MISP CVE-2026-95697

Exploitation requires an authenticated MISP account holding at least the sharing-group (SG) editor role plus network access to the MISP web interface (PR:L). The specific trigger is any request that reaches Organisation::captureOrg with the $force parameter set to true, which in the unpatched code overwrites organization metadata without verifying perm_site_admin or perm_sync. Limiting factors: this is NOT unauthenticated - it depends on the target having provisioned SG editor privileges to a lower-trust user, and impact is confined to integrity of organization records and derived sharing-group/blueprint configurations (no data disclosure or service disruption). Instances that restrict SG editor roles to fully trusted administrators face substantially reduced practical risk.

This is a genuine but low-severity integrity issue, not a top-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network reachability with low attack complexity and no user interaction, but critically requires privileges (PR:L) - an authenticated user already holding a sharing-group editor role. Impact is narrow: vulnerable-system integrity only (VI:L, SI:L), with no confidentiality (VC:N) and no availability (VA:N) impact, which aligns with the description's 'primarily on the integrity of organization records.' No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent - there is no conflict between a network vector and the described web-interface access, and the moderate 5.3 score is a fair reflection of a privilege-gated, integrity-only authorization bypass. The Tags field mislabels this as 'Authentication Bypass'; it is actually an authorization/missing-authorization flaw (CWE-862) - the attacker is already authenticated, so no authentication is bypassed. Real-world priority is modest: patch during normal cycles, prioritizing instances that delegate SG editor roles to lower-trust users.

An authenticated MISP user who has been granted a sharing-group editor role invokes the code path that calls Organisation::captureOrg with $force=true, causing organization metadata fields to be overwritten without the site-admin or sync privilege check that should gate them. By altering organizational attributes, the attacker influences how sharing groups and blueprints resolve organizations across the instance, corrupting shared threat-intelligence distribution. No public exploit code is identified at time of analysis, and the attack requires an existing low-privilege account on the target instance.