Vulnerability-Lookup

GHSA-PRF9-8CGH-75PC

Vulnerability from github – Published: 2026-09-22 15:32 – Updated: 2026-09-22 15:32

Details

According to the commit message, this could lead to blueprint-based sharing group manipulation, meaning an attacker with SG editor access could alter organizational attributes in ways that influence how sharing groups and blueprints behave across the MISP instance.

The vulnerability requires an authenticated user with at least SG editor privileges and network access to the MISP web interface. The impact is primarily on the integrity of organization records and, potentially, on the integrity of sharing group configurations derived from those records.

Severity

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-95697"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-22T15:17:27Z",
    "severity": "MODERATE"
  },
  "details": "MISP contains an authorization flaw in the Organisation model\u0027s captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group (SG) editor role can trigger this code path, allowing them to modify organization metadata that should be restricted to site administrators or users with sync permissions.\n\nAccording to the commit message, this could lead to blueprint-based sharing group manipulation, meaning an attacker with SG editor access could alter organizational attributes in ways that influence how sharing groups and blueprints behave across the MISP instance.\u00a0\n\nThe vulnerability requires an authenticated user with at least SG editor privileges and network access to the MISP web interface. The impact is primarily on the integrity of organization records and, potentially, on the integrity of sharing group configurations derived from those records.",
  "id": "GHSA-prf9-8cgh-75pc",
  "modified": "2026-09-22T15:32:44Z",
  "published": "2026-09-22T15:32:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95697"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MISP/MISP/commit/f3ec974ee"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-95697 (GCVE-0-2026-95697)

Vulnerability from cvelistv5 – Published: 2026-09-22 14:31 – Updated: 2026-09-22 15:06

Title

MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata

Summary

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group (SG) editor role can trigger this code path, allowing them to modify organization metadata that should be restricted to site administrators or users with sync permissions. According to the commit message, this could lead to blueprint-based sharing group manipulation, meaning an attacker with SG editor access could alter organizational attributes in ways that influence how sharing groups and blueprints behave across the MISP instance. The vulnerability requires an authenticated user with at least SG editor privileges and network access to the MISP web interface. The impact is primarily on the integrity of organization records and, potentially, on the integrity of sharing group configurations derived from those records.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 15:06 UTC

CWE

CWE-862 - Missing Authorization

Assigner

CIRCL ENISA root

References

1 reference

URL	Tags
https://github.com/MISP/MISP/commit/f3ec974ee	patch

Impacted products

1 product

Vendor	Product	Version
MISP	MISP	Affected: 0 , < 2.5.47 (semver)

Credits

Jeroen Pinoy iglocska

GCVE extensions

AI-generated Human-reviewed Confidence: medium Model qwen3.8:27b advisory bcp-05-x-01bcp-05-x-02

AI involvement GCVE-BCP-05-X-01

Whole record AI-generated Human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification

Model	Source	Identifier
qwen3.8:27b	ollama	`qwen3.8:27b`

Patch provenance GCVE-BCP-05-X-02

Generator: patch2vuln.py on 2026-09-22 14:23
Model: qwen3.8:27b
Input: https://github.com/MISP/MISP/commit/f3ec974ee.patch 63108ba85f58…
Confidence: medium

Commit	Subject	Patch SHA-256
`f3ec974ee2d7`	fix: [security] overwrite of org metadata by sg editors	`63108ba85f58…`

Fix summary

The fix adds an authorization check to the captureOrg method so that the forced overwrite of organization metadata fields is only permitted when the invoking user holds either the site_admin permission or the sync permission. This ensures that low-privilege roles such as sharing group editors can no longer trigger the metadata overwrite path, closing the authorization gap.

Patch summary

In app/Model/Organisation.php, the condition guarding the forced overwrite of organization metadata fields (type, date_created, date_modified, nationality, sector, contacts) was changed from a simple 'if ($force)' check to 'if ($force && (!empty($user['Role']['perm_site_admin']) || !empty($user['Role']['perm_sync'])))'. This one-line change adds a role-based authorization requirement so that only site administrators or sync-permitted users can execute the metadata overwrite when $force is true.

