MISP CVE-2026-54397

Exploitation requires a valid MISP user account with event editing permissions (PR:L in CVSS terms) - unauthenticated exploitation is not possible. The attack specifically targets the non-REST web form edit path (/events/edit/[id]); the REST API path is not vulnerable because it enforces sharing group authorization via Event::_edit(). The attacker must submit a crafted POST request with distribution set to mode 4 (sharing group) and a sharing_group_id referencing a group they do not belong to. Exploitation is further constrained by the need to know or enumerate valid integer sharing_group_id values within the MISP instance. The impact is bounded to sharing group name disclosure and event metadata integrity corruption - no code execution, credential theft, or direct data exfiltration of event content results. Organizations where all MISP users are equally trusted across all sharing groups are not materially affected by this flaw.

The CVSS 4.0 score of 6.1 with vector AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:N/SA:N reflects a medium-severity finding. The SC:H metric is the primary risk driver, representing the high subsequent confidentiality impact of leaking restricted sharing group identity information - in MISP's operational context, the existence and membership of sharing groups is often itself sensitive (e.g., government CERT circles, classified ISACs). Attack complexity is low once the attacker holds event edit rights, requiring only standard HTTP interception to modify form parameters. No EPSS score was present in the provided data, so numeric exploitation probability cannot be assessed. No CISA KEV listing and no public exploit code have been identified, indicating no confirmed active exploitation at time of analysis; risk at this point is theoretical but technically straightforward for any credentialed insider. The attacker pool is constrained to authenticated MISP users with event edit permissions, significantly limiting blast radius compared to an unauthenticated flaw. Organizations operating MISP instances with sensitive or classified sharing groups - exactly the deployments for which this platform is designed - should treat this as a priority fix.

An authenticated MISP user with event edit permissions uses a browser proxy tool to intercept the HTTP POST request submitted when saving an event edit, modifies the sharing_group_id parameter to the numeric ID of a sharing group they are not authorized to use, and resubmits the request to the non-REST edit endpoint. MISP saves the event with the unauthorized sharing_group_id, and the restricted sharing group's name subsequently appears in the event index listing, disclosing its existence to the attacker and any observers of that event.