CVE-2026-85533

CVE-2026-85533 is a missing-authorization flaw (CWE-862) in MISP's handling of Sharing Groups during attribute (including attachment) and Galaxy Cluster creation and editing workflows. Because the Sharing Group authorization check ran only when a request explicitly set the distribution field to 4 (Sharing Group), an authenticated user with permission to create or edit these objects can omit or sidestep that parameter while supplying a sharing_group_id, skipping verification that they are allowed to use the referenced group. The attacker gains the ability to associate data with a Sharing Group they are not authorized to use, potentially placing or distributing that data to members of another Sharing Group and bypassing intended information-sharing boundaries. Any MISP deployment where non-administrator users can create or edit attributes/attachments or Galaxy Clusters is affected, which is common in multi-organization sharing communities; exact affected version numbers were not provided in the available data. No public proof-of-concept or in-the-wild exploitation is known, the flaw is not in CISA KEV, and EPSS currently estimates a 0.2% probability of exploitation within 30 days.

What to do: Upgrade MISP to the patched release containing the fix that routes every non-empty sharing_group_id through SharingGroup::canUse() and explicitly rejects empty identifiers (consult the official MISP changelog/security advisories for the exact version). Until patched, restrict attribute/attachment and Galaxy Cluster create/edit permissions to trusted users, and audit recent attribute and Galaxy Cluster edits for sharing_group_id values set without distribution=4 or by users not authorized for the referenced Sharing Group.