Is there a patch available for CVE-2026-54397?

Yes, a patch is available for CVE-2026-54397. Update the affected software to the latest version immediately.

MISP CVE-2026-54397

Q: What is the CVSS score of CVE-2026-54397?

CVE-2026-54397 has a CVSS 4.0 base score of 6.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36577 MEDIUM

Incorrect Authorization (CWE-863)

2026-06-12 CIRCL

GHSA-4qr4-pqwx-m352

Authentication Bypass Misp

6.1

CVSS 4.0 · Vendor: CIRCL

Severity by source

Vendor (CIRCL) PRIMARY

6.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.4 MEDIUM

Network-accessible web form; attacker submits crafted request directly (no other user interaction); scope change applies as the attacker accesses sharing group resources outside their authorization boundary.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (CIRCL).

CVSS VectorVendor: CIRCL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 12, 2026 - 21:21 vuln.today

Analysis Generated

Jun 12, 2026 - 21:21 vuln.today

DescriptionCVE.org

A vulnerability in MISP’s non-REST event editing path allowed an authenticated user with event edit permissions to manipulate the submitted form data and set an event’s sharing_group_id to a sharing group they were not authorized to use. When distribution was set to sharing group distribution, the non-REST save path accepted the submitted sharing_group_id without performing the same sharing group authorization check enforced by the REST edit path.

An attacker could exploit this by tampering with the event edit request and assigning an event to an undisclosed or unauthorized sharing group. This could result in unauthorized use of restricted sharing groups, disclosure of the sharing group name in event listings, and unintended modification of the event’s distribution metadata.

The issue is fixed by validating that the selected sharing group can be used by the current user when the sharing group is changed, and by clearing sharing_group_id when the event distribution is not set to sharing group distribution.

AnalysisAI

Unauthorized sharing group assignment in MISP's non-REST event edit path allows any authenticated event editor to assign an event to a restricted sharing group they are not a member of by tampering with submitted form data. The REST API path enforced sharing group authorization via Event::_edit(), but the web form save path wrote sharing_group_id directly from POST data without equivalent validation - a classic split-path authorization gap (CWE-863). Successful exploitation leaks the restricted sharing group's name in event listings and corrupts the event's distribution metadata. No public exploit has been identified at time of analysis, and the fix is available as commit 609ff6c from the MISP maintainers (CIRCL).

Technical ContextAI

MISP (Malware Information Sharing Platform) is an open-source threat intelligence sharing platform maintained by CIRCL. Distribution of events in MISP is governed by a tiered model; distribution mode 4 assigns an event to a specific sharing group - a named, access-controlled pool of organizations. The sharing_group_id field on an event determines which group receives it. The REST API code path enforced sharing group membership authorization through Event::_edit(), but the non-REST controller action in app/Controller/EventsController.php directly consumed the sharing_group_id value from the submitted HTTP POST body without calling SharingGroup->checkIfCanBeUsed() for the acting user. The commit diff confirms the fix adds this authorization call when sharing_group_id changes under distribution mode 4 and zeros out sharing_group_id when distribution is not set to mode 4 - closing both the assignment bypass and a residual metadata inconsistency. CWE-863 (Incorrect Authorization) precisely describes the root cause: authorization logic existed but was applied inconsistently across code paths for the same resource operation.

RemediationAI

Upstream fix is available as commit 609ff6c785d7dae41d22ef43dda9347d34cd2a58 at https://github.com/MISP/MISP/commit/609ff6c785d7dae41d22ef43dda9347d34cd2a58; a released patched version number was not independently confirmed from available data - administrators should apply this commit or update to the latest MISP release from the official repository. The patch adds a call to SharingGroup->checkIfCanBeUsed() when an editor attempts to change an event's sharing_group_id under distribution mode 4, and clears sharing_group_id when distribution is not set to sharing group mode. If immediate patching is not feasible, restrict event editing permissions to the minimum necessary set of highly trusted organizational accounts - this directly reduces the population of users capable of exploiting the flaw, though it does not eliminate the vulnerability. Restricting web interface access to known organizational network ranges via firewall or reverse proxy rules reduces external exposure but does not protect against insider abuse. Neither workaround eliminates the vulnerability and patching remains the required remediation.