CVSS rationale

AV:N: MISP is a network-accessible web application. AC:L: The attack requires only calling the existing captureOrg function with $force=true; no race conditions or complex bypasses are needed. AT:N: No user interaction or attack tooling beyond normal API usage is required. PR:L: The attacker needs an authenticated account with at least SG editor privileges, which is a low-privilege role in MISP. UI:N: No victim interaction is required. VC:N: No confidentiality impact is evident from the patch. VI:H: Organization metadata (type, nationality, sector, contacts, dates) can be arbitrarily modified, representing high integrity impact on the vulnerable component. VA:N: No availability impact. SC:N: No direct confidentiality impact on other systems. SI:H: The commit message explicitly notes the issue 'could lead to blueprint based SG manipulation,' indicating integrity impact extends to sharing group configurations in the broader MISP ecosystem. SA:N: No availability impact on other systems.

Weakness rationale

CWE-862 The captureOrg method performed a privileged operation (overwriting organization metadata) based solely on the $force flag without verifying that the authenticated user held the necessary permission (site_admin or sync). The authorization check was entirely absent for this code path, which is the definition of a missing authorization vulnerability.

Attack pattern rationale

CAPEC-100 The closest plausible CAPEC is Parameter Tampering: an authenticated user with a lower-privilege role (SG editor) invokes the captureOrg function with the $force parameter set to true, triggering a code path that was intended only for higher-privilege users. The user manipulates a function parameter to cause unintended privileged behavior. This mapping is approximate because the core issue is a missing authorization check rather than classic parameter tampering, but no CAPEC entry more precisely describes an authenticated user exploiting a missing permission gate via a boolean flag.

Assumptions to verify

The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.47, 139 commits after fix), suggesting the fix landed in or before v2.5.47. The exact first affected version is not specified in the patch.
The 'blueprint based SG manipulation' impact mentioned in the commit message is taken at face value for the SI:H rating; the patch itself only shows the org metadata overwrite fix and does not include code demonstrating the SG manipulation path.
CAPEC-100 (Parameter Tampering) is the closest available mapping; the vulnerability is more precisely a missing authorization check (CWE-862) than a classic parameter tampering scenario, but no CAPEC entry directly models 'authenticated user exploits missing permission gate via a boolean flag.'
The PR:L rating assumes that SG editor is a low-privilege role in MISP's permission hierarchy; the patch references perm_site_admin and perm_sync as the required higher-level permissions, implying SG editor is below that level.
No specific MISP version range is confirmed beyond the v2.5.47 tag boundary; earlier versions may or may not be affected depending on when the captureOrg method was introduced.

Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model	Score	Agreement	Confidence	Assumptions
`qwen3.8:27b`	5	9	medium	5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95697",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:06:23.172470Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:06:43.859Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "Organisation model (app/Model/Organisation.php)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Organisation.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains an authorization flaw in the Organisation model\u0027s captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group (SG) editor role can trigger this code path, allowing them to modify organization metadata that should be restricted to site administrators or users with sync permissions.\u003c/p\u003e\u003cp\u003eAccording to the commit message, this could lead to blueprint-based sharing group manipulation, meaning an attacker with SG editor access could alter organizational attributes in ways that influence how sharing groups and blueprints behave across the MISP instance.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThe vulnerability requires an authenticated user with at least SG editor privileges and network access to the MISP web interface. The impact is primarily on the integrity of organization records and, potentially, on the integrity of sharing group configurations derived from those records.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains an authorization flaw in the Organisation model\u0027s captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group (SG) editor role can trigger this code path, allowing them to modify organization metadata that should be restricted to site administrators or users with sync permissions.\n\nAccording to the commit message, this could lead to blueprint-based sharing group manipulation, meaning an attacker with SG editor access could alter organizational attributes in ways that influence how sharing groups and blueprints behave across the MISP instance.\u00a0\n\nThe vulnerability requires an authenticated user with at least SG editor privileges and network access to the MISP web interface. The impact is primarily on the integrity of organization records and, potentially, on the integrity of sharing group configurations derived from those records."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T14:31:25.876Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/f3ec974ee"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix adds an authorization check to the captureOrg method so that the forced overwrite of organization metadata fields is only permitted when the invoking user holds either the site_admin permission or the sync permission. This ensures that low-privilege roles such as sharing group editors can no longer trigger the metadata overwrite path, closing the authorization gap.\u003c/p\u003e"
            }
          ],
          "value": "The fix adds an authorization check to the captureOrg method so that the forced overwrite of organization metadata fields is only permitted when the invoking user holds either the site_admin permission or the sync permission. This ensures that low-privilege roles such as sharing group editors can no longer trigger the metadata overwrite path, closing the authorization gap."
        }
      ],
      "title": "MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.47, 139 commits after fix), suggesting the fix landed in or before v2.5.47. The exact first affected version is not specified in the patch.",
                  "The \u0027blueprint based SG manipulation\u0027 impact mentioned in the commit message is taken at face value for the SI:H rating; the patch itself only shows the org metadata overwrite fix and does not include code demonstrating the SG manipulation path.",
                  "CAPEC-100 (Parameter Tampering) is the closest available mapping; the vulnerability is more precisely a missing authorization check (CWE-862) than a classic parameter tampering scenario, but no CAPEC entry directly models \u0027authenticated user exploits missing permission gate via a boolean flag.\u0027",
                  "The PR:L rating assumes that SG editor is a low-privilege role in MISP\u0027s permission hierarchy; the patch references perm_site_admin and perm_sync as the required higher-level permissions, implying SG editor is below that level.",
                  "No specific MISP version range is confirmed beyond the v2.5.47 tag boundary; earlier versions may or may not be affected depending on when the captureOrg method was introduced."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-100",
                    "rationale": "The closest plausible CAPEC is Parameter Tampering: an authenticated user with a lower-privilege role (SG editor) invokes the captureOrg function with the $force parameter set to true, triggering a code path that was intended only for higher-privilege users. The user manipulates a function parameter to cause unintended privileged behavior. This mapping is approximate because the core issue is a missing authorization check rather than classic parameter tampering, but no CAPEC entry more precisely describes an authenticated user exploiting a missing permission gate via a boolean flag."
                  }
                ],
                "commit": "f3ec974ee2d72d77311dbb364c70f1aee83a58c2",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The attack requires only calling the existing captureOrg function with $force=true; no race conditions or complex bypasses are needed. AT:N: No user interaction or attack tooling beyond normal API usage is required. PR:L: The attacker needs an authenticated account with at least SG editor privileges, which is a low-privilege role in MISP. UI:N: No victim interaction is required. VC:N: No confidentiality impact is evident from the patch. VI:H: Organization metadata (type, nationality, sector, contacts, dates) can be arbitrarily modified, representing high integrity impact on the vulnerable component. VA:N: No availability impact. SC:N: No direct confidentiality impact on other systems. SI:H: The commit message explicitly notes the issue \u0027could lead to blueprint based SG manipulation,\u0027 indicating integrity impact extends to sharing group configurations in the broader MISP ecosystem. SA:N: No availability impact on other systems.",
                "fixSummary": "The fix adds an authorization check to the captureOrg method so that the forced overwrite of organization metadata fields is only permitted when the invoking user holds either the site_admin permission or the sync permission. This ensures that low-privilege roles such as sharing group editors can no longer trigger the metadata overwrite path, closing the authorization gap.",
                "generatedAt": "2026-09-22T14:23:51.691782Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "63108ba85f58bd5ec8318ea052879e536aaa83464f8ff4f90ef1d386913dc835",
                "patchSummary": "In app/Model/Organisation.php, the condition guarding the forced overwrite of organization metadata fields (type, date_created, date_modified, nationality, sector, contacts) was changed from a simple \u0027if ($force)\u0027 check to \u0027if ($force \u0026\u0026 (!empty($user[\u0027Role\u0027][\u0027perm_site_admin\u0027]) || !empty($user[\u0027Role\u0027][\u0027perm_sync\u0027])))\u0027. This one-line change adds a role-based authorization requirement so that only site administrators or sync-permitted users can execute the metadata overwrite when $force is true.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "f3ec974ee2d72d77311dbb364c70f1aee83a58c2",
                    "patchSha256": "63108ba85f58bd5ec8318ea052879e536aaa83464f8ff4f90ef1d386913dc835",
                    "source": "https://github.com/MISP/MISP/commit/f3ec974ee.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/f3ec974ee.patch",
                    "subject": "fix: [security] overwrite of org metadata by sg editors"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/f3ec974ee.patch",
                "subject": "fix: [security] overwrite of org metadata by sg editors",
                "tagVersionBoundary": {
                  "commits_after_fix": 139,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The captureOrg method performed a privileged operation (overwriting organization metadata) based solely on the $force flag without verifying that the authenticated user held the necessary permission (site_admin or sync). The authorization check was entirely absent for this code path, which is the definition of a missing authorization vulnerability."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20182"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-95697",
    "datePublished": "2026-09-22T14:31:25.876Z",
    "dateReserved": "2026-09-22T14:31:23.351Z",
    "dateUpdated": "2026-09-22T15:06:43.859Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-PRF9-8CGH-75PC

CVE-2026-95697 (GCVE-0-2026-95697)

Fix summary

Patch summary

CVSS rationale

Weakness rationale

Attack pattern rationale

Assumptions to verify

Model comparison

Tags

Sightings

Nomenclature

Related by attack behaviour