Is there a patch available for EUVD-2026-42601?

Yes, a patch is available for EUVD-2026-42601. Update the affected software to the latest version immediately.

MISP EUVD-2026-42601

Q: What is the CVSS score of EUVD-2026-42601?

EUVD-2026-42601 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-61474 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-09 CIRCL

GHSA-x9x8-26mr-9wmm

Authentication Bypass Misp

5.3

CVSS 4.0 · Vendor: CIRCL

Severity by source

Vendor (CIRCL) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-accessible with low authentication (PR:L) required; no scope change as impact is confined to MISP's own sharing metadata; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N

Primary rating from Vendor (CIRCL).

CVSS VectorVendor: CIRCL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 16:21 vuln.today

DescriptionCVE.org

An improper authorization check in MISP’s attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharing_group_id without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly set to 4 - “sharing group”.

As a result, a user could reference or associate an attribute with a sharing group they were not authorized to use. This could lead to an access-control bypass affecting the integrity of attribute sharing metadata and potentially expose or misuse restricted sharing group relationships.

The patch changes the authorization logic so that the sharing group permission check is performed whenever a non-empty sharing_group_id is provided, regardless of the selected distribution value.

AnalysisAI

MISP's attribute creation endpoint contains an authorization bypass allowing authenticated users with attribute-creation permissions to associate attributes with sharing groups they are not authorized to access. The flaw arises because the sharing group permission check was gated exclusively on the distribution field being set to 4 (sharing group mode), meaning a user could submit any non-empty sharing_group_id with a different distribution value and bypass the check entirely. No public exploit has been identified at time of analysis; a vendor patch is available via a confirmed GitHub commit.

Technical ContextAI

MISP (Malware Information Sharing Platform) is an open-source threat intelligence sharing platform widely used by CERTs, ISACs, and security organizations to share structured threat data. Its data model includes sharing groups - restricted collections of organizations that control access to sensitive indicators. The attribute creation endpoint accepts both a distribution field (integer 0-4) and a sharing_group_id field. The root cause is CWE-863 (Incorrect Authorization): the authorization check for sharing group membership was conditional on distribution equaling 4, rather than triggering whenever sharing_group_id was non-empty. This logic gap allowed an attacker-controlled sharing_group_id to slip through without the associated membership verification. CPE string cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* covers all MISP versions.

RemediationAI

Update MISP to a version that includes commit df612166538e2979fae9f7eda88345ccc8fee761 (https://github.com/MISP/MISP/commit/df612166538e2979fae9f7eda88345ccc8fee761), which corrects the authorization logic to perform the sharing group membership check whenever a non-empty sharing_group_id is submitted, regardless of the distribution value. If an immediate update is not feasible, restrict attribute-creation permissions to fully trusted, internal-only users as a compensating control - this trades contributor breadth for reduced exposure, and is appropriate for high-sensitivity MISP instances. Operators should also audit existing attributes for unexpected sharing_group_id associations that may indicate prior exploitation; MISP's event audit log can assist. No network-layer workaround exists that preserves full API functionality without applying the patch. The exact patched release version number is not confirmed from available data - verify the target release tag includes the referenced commit before deploying.