https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 22:02:59 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-112178 <p>MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user&#39;s sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.</p> <p>- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute&#39;s distribution level (levels 1-3 should restrict visibility)</p> <p>- The owning organisation could not view proposals on its own org-only attributes</p> <p>Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.</p> <p>Affected: &lt;2.5.48</p> <p>MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user&#39;s sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.</p> <p>- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute&#39;s distribution level (levels 1-3 should restrict visibility)</p> <p>- The owning organisation could not view proposals on its own org-only attributes</p> <p>Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.</p> <p>Affected: &lt;2.5.48</p> https://db.gcve.eu/vuln/fkie_cve-2026-112178 https://db.gcve.eu/vuln/gcve-1-2026-20337 <p><strong>Affected:</strong> MISP</p> <p>MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user&#39;s sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.</p> <p>- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute&#39;s distribution level (levels 1-3 should restrict visibility)</p> <p>- The owning organisation could not view proposals on its own org-only attributes</p> <p>Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.</p> <p>Affected: &lt;2.5.48</p> <p><strong>Affected:</strong> MISP</p> <p>MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user&#39;s sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.</p> <p>- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute&#39;s distribution level (levels 1-3 should restrict visibility)</p> <p>- The owning organisation could not view proposals on its own org-only attributes</p> <p>Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.</p> <p>Affected: &lt;2.5.48</p> https://db.gcve.eu/vuln/gcve-1-2026-20337 https://db.gcve.eu/vuln/ghsa-9h3q-39v8-fmg5 <p>MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user&#39;s sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.</p> <p>- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute&#39;s distribution level (levels 1-3 should restrict visibility)</p> <p>- The owning organisation could not view proposals on its own org-only attributes</p> <p>Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.</p> <p>Affected: &lt;2.5.48</p> <p>MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user&#39;s sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.</p> <p>- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute&#39;s distribution level (levels 1-3 should restrict visibility)</p> <p>- The owning organisation could not view proposals on its own org-only attributes</p> <p>Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.</p> <p>Affected: &lt;2.5.48</p> https://db.gcve.eu/vuln/ghsa-9h3q-39v8-fmg5