---
id: "CVE-2026-112178"
kind: "vulnerability"
aliases: ["CVE-2026-112178"]
title: "MISP: proposal visibility check ignores distribution level, exposing shadow attributes"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["misp", "package", "self-hosted", "threat-intel"]
not_affected_if: ["default-config"]
published_at: "2026-10-19T09:17:08+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T03:36:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112178", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# MISP: proposal visibility check ignores distribution level, exposing shadow attributes

MISP's check for who can view proposals (shadow attributes) on attributes and objects only looks at sharing groups and skips the distribution level. Users in a matching sharing group can read proposed changes that should be restricted to narrower distribution levels.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the MISP version with `cat /var/www/MISP/VERSION.json` or the About page in the web UI; versions below `2.5.48` are affected.
- Review whether MISP uses sharing groups with proposals enabled on attributes marked organisation-only or community-only.

## Fix

- Upgrade MISP to `2.5.48` or later.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112178

## From the sources

MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.

- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute's distribution level (levels 1-3 should restrict visibility)

- The owning organisation could not view proposals on its own org-only attributes

Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.

Affected: <2.5.48

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_