MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions
MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization (org-only distribution). It did not enforce the full thread access control list, including sharing-group membership and event-level visibility. As a result, an authenticated user who is outside the relevant sharing group or who does not have visibility on the associated event could: - Read the thread title and the content of the quoted post - Submit a new post into the discussion thread This constitutes both an information disclosure (reading restricted thread and post content) and an integrity issue (injecting content into a thread the user is not authorized to participate in). Affected: <2.5.48
CVE-2026-103858
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-103858
MISP
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"modules": [
"PostsController (discussion/thread posting)"
],
"product": "MISP",
"versions": [
{
"status": "affected",
"version": "unspecified",
"lessThan": "2.5.48",
"versionType": "semver"
}
],
"programFiles": [
"app/Controller/PostsController.php"
]
}
]- Related CVEs
- CVE-2026-103858
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #5306 · Revision 1
- Added to Heist Feed
- Publisher date