{"id":"CVE-2026-91825","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-91825","summary":"Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path.\n\n\nThe vulnerable logic checked whether the acting user could use a sharing_group_id…","details":"Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path.\n\n\nThe vulnerable logic checked whether the acting user could use a sharing_group_id only when the request explicitly supplied distribution = 4. If the attacker instead omitted distribution but supplied a different sharing_group_id, that authorization branch was skipped. Later, MISP’s field-recovery logic restored the existing event distribution from storage. For events already configured with sharing-group distribution, the unauthorized sharing-group ID could therefore be saved.\n\n\nThe fix adds authorization checks in both the controller and Event::_edit() whenever a non-empty sharing_group_id is supplied without distribution. The model now calls SharingGroup::checkIfAuthorised() before persisting the change.\n\n\n\nVersion affected: ≤2.5.45","published":"2026-09-15T09:16:45.540","modified":"2026-09-15T09:16:45.540","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/MISP/MISP/commit/cf3ee4026","label":"MISP/MISP@cf3ee40"},"references":[{"type":"WEB","url":"https://github.com/MISP/MISP/commit/cf3ee4026"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-09-15T09:16:45.540"}}