Is there a patch available for CVE-2026-54398?

Yes, a patch is available for CVE-2026-54398. Update the affected software to the latest version immediately.

MISP CVE-2026-54398

Q: What is the CVSS score of CVE-2026-54398?

CVE-2026-54398 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36603 MEDIUM

Incorrect Authorization (CWE-863)

2026-06-12 CIRCL

GHSA-27wx-pvwm-cfh2

Authentication Bypass Misp

5.3

CVSS 4.0 · Vendor: CIRCL

Severity by source

Vendor (CIRCL) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-exploitable with low complexity; requires authenticated editor-level access (PR:L); limited confidentiality and integrity impact; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CIRCL).

CVSS VectorVendor: CIRCL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 12, 2026 - 22:21 vuln.today

Analysis Generated

Jun 12, 2026 - 22:21 vuln.today

DescriptionCVE.org

An authorization flaw in MISP’s object add/edit handling allowed an authenticated user with object editing permissions to assign a MISP object, or attributes contained within an object, to a sharing group that the user was not authorized to use or view. When editing objects, the sharing group validation was performed against the wrong request data structure after object fields had been merged to the top level, causing the check to be bypassed. In addition, attributes embedded in objects were not individually validated for authorized sharing group use.

An attacker could craft a request with distribution set to 4 and an arbitrary sharing_group_id, potentially disclosing the existence or name of otherwise non-visible sharing groups and improperly modifying the distribution metadata of objects or contained attributes.

AnalysisAI

Sharing group authorization bypass in MISP's object add/edit workflow allows an authenticated user with object-editing permissions to assign objects and their contained attributes to sharing groups they are not authorized to access or view. The flaw stems from a structural data merging step in ObjectsController.php that silently relocates field keys, causing the sharing group validation check to evaluate a stale, already-removed data path and thus never fire. An attacker exploiting this can probe the existence and names of non-visible sharing groups and improperly alter the distribution metadata of objects and embedded attributes. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

MISP (Malware Information Sharing Platform) is a PHP-based threat intelligence sharing application maintained by CIRCL. The affected component is ObjectsController.php, which handles creation and modification of MISP objects - structured containers that group related attributes. The root cause is classified as CWE-863 (Incorrect Authorization): the edit() method merged the nested data['Object'] fields up to the top level of the request data array and then unset data['Object'], but the subsequent sharing group authorization check still referenced $this->request->data['Object']['distribution'] - a key that no longer existed after the merge. The condition could therefore never be true, meaning the checkIfCanBeUsed() call was never reached. A parallel gap existed for embedded attributes: AttributesController already validated sharing groups for standalone attribute add/edit operations, but no equivalent validation was applied to attributes nested inside objects processed by ObjectsController. The fix corrects the key reference to $this->request->data['distribution'] and introduces a new private __validateAttributeSharingGroups() method that iterates over each embedded attribute with distribution=4 and invokes the same sharing group authorization check used for standalone attributes. The CPE string cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* indicates all MISP versions are potentially affected prior to the patch commit.

RemediationAI

The primary remediation is to update MISP to a version that includes commit 4fe48c523e66999d65f99fdec9508adb3aa1c0f3, which corrects the distribution field key reference in the edit() method and adds per-attribute sharing group validation via the new __validateAttributeSharingGroups() method. The patch reference is available at https://github.com/MISP/MISP/commit/4fe48c523e66999d65f99fdec9508adb3aa1c0f3. A specific tagged release version containing this fix is not confirmed in the provided data - administrators should identify the first tagged release incorporating this commit and upgrade to it. As a compensating control prior to patching, restrict object editing permissions to only fully trusted users within each MISP instance, since the vulnerability requires the actor to hold object editing rights. Auditing MISP event and object logs for anomalous distribution=4 assignments by lower-privilege users may help identify exploitation attempts. Note that restricting editing rights may limit operational workflows and should be assessed against operational impact before implementation.