CVE-2026-61474

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-61474", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "state": "PUBLISHED", "assignerShortName": "CIRCL", "dateReserved": "2026-07-09T15:05:55.590Z", "datePublished": "2026-07-09T15:06:00.805Z", "dateUpdated": "2026-07-09T16:08:18.550Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "misp", "repo": "https://github.com/misp/misp", "vendor": "misp", "versions": [{"lessThanOrEqual": "2.5.42", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "Andras Iklody"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>An improper authorization check in MISP\u2019s attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a <code>sharing_group_id</code> without triggering the corresponding sharing group authorization check, as long as the attribute <code>distribution</code> value was not explicitly set to <code>4</code> \u2014 \u201csharing group\u201d.</p>\n<p>As a result, a user could reference or associate an attribute with a sharing group they were not authorized to use. This could lead to an access-control bypass affecting the integrity of attribute sharing metadata and potentially expose or misuse restricted sharing group relationships.</p>\n<p>The patch changes the authorization logic so that the sharing group permission check is performed whenever a non-empty <code>sharing_group_id</code> is provided, regardless of the selected distribution value.</p>\n<p><strong></strong></p><br>"}], "value": "An improper authorization check in MISP\u2019s attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharing_group_id without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly set to 4 \u2014 \u201csharing group\u201d.\n\n\nAs a result, a user could reference or associate an attribute with a sharing group they were not authorized to use. This could lead to an access-control bypass affecting the integrity of attribute sharing metadata and potentially expose or misuse restricted sharing group relationships.\n\n\nThe patch changes the authorization logic so that the sharing group permission check is performed whenever a non-empty sharing_group_id is provided, regardless of the selected distribution value."}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-07-09T15:06:00.805Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/df612166538e2979fae9f7eda88345ccc8fee761"}], "source": {"discovery": "UNKNOWN"}, "title": "MISP: Improper sharing group authorization check when adding attributes", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-09T16:08:10.715054Z", "id": "CVE-2026-61474", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T16:08:18.550Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-61474", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T16:08:10.715054Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T16:08:15.255Z"}}], "cna": {"title": "MISP: Improper sharing group authorization check when adding attributes", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Jeroen Pinoy"}, {"lang": "en", "type": "remediation developer", "value": "Andras Iklody"}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/misp/misp", "vendor": "misp", "product": "misp", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.5.42"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/MISP/MISP/commit/df612166538e2979fae9f7eda88345ccc8fee761", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "An improper authorization check in MISP\u2019s attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharing_group_id without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly set to 4 \u2014 \u201csharing group\u201d.\n\n\nAs a result, a user could reference or associate an attribute with a sharing group they were not authorized to use. This could lead to an access-control bypass affecting the integrity of attribute sharing metadata and potentially expose or misuse restricted sharing group relationships.\n\n\nThe patch changes the authorization logic so that the sharing group permission check is performed whenever a non-empty sharing_group_id is provided, regardless of the selected distribution value.", "supportingMedia": [{"type": "text/html", "value": "<p>An improper authorization check in MISP\u2019s attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a <code>sharing_group_id</code> without triggering the corresponding sharing group authorization check, as long as the attribute <code>distribution</code> value was not explicitly set to <code>4</code> \u2014 \u201csharing group\u201d.</p>\n<p>As a result, a user could reference or associate an attribute with a sharing group they were not authorized to use. This could lead to an access-control bypass affecting the integrity of attribute sharing metadata and potentially expose or misuse restricted sharing group relationships.</p>\n<p>The patch changes the authorization logic so that the sharing group permission check is performed whenever a non-empty <code>sharing_group_id</code> is provided, regardless of the selected distribution value.</p>\n<p><strong></strong></p><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-07-09T15:06:00.805Z"}}}, "cveMetadata": {"cveId": "CVE-2026-61474", "state": "PUBLISHED", "dateUpdated": "2026-07-09T16:08:18.550Z", "dateReserved": "2026-07-09T15:05:55.590Z", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "datePublished": "2026-07-09T15:06:00.805Z", "assignerShortName": "CIRCL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "misp", "repo": "https://github.com/misp/misp", "vendor": "misp", "versions": [{"lessThanOrEqual": "2.5.42", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper authorization check in MISP\u2019s attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharing_group_id without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly set to 4 \u2014 \u201csharing group\u201d.\n\n\nAs a result, a user could reference or associate an attribute with a sharing group they were not authorized to use. This could lead to an access-control bypass affecting the integrity of attribute sharing metadata and potentially expose or misuse restricted sharing group relationships.\n\n\nThe patch changes the authorization logic so that the sharing group permission check is performed whenever a non-empty sharing_group_id is provided, regardless of the selected distribution value."}], "id": "CVE-2026-61474", "lastModified": "2026-07-09T17:17:04.483", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61474", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-09T16:08:10.715054Z", "version": "2.0.3"}}]}, "published": "2026-07-09T16:16:49.250", "references": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "url": "https://github.com/MISP/MISP/commit/df612166538e2979fae9f7eda88345ccc8fee761"}], "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.5.42]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "misp", "source": "cna", "vendor": "misp"}, "product": "misp", "vendor": "misp"}], "created": "2026-07-09T16:30:05.885673+00:00", "updated": "2026-08-01T14:30:06.062036+00:00", "vendors": ["misp", "misp$PRODUCT$misp"]}