EUVD-2026-36552
GHSA-j794-65mg-q3vf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable add endpoint exploitable by any authenticated user with the add-sharing-group role (PR:L, AC:L); scope changes because the vulnerable controller modifies another org's authorization boundary; high C and I on shared data, no availability impact.
Primary rating from Vendor (5a6e4751-2f3f-4070-9419-94fb35b644e8).
CVSS VectorVendor: 5a6e4751-2f3f-4070-9419-94fb35b644e8
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A mass assignment vulnerability exists in MISP’s sharing group creation endpoint. When creating a new sharing group, the controller did not remove a user-supplied id field before saving the submitted data. In CakePHP, supplying a primary key in the save data can cause a create() followed by save() operation to update an existing record instead of creating a new one.
An authenticated user with permission to add sharing groups could therefore submit the identifier of an existing sharing group and modify that sharing group without passing the normal edit access-control checks. This may allow the attacker to take over or alter sharing groups they do not otherwise have access to, potentially affecting the confidentiality and integrity of information shared through those groups.
Affected component: app/Controller/SharingGroupsController.php, add() action
Articles & Coverage 1
AnalysisAI
Mass assignment in MISP's sharing group creation endpoint allows authenticated users with add-sharing-group permission to hijack arbitrary existing sharing groups by submitting the target group's primary key in the add() request. The CakePHP create()+save() pattern treats a supplied id as an update, bypassing the normal edit ACL on app/Controller/SharingGroupsController.php and exposing confidentiality and integrity of shared threat intelligence. No public exploit identified at time of analysis, though a fix commit is publicly visible on GitHub.
Technical ContextAI
MISP (Malware Information Sharing Platform) is a PHP threat-intelligence sharing platform built on the CakePHP framework. Sharing groups are MISP's access-control primitive defining which organizations can see specific events and attributes. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): CakePHP's ORM treats a primary key present in save data as an instruction to update that row, so a controller calling create() followed by save() on unfiltered POST data will silently update the record whose id the attacker supplies instead of inserting a new one. The vulnerable code path is SharingGroupsController::add(), which never unset the id field from submitted data before persisting.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change in MISP commit 687e7cb530ae0e2faaadf5e3e44712258fb3ef1b, which adds unset($sg['id']) in SharingGroupsController::add() to strip the user-controlled primary key before save (https://github.com/MISP/MISP/commit/687e7cb530ae0e2faaadf5e3e44712258fb3ef1b), and upgrade to the next tagged MISP release that includes it. As a temporary workaround until patching, revoke the 'add sharing group' permission from non-administrator roles (side effect: users can no longer create sharing groups, breaking normal collaboration workflows) or place a reverse-proxy rule that rejects POSTs to /sharing_groups/add containing an id parameter (side effect: legitimate clients sending stray id fields will fail). Audit existing sharing groups for unexpected membership or organization changes since the vulnerability was introduced, as exploitation leaves no distinguishing signature beyond a modified record.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today