CVE-2026-85533

An authorization flaw in MISP allowed an authenticated user to submit a sharing_group_id without verifying that the user was authorized to use the referenced Sharing Group. In several attribute and Galaxy Cluster creation and editing workflows, validation of the submitted Sharing Group was performed only when the request explicitly set the distribution field to 4 ("Sharing Group"). An attacker could therefore craft a request containing a sharing_group_id while omitting the distribution parameter, or otherwise avoiding the distribution == 4 condition, causing the Sharing Group authorization check to be skipped. This could allow a user with permission to create or modify the affected MISP objects to associate data with a Sharing Group that they are not authorized to use. Depending on the affected object's existing distribution settings and subsequent processing, this could bypass intended information-sharing boundaries and result in unauthorized placement or distribution of data to members of another Sharing Group. The issue affected attribute attachment and editing operations as well as Galaxy Cluster creation and editing. The fix ensures that authorization is performed whenever a non-empty sharing_group_id is submitted, independently of the distribution parameter. It also centralizes the authorization decision in SharingGroup::canUse() and explicitly rejects empty Sharing Group identifiers rather than allowing them to be interpreted as an unrestricted query.

• CWE-862

• https://github.com/MISP/MISP/commit/9b1363955

Published

Sep 4, 2026

Last Modified

Sep 8, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85528Improper input validation of the auto-configuration account …5.3
• CVE-2026-85529GitLab has remediated an issue in GitLab CE/EE affecting all…5.3
• CVE-2026-8553Use after free in GPU in Google Chrome prior to 148.0.7778.1…3.1
• CVE-2026-85530The GiveWP WordPress plugin before 4.16.8.1 does not consis…8.1
• CVE-2026-85531Improper verification of cryptographic signature vulnerabili…9.8
• CVE-2026-85532Apache WSS4J accepted attacker-controlled derived-key length…7.5
• CVE-2026-85534A flaw was found in libsoup. When a client sends an HTTP/2 r…5.9
• CVE-2026-85538An incorrect authorization vulnerability in MISP allowed aut…8.3
• CVE-2026-8554Type Confusion in ANGLE in Google Chrome on Windows prior to…3.1
• CVE-2026-85540DreamMaker developed by Interinfo has a SQL Injection vulner…8.8
• CVE-2026-85541DreamMaker developed by Interinfo has a Reflected Cross-site…5.4
• CVE-2026-85542IBM Guardium Data Protection 12.2 is affected by a command i…8.8