CVE-2026-56424: MISP Authorization Bypass Enabling Cross-Organization Data Tampering

Technical summary

CVE-2026-56424 encompasses five distinct broken access-control vulnerabilities across MISP's core authorization logic. The common pattern: write operations either validated permissions against a different entity than the target (ID confusion), or omitted ownership checks altogether on view-scope data. Affected subsystems include: (1) Event Reports tag removal, where the authorized report ID could differ from the target report, enabling cross-org tag stripping; (2) Collection Elements bulk deletion, which checked a collection whose ID matched the row ID rather than the actual parent collection; (3) Analyst Data capture/update, where nested updates bypassed canEditAnalystData ownership verification; (4) Template Elements editing, authorized against a template ID matching the element ID instead of the parent template; and (5) Decaying Model editing, which loaded models via view-scope queries without verifying edit rights. Each flaw requires the attacker to hold subsystem-specific permissions but not necessarily ownership of the target object.

Business impact

In threat intelligence operations, data integrity is foundational. These flaws allow competitor organizations or malicious insiders with legitimate MISP access to sabotage shared intelligence by deleting collections, corrupting analyst annotations, tampering with template definitions, or modifying threat decay models. This undermines trust in MISP deployments used for collaborative intelligence sharing, potentially causing security teams to waste resources investigating corrupted threat data or to lose confidence in shared indicators. For organizations operating multi-tenant MISP instances, the risk extends to accidental or intentional cross-customer data manipulation, with serious compliance and liability implications.

Affected systems

MISP (Malware Information Sharing Platform & Threat Sharing) in versions prior to the patched release. The vulnerability affects any MISP deployment where multiple organizations or user groups share the same instance and rely on role-based access controls to prevent cross-organization data modification. Organizations using MISP for internal threat intelligence only, or those with strict network isolation, face lower risk; shared and federated MISP deployments face critical risk.

Exploitability

Exploitation requires valid MISP authentication and the target subsystem's feature permission (e.g., permission to manage event reports, or to edit analyst data). No network traversal or privilege escalation is needed; attacks are straightforward HTTP requests that can be crafted manually or scripted. The CVSS score of 8.8 (HIGH) reflects easy network access, low complexity, and the requirement for low-level privileges—but also that the attacker must already possess credentials and basic permissions. The vulnerability is not in KEV as of publication; however, the straightforward attack surface and high integrity impact suggest rapid exploitation is likely once details are known.

Remediation

Apply the patched MISP version released for this CVE (verify against the official MISP project advisory for exact version numbers and release date). The patch restores proper ownership and entity checks across all five affected subsystems. Organizations unable to patch immediately should restrict MISP access to trusted users and implement network-level controls to limit who can reach the platform. Consider disabling high-risk features (bulk deletion, template editing) temporarily if feasible, and monitor authorization logs for suspicious cross-organization data modifications.

Patch guidance

Check the MISP project's official security advisory and release notes for the patched version. Apply patches to all MISP instances in your environment, including development and staging. Test the patch in a non-production environment first, especially if you rely on the affected features (event report tagging, bulk collection operations, analyst data annotations, template management, or decay model configuration). After patching, review recent audit logs to detect any unauthorized modifications during the vulnerability window.

Detection guidance

Monitor MISP audit and access logs for: (1) users from one organization creating, updating, or deleting objects owned by another organization; (2) bulk deletion operations followed by data inconsistencies; (3) analyst data or template changes without the corresponding edit permission recorded; (4) event report modifications by users without explicit report ownership. Enable MISP's audit trail if not already active. Consider SIEM ingestion of MISP logs to correlate suspicious modifications with user account anomalies or lateral movement. Validate data integrity in shared collections and templates post-incident by comparing against backups or external threat intel feeds.

Why prioritize this

HIGH priority because (1) the CVSS score is 8.8, reflecting high confidentiality, integrity, and availability impact; (2) exploitation is simple and requires only valid credentials, not privilege escalation or complex attack chains; (3) the flaw directly threatens the core trust model of collaborative threat intelligence sharing; (4) potential for widespread data corruption across an organization's entire MISP instance. Organizations with multi-tenant or federated MISP deployments should treat this as critical. Even single-tenant deployments should prioritize patching to mitigate insider threats and compartmentalization failures.

Risk score, explained

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a score of 8.8. Network-accessible attack vector and low attack complexity reflect that any authenticated user can exploit the flaw via simple HTTP requests. Low privilege requirement acknowledges that attackers need valid credentials and subsystem permissions, but not admin or organization-owner roles. The high impact on confidentiality, integrity, and availability stems from the ability to read, modify, or delete sensitive threat intelligence across organizational boundaries. Unchanged scope (S:U) indicates the impact is limited to the MISP application itself, not the broader system.

Frequently asked questions