CVE-2026-85538

CVE-2026-85538 is an incorrect authorization flaw (CWE-863) in MISP, the open-source threat intelligence sharing platform, in which attribute deletion operations did not consistently enforce the platform's event-modification permission checks. It is triggered when an authenticated user who belongs to the organization owning an event requests deletion of one or more of that event's attributes: the affected code paths relied only on organization-membership checks in MispAttribute::deleteAttribute() instead of the ACL::canModifyEvent() authorization used for editing, so users lacking perm_modify or perm_modify_org could still delete attributes, including via bulk deletion. An attacker gains the ability to remove threat intelligence attributes from events they could not otherwise modify, causing unauthorized modification or loss of shared threat data (integrity impact; confidentiality is not directly affected). Any MISP deployment is potentially affected where users have accounts in an organization that owns events but whose assigned role lacks modify permissions; the available data does not specify affected version ranges. No public proof of concept, CISA KEV listing, or known in-the-wild exploitation is documented, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Upgrade to the patched MISP release that adds the common authorization check resolving associated events and verifying ACL::canModifyEvent() for all attribute deletion paths (individual and bulk); exact fixed version numbers are not specified in the available data, so track the project's security advisories for the release containing this fix. Until patched, audit role assignments for users in organizations that own shared events, review event and audit logs for unexpected attribute deletions, and consider restricting deletion endpoints to roles that hold perm_modify or perm_modify_org.