP/MISP/commit/9c5af321f.patch"
],
"timestamp": "2026-09-24T14:23:08Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20337"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-112178",
"datePublished": "2026-10-19T08:50:52.402Z",
"dateReserved": "2026-10-19T08:50:50.711Z",
"dateUpdated": "2026-10-19T17:20:40.642Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-112178\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-19T17:20:26.843308Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-19T17:20:35.497Z\"}}], \"cna\": {\"title\": \"MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control\", \"x_gcve\": [{\"vulnId\": \"GCVE-1-2026-20337\", \"extensions\": {\"bcp-05-x-01\": {\"ai_annotations\": [{\"tags\": [\"ai-computer-assisted:llm-generated\", \"ai-computer-assisted:classification\"], \"scope\": \"record\", \"models\": [{\"name\": \"qwen3.8:27b\", \"source\": \"ollama\", \"gna_source\": 1, \"identifier\": \"qwen3.8:27b\"}], \"ai_level\": \"generated\", \"gna_source\": 1, \"description\": \"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.\", \"review_status\": \"full\"}]}, \"bcp-05-x-02\": {\"x_patch2vuln\": {\"ssvc\": {\"role\": \"Supplier\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-19T08:49:14Z\"}, \"model\": \"qwen3.8:27b\", \"commit\": \"9c5af321fe8f1d2209c8b3c35f4d570d47e9af9e\", \"source\": \"https://github.com/MISP/MISP/commit/9c5af321f.patch\", \"credits\": [{\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"iglocska\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Claude Opus 5.5 (1M context)\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"elhoim\"}], \"patches\": [{\"date\": \"Thu, 24 Sep 2026 16:23:08 +0200\", \"commit\": \"9c5af321fe8f1d2209c8b3c35f4d570d47e9af9e\", \"source\": \"https://github.com/MISP/MISP/commit/9c5af321f.patch\", \"subject\": \"fix: [proposals] Apply the attribute ACL rules to proposals\", \"sourceUrl\": \"https://github.com/MISP/MISP/commit/9c5af321f.patch\", \"patchSha256\": \"c50a0b040ef7da05d8dffbdc10599991ce441f3fe965e1025620e2e0581b7166\"}], \"subject\": \"fix: [proposals] Apply the attribute ACL rules to proposals\", \"generator\": \"patch2vuln.py\", \"confidence\": \"medium\", \"fixSummary\": \"The fix enforces the distribution level constraint in the sharing group access check, requiring distribution level 4 (All communities) for the sharing group test to apply. Additionally, the owning organisation is now explicitly granted access to proposals on its own attributes regardless of distribution level, correcting the over-restrictive behavior.\", \"assumptions\": [\"The CAPEC mapping (CAPEC-2, Parameter Tampering) is the closest available match but is uncertain; the vulnerability is more accurately a missing authorization check (incomplete ACL evaluation) rather than active parameter manipulation by the attacker.\", \"The affected version boundary is inferred from the tag v2.5.48 and the commit position (35 commits after the fix); exact version boundaries are not explicitly stated in the patch metadata.\", \"The second aspect of the vulnerability (owner organisation denied access to its own proposals) is primarily a functional/availability defect rather than a security vulnerability, but is included as part of the same fix and the same root cause (incomplete ACL logic).\", \"CVSS PR:L assumes the attacker must be an authenticated MISP user with membership in a relevant sharing group; no evidence supports unauthenticated access.\", \"The Co-Authored-By line credits an AI assistant (Claude Opus 5.5) as a remediation developer; this is recorded as-is from the commit metadata.\"], \"generatedAt\": \"2026-10-19T08:49:14.568262Z\", \"patchSha256\": \"c50a0b040ef7da05d8dffbdc10599991ce441f3fe965e1025620e2e0581b7166\", \"patchSummary\": \"In the shadow attribute model\u0027s condition builder, the sharing group check for both objects and attributes now includes an AND condition requiring distribution = 4 alongside the sharing_group_id IN check. The attribute distribution condition was changed from a simple sharing_group_id IN clause to a compound AND condition with distribution = 4. A new OR condition (Event.org_id matching the user\u0027s org_id) was added to grant the owning organisation access to proposals on its own attributes.\", \"cvssRationale\": \"AV:N: MISP is a network-accessible web application. AC:L: The user only needs to be a member of a sharing group; no special conditions or race conditions are required. AT:N: No active attack requirements beyond normal API usage. PR:L: The attacker must be an authenticated user with membership in a relevant sharing group. UI:N: No user interaction is required; the check is server-side. VC:H: The user can view proposals (proposed attribute changes) that should be restricted by distribution level, disclosing sensitive information about proposed changes. VI:N: No integrity impact; the user cannot modify proposals. VA:N: No availability impact. SC/SI/SA:N: No impact on subsequent components.