Live › vulnerability › CVE-2026-112178
Go to dashboardMISP's check for who can view proposals (shadow attributes) on attributes and objects only looks at sharing groups and skips the distribution level. Users in a matching sharing group can read proposed changes that should be restricted to narrower distribution levels.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any MISP instance running a version below 2.5.48 where teams use sharing groups and proposals (shadow attributes) on attributes with restricted distribution levels. Instances that do not use sharing groups or proposals are less exposed. Users who need to see proposals on their own org attributes are also affected by the second bug, which blocks owner access.
No product ranges from the sources yet.
cat /var/www/MISP/VERSION.json or the About page in the web UI; versions below 2.5.48 are affected.2.5.48 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.
A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute's distribution level (levels 1-3 should restrict visibility)
The owning organisation could not view proposals on its own org-only attributes
Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.
Affected: <2.5.48
This page as .md · .json · in your agent: get_signal("CVE-2026-112178")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.