CVE-2026-91825

MISP versions up to and including 2.5.45 contain a missing authorization flaw (CWE-862) in the event-edit path: the code only validated that the acting user may use a submitted sharing_group_id when the request explicitly set distribution = 4. An authenticated attacker could omit the distribution field while supplying a different sharing_group_id, skipping the authorization branch; MISP's field-recovery logic then restored the event's existing sharing-group distribution from storage, so the unauthorized sharing group ID was persisted. This allows a low-privileged user with edit rights on an event to reassign it to a sharing group they are not authorized to use, exposing or misrouting sensitive threat-intelligence data (high integrity impact, CVSS 4.0: 7.1). The fix adds authorization checks in both the controller and Event::_edit() whenever a non-empty sharing_group_id arrives without distribution, and the model now calls SharingGroup::checkIfAuthorised() before saving. No public proof-of-concept exists and the issue is not in the CISA KEV catalog; exploitation status is none known.

What to do: Upgrade to a MISP release newer than 2.5.45, where authorization checks in the controller, Event::_edit(), and SharingGroup::checkIfAuthorised() cover sharing_group_id changes made without an explicit distribution field. Until patched, audit recent event edits for sharing_group_id changes that bypass distribution=4 requests, and verify that events have not been reassigned to sharing groups their editors were not members of. Review sharing-group membership and event distribution settings for any unauthorized data exposure.