An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required… (CVE-2026-85538)

MISP contains an incorrect authorization vulnerability (CVE-2026-85538) where authenticated users can delete attributes from events despite lacking the perm_modify or perm_modify_org permissions. The affected deletion paths rely on organization membership checks but fail to enforce MISP's event modification authorization consistently. While attribute editing uses MISP's ACL::canModifyEvent() logic, deletion operations bypass this, allowing users with organization membership but insufficient roles to remove attributes individually or in bulk. The patch introduces a unified authorization check that verifies user permissions against the event modification rules before allowing attribute deletion.

Authenticated users with membership in the organization associated with an event can delete attributes from that event without proper authorization. This can lead to unauthorized modification or loss of critical threat intelligence data within MISP, potentially impacting the integrity and reliability of shared security information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has introduced a patch that enforces consistent authorization checks for attribute deletion by verifying user permissions using the same mechanism as event and attribute modification. Until the patch is applied, restrict user roles and monitor for unauthorized attribute deletions.