CVE-2026-54357

An improper authorization vulnerability in MISP allowed an authenticated organization administrator to access or modify user settings belonging to site administrator accounts within the same organization. The affected access-control checks scoped administrative actions by organization membership but did not exclude higher-privileged site administrator users. As a result, an organization administrator could potentially view or alter site administrator user settings and related login profile information, crossing the intended privilege boundary between organization administration and site-wide administration. The patch hardens the ACL logic by excluding site administrator accounts from organization administrator–managed user sets, adding explicit authorization failure when a target user is not administrable, and ensuring user setting and login profile operations fail closed.

• CWE-639
• CWE-863

• https://github.com/MISP/MISP/commit/ed3d9b862dea4c8c8e9b620a5ad99ce0c2c82154

Published

Jun 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54345gopacket provides packet processing capabilities for Go. In …7.5
• CVE-2026-5435The deprecated functions ns_printrrf, ns_printrr and fp_nque…7.3
• CVE-2026-54350Budibase is an open-source low-code platform. Prior to 3.39.…9.8
• CVE-2026-54351Budibase is an open-source low-code platform. Prior to 3.39.…9.6
• CVE-2026-54352Budibase is an open-source low-code platform. Prior to 3.39.…9.6
• CVE-2026-54353Budibase is an open-source low-code platform. Prior to 3.39.…7.1
• CVE-2026-54358An incorrect authorization vulnerability in MISP allows an o…7.5
• CVE-2026-54359MISP contains an insecure default configuration in which the…7.1
• CVE-2026-5436The MW WP Form plugin for WordPress is vulnerable to Arbitra…8.1
• CVE-2026-54360A mass assignment vulnerability exists in MISP’s sharing gro…8.4
• CVE-2026-54361MISP contained multiple mass assignment vulnerabilities in t…8.8
• CVE-2026-54362An incorrect visibility condition in the MISP event template…5.3