MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-285.
Summary
MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distribution and sharing-group access control check was not re-applied to those attributes. As a result, a user who can view a community-distributed event could retrieve attributes belonging to organisation-only objects (distribution level 0) or objects restricted to a specific sharing group, even though the user's organisation does not have access to those objects. This constitutes an unauthorized disclosure of sensitive threat intelligence data. A secondary issue was introduced by the initial remediation: the fix reused the full Object contain conditions (including soft-delete state) as the gate for flattened attributes, causing an event owner requesting deleted attributes to lose all attributes whose parent object was still live. The final fix isolates the distribution ACL condition as the sole gate. Preconditions: - An authenticated user with access to a community-distributed event - The event contains at least one object with a distribution level or sharing group that restricts access beyond the event's own distribution Impact: - Unauthorized disclosure of attributes belonging to restricted objects - Potential exposure of organisation-specific threat intelligence to other organisations Affected versions: <2.5.48
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA MISP (MISP) Fixed in 2.5.48
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
MISP 2.5.48
6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2026-65744 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity PeriodPriority MEDIUM 48
- TI-2026-65743 MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication BypassPriority LOW 35
- TI-2026-65763 MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to DiscussionsPriority LOW 23
Timeline
- 2026-10-02 Threatist record created from CVE-2026-103659
- 2026-10-03 Alias added: GHSA-r4v7-fgm4-552c
References
Patch 2
More MISP vulnerabilities
- TI-2025-41517 In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. CVSS 3.1CRITICAL 9.0
- TI-2026-65744 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period CVSS 4.0CRITICAL 9.3
- TI-2026-54145 Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library CVSS 4.0HIGH 8.8
- TI-2020-10250 MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case. CVSS 3.1CRITICAL 9.8
- TI-2026-59159 MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding CVSS 4.0HIGH 8.7
- TI-2026-58541 MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials CVSS 4.0CRITICAL 9.5
Sources
- CVE-2026-103659 · CVE Program
- CVE-2026-103659 · NVD
- FIRST EPSS
- GHSA-r4v7-fgm4-552c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences