MISP CVE-2026-103858

Requires an authenticated MISP account (PR:L) on the instance - exploitation is not possible unauthenticated. The attacker must be OUTSIDE the target thread's authorization scope (not a member of its sharing group, or lacking visibility on the associated event) and must know or enumerate a target thread ID, then invoke the discussion post/reply functionality (PostsController::add). What limits exploitation: the pre-2.5.48 code only skipped the sharing-group and event-level checks while still enforcing org-only (distribution==0) restriction, so threads limited purely by org distribution were NOT exposed - only threads restricted via sharing-group membership or event visibility are affected. No user interaction and no non-default configuration are needed beyond having multiple organizations/sharing groups in use, which is the normal MISP federation deployment mode.

This is a genuine but modest-severity authorization flaw, not a high-CVSS-but-low-risk false alarm nor a critical priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N, 5.3 MEDIUM) is internally consistent with the description: network-reachable, low complexity, but requiring an authenticated low-privileged account (PR:L) and yielding only low confidentiality and integrity impact with no scope change or availability effect. No EPSS score, KEV listing, or POC was provided, so exploitation status is 'no public exploit identified at time of analysis' - this is targeted-value-only, not mass-exploitable. The signals do not conflict: a partial-impact authz check bypass accessible only to existing authenticated MISP users aligns with a medium score. The limiting factor is the trust model - MISP instances deliberately federate multiple organizations and sharing groups, so the realistic threat is a legitimate low-trust member reading/injecting into threads outside their sharing-group or event visibility, which matters precisely because MISP's whole value is compartmentalized intel sharing. No key data is missing or contradictory; the source-code diff independently confirms the described defect and its fix.

An authenticated MISP user who belongs to the instance but is outside a given thread's sharing group (or lacks visibility on the associated event) submits a post or reply targeting that restricted thread's ID. Because PostsController::add only checked org-only distribution and not the full thread ACL, the server returns the thread title and quoted post content to the attacker and accepts their injected reply into the restricted discussion. No public exploit code was provided, but the attack is trivially reproducible by anyone with a valid account and a target thread ID.