{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-112178", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "state": "PUBLISHED", "assignerShortName": "CIRCL", "dateReserved": "2026-10-19T08:50:50.711Z", "datePublished": "2026-10-19T08:50:52.402Z", "dateUpdated": "2026-10-19T08:50:52.402Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["ShadowAttribute (proposal/shadow attribute handling)"], "product": "MISP", "programFiles": ["app/Model/ShadowAttribute.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}, {"lang": "en", "type": "reporter", "value": "elhoim"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.</p><p>- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute's distribution level (levels 1-3 should restrict visibility)</p><p>- The owning organisation could not view proposals on its own org-only attributes</p><p>Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.</p><p>Affected: &lt;2.5.48</p>"}], "value": "MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.\n\n- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute's distribution level (levels 1-3 should restrict visibility)\n\n- The owning organisation could not view proposals on its own org-only attributes\n\nSecurity impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.\n\nAffected: <2.5.48"}], "impacts": [{"capecId": "CAPEC-2", "descriptions": [{"lang": "en", "value": "CAPEC-2 Parameter Tampering"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 7.1, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-19T08:49:14Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-10-19T08:50:52.402Z"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/9c5af321f"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix enforces the distribution level constraint in the sharing group access check, requiring distribution level 4 (All communities) for the sharing group test to apply. Additionally, the owning organisation is now explicitly granted access to proposals on its own attributes regardless of distribution level, correcting the over-restrictive behavior.</p>"}], "value": "The fix enforces the distribution level constraint in the sharing group access check, requiring distribution level 4 (All communities) for the sharing group test to apply. Additionally, the owning organisation is now explicitly granted access to proposals on its own attributes regardless of distribution level, correcting the over-restrictive behavior."}], "title": "MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The CAPEC mapping (CAPEC-2, Parameter Tampering) is the closest available match but is uncertain; the vulnerability is more accurately a missing authorization check (incomplete ACL evaluation) rather than active parameter manipulation by the attacker.", "The affected version boundary is inferred from the tag v2.5.48 and the commit position (35 commits after the fix); exact version boundaries are not explicitly stated in the patch metadata.", "The second aspect of the vulnerability (owner organisation denied access to its own proposals) is primarily a functional/availability defect rather than a security vulnerability, but is included as part of the same fix and the same root cause (incomplete ACL logic).", "CVSS PR:L assumes the attacker must be an authenticated MISP user with membership in a relevant sharing group; no evidence supports unauthenticated access.", "The Co-Authored-By line credits an AI assistant (Claude Opus 5.5) as a remediation developer; this is recorded as-is from the commit metadata."], "capecRationale": [{"capecId": "CAPEC-2", "rationale": "The user's sharing group membership (a parameter of their identity/session) was leveraged by the flawed authorization logic to grant access to proposals without the required distribution level check. This is the closest available CAPEC pattern; the user is not actively tampering with parameters, but the system improperly treats group membership as a sufficient access parameter without enforcing the additional distribution constraint. The mapping is uncertain because the vulnerability is more accurately a missing authorization check than active parameter manipulation."}], "commit": "9c5af321fe8f1d2209c8b3c35f4d570d47e9af9e", "confidence": "medium", "credits": [{"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}, {"lang": "en", "type": "reporter", "value": "elhoim"}], "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The user only needs to be a member of a sharing group; no special conditions or race conditions are required. AT:N: No active attack requirements beyond normal API usage. PR:L: The attacker must be an authenticated user with membership in a relevant sharing group. UI:N: No user interaction is required; the check is server-side. VC:H: The user can view proposals (proposed attribute changes) that should be restricted by distribution level, disclosing sensitive information about proposed changes. VI:N: No integrity impact; the user cannot modify proposals. VA:N: No availability impact. SC/SI/SA:N: No impact on subsequent components.", "fixSummary": "The fix enforces the distribution level constraint in the sharing group access check, requiring distribution level 4 (All communities) for the sharing group test to apply. Additionally, the owning organisation is now explicitly granted access to proposals on its own attributes regardless of distribution level, correcting the over-restrictive behavior.", "generatedAt": "2026-10-19T08:49:14.568262Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 5, "confidence": "medium", "model": "qwen3.8:27b", "score": 7}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "c50a0b040ef7da05d8dffbdc10599991ce441f3fe965e1025620e2e0581b7166", "patchSummary": "In the shadow attribute model's condition builder, the sharing group check for both objects and attributes now includes an AND condition requiring distribution = 4 alongside the sharing_group_id IN check. The attribute distribution condition was changed from a simple sharing_group_id IN clause to a compound AND condition with distribution = 4. A new OR condition (Event.org_id matching the user's org_id) was added to grant the owning organisation access to proposals on its own attributes.", "patchTruncated": false, "patches": [{"commit": "9c5af321fe8f1d2209c8b3c35f4d570d47e9af9e", "date": "Thu, 24 Sep 2026 16:23:08 +0200", "patchSha256": "c50a0b040ef7da05d8dffbdc10599991ce441f3fe965e1025620e2e0581b7166", "source": "https://github.com/MISP/MISP/commit/9c5af321f.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/9c5af321f.patch", "subject": "fix: [proposals] Apply the attribute ACL rules to proposals"}], "source": "https://github.com/MISP/MISP/commit/9c5af321f.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-19T08:49:14Z", "version": "2.0.3"}, "subject": "fix: [proposals] Apply the attribute ACL rules to proposals", "tagVersionBoundary": {"commits_after_fix": 35, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-862", "rationale": "The authorization check for proposal visibility was missing the distribution level constraint. The system evaluated sharing group membership as sufficient for access without also requiring the distribution level to be 4 (All communities), resulting in an incomplete authorization check that allowed access to proposals on more restrictively distributed attributes."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (9c5af321fe8f1d2209c8b3c35f4d570d47e9af9e): fix: [proposals] Apply the attribute ACL rules to proposals", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/9c5af321f.patch"], "timestamp": "2026-09-24T14:23:08Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20337"}]}}}

{}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["ShadowAttribute (proposal/shadow attribute handling)"], "product": "MISP", "programFiles": ["app/Model/ShadowAttribute.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.\n\n- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute's distribution level (levels 1-3 should restrict visibility)\n\n- The owning organisation could not view proposals on its own org-only attributes\n\nSecurity impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.\n\nAffected: <2.5.48"}], "id": "CVE-2026-112178", "lastModified": "2026-10-19T09:17:08.357", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}], "ssvcV203": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "ssvcData": {"options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "Supplier", "timestamp": "2026-10-19T08:49:14Z", "version": "2.0.3"}}]}, "published": "2026-10-19T09:17:08.240", "references": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "url": "https://github.com/MISP/MISP/commit/9c5af321f"}], "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}]}

{}

{}