CVE-2026-103858

MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization (org-only distribution). It did not enforce the full thread access control list, including sharing-group membership and event-level visibility. As a result, an authenticated user who is outside the relevant sharing group or who does not have visibility on the associated event could: - Read the thread title and the content of the quoted post - Submit a new post into the discussion thread This constitutes both an information disclosure (reading restricted thread and post content) and an integrity issue (injecting content into a thread the user is not authorized to participate in). Affected: <2.5.48

• CWE-285

• https://github.com/MISP/MISP/commit/79fbd4c75

Published

Oct 1, 2026

Last Modified

Oct 1, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-103687A vulnerability has been found in rhukster dom-sanitizer up …7.3
• CVE-2026-1037IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2…6.1
• CVE-2026-103752Unauthenticated Privilege Escalation in Authorizer <= 3.15.3…9.8
• CVE-2026-103754A flaw was found in ansible-runner. The unstream_dir() funct…5.9
• CVE-2026-103757Budibase through 3.41.0 contains a server-side request forge…7.7
• CVE-2026-103758Obot 0.21.1 through 0.24.1 contains an authorization bypass …8.1
• CVE-2026-1042The WP Hello Bar plugin for WordPress is vulnerable to Store…4.4
• CVE-2026-10420Untrusted pointer dereference vulnerability in Samsung Open …5.5
• CVE-2026-1043The PostmarkApp Email Integrator plugin for WordPress is vul…4.4
• CVE-2026-1044The Tennis Court Bookings plugin for WordPress is vulnerable…4.4
• CVE-2026-1045The Viet contact plugin for WordPress is vulnerable to Store…4.4
• CVE-2026-1046Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to…6.5