CVE-2026-88915

MISP versions up to and including 2.5.45 do not consistently enforce the acting user's authorization when instantiating event templates (CWE-862, missing authorization). An authenticated user who instantiates a template can cause an event to be created with a sharing group (distribution = 4) that the user is not actually permitted to use, because the template-supplied sharing_group_id is written directly into event creation without a SharingGroup::canUse() check. The same path also attaches template-specified tags without checking the user's tagging permissions and hardcodes local => 0, so tags marked local_only are attached globally and can propagate to other instances through synchronization or export, contrary to their intended restriction. An attacker gains unauthorized write access to event metadata (sharing-group assignments and tags), an integrity issue in shared threat intelligence rather than a confidentiality or availability problem. All MISP deployments running version 2.5.45 or earlier are affected; no public proof-of-concept is known and the flaw is not in CISA's Known Exploited Vulnerabilities catalog.

What to do: Upgrade MISP to any release later than 2.5.45, which adds SharingGroup::canUse() authorization for the acting user, applies normal tag-modification permission checks during template instantiation, and attaches local_only tags locally. Until patched, review events created via template instantiation for sharing-group assignments or globally attached tags that the creating users were not entitled to set, and check whether local_only tags have propagated to downstream instances via synchronization or export. Consider restricting which users may instantiate event templates as an interim mitigation.