\", \"capecRationale\": [{\"capecId\": \"CAPEC-2\", \"rationale\": \"The user\u0027s sharing group membership (a parameter of their identity/session) was leveraged by the flawed authorization logic to grant access to proposals without the required distribution level check. This is the closest available CAPEC pattern; the user is not actively tampering with parameters, but the system improperly treats group membership as a sufficient access parameter without enforcing the additional distribution constraint. The mapping is uncertain because the vulnerability is more accurately a missing authorization check than active parameter manipulation.\"}], \"patchTruncated\": false, \"modelComparison\": {\"rankings\": [{\"model\": \"qwen3.8:27b\", \"score\": 7, \"confidence\": \"medium\", \"agreementScore\": 11, \"assumptionCount\": 5}], \"selectedModel\": \"qwen3.8:27b\", \"selectionMethod\": \"deterministic-consensus-v1\", \"selectionNotice\": \"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.\"}, \"weaknessRationale\": [{\"cweId\": \"CWE-862\", \"rationale\": \"The authorization check for proposal visibility was missing the distribution level constraint. The system evaluated sharing group membership as sufficient for access without also requiring the distribution level to be 4 (All communities), resulting in an incomplete authorization check that allowed access to proposals on more restrictively distributed attributes.\"}], \"tagVersionBoundary\": {\"tag\": \"v2.5.48\", \"version\": \"2.5.48\", \"repository\": \"https://github.com/MISP/MISP\", \"version_type\": \"semver\", \"commits_after_fix\": 35}}}, \"bcp-05-x-03\": {\"x_timeline\": {\"events\": [{\"id\": \"evt-fix-developed-1\", \"type\": \"fix-developed\", \"timestamp\": \"2026-09-24T14:23:08Z\", \"references\": [\"https://github.com/MISP/MISP/commit/9c5af321f.patch\"], \"description\": \"Corrective change authored (9c5af321fe8f1d2209c8b3c35f4d570d47e9af9e): fix: [proposals] Apply the attribute ACL rules to proposals\"}]}}}, \"recordType\": \"advisory\"}], \"credits\": [{\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"iglocska\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Claude Opus 5.5 (1M context)\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"elhoim\"}], \"impacts\": [{\"capecId\": \"CAPEC-2\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-2 Parameter Tampering\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 7.1, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"other\": {\"type\": \"SSVC\", \"content\": {\"role\": \"Supplier\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-19T08:49:14Z\"}}, \"format\": \"SSVC\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/MISP/MISP\", \"vendor\": \"MISP\", \"modules\": [\"ShadowAttribute (proposal/shadow attribute handling)\"], \"product\": \"MISP\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.5.48\", \"versionType\": \"semver\"}], \"programFiles\": [\"app/Model/ShadowAttribute.php\"]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The fix enforces the distribution level constraint in the sharing group access check, requiring distribution level 4 (All communities) for the sharing group test to apply. Additionally, the owning organisation is now explicitly granted access to proposals on its own attributes regardless of distribution level, correcting the over-restrictive behavior.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe fix enforces the distribution level constraint in the sharing group access check, requiring distribution level 4 (All communities) for the sharing group test to apply. Additionally, the owning organisation is now explicitly granted access to proposals on its own attributes regardless of distribution level, correcting the over-restrictive behavior.\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://github.com/MISP/MISP/commit/9c5af321f\", \"name\": \"Security patch\", \"tags\": [\"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user\u0027s sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.\\n\\n- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute\u0027s distribution level (levels 1-3 should restrict visibility)\\n\\n- The owning organisation could not view proposals on its own org-only attributes\\n\\nSecurity impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.\\n\\nAffected: \u003c2.5.48\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eMISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user\u0027s sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.\u003c/p\u003e\u003cp\u003e- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute\u0027s distribution level (levels 1-3 should restrict visibility)\u003c/p\u003e\u003cp\u003e- The owning organisation could not view proposals on its own org-only attributes\u003c/p\u003e\u003cp\u003eSecurity impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862 Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"5a6e4751-2f3f-4070-9419-94fb35b644e8\", \"shortName\": \"CIRCL\", \"dateUpdated\": \"2026-10-19T08:50:52.402Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-112178\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-19T17:20:40.642Z\", \"dateReserved\": \"2026-10-19T08:50:50.711Z\", \"assignerOrgId\": \"5a6e4751-2f3f-4070-9419-94fb35b644e8\", \"datePublished\": \"2026-10-19T08:50:52.402Z\", \"assignerShortName\": \"CIRCL\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…