An authorization flaw in MISP allowed an authenticated user to submit a sharing_group_id without verifying that the user was authorized to use the… (CVE-2026-85533)

The vulnerability in MISP (CVE-2026-85533) is an authorization flaw where an authenticated user can submit a sharing_group_id without verifying authorization to use the referenced Sharing Group. Validation was only done when the distribution field was set to 4, allowing crafted requests to bypass this check by omitting or altering the distribution parameter. This enables unauthorized association of data with Sharing Groups, potentially violating information-sharing boundaries. The issue impacts attribute and Galaxy Cluster creation and editing workflows. The remediation centralizes authorization in SharingGroup::canUse() and enforces checks on any non-empty sharing_group_id regardless of distribution.

This flaw could allow users with limited permissions to associate data with Sharing Groups they are not authorized to use, potentially bypassing information-sharing boundaries and exposing data to unauthorized parties within other Sharing Groups. The impact is unauthorized data placement or distribution within the MISP platform, which could compromise confidentiality of shared threat intelligence.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves enforcing authorization checks on all non-empty sharing_group_id submissions regardless of the distribution parameter and centralizing authorization logic. Until an official fix is confirmed, restrict permissions to create or modify affected MISP objects to trusted users only and monitor for unusual sharing_group_id usage patterns.