GCVE-1-2026-20244 (CVE-2026-103858)

Vulnerability from gna-1 – Published: 2026-10-01 11:31 – Updated: 2026-10-01 11:31
VLAI
Title
MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions
Summary
MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization (org-only distribution). It did not enforce the full thread access control list, including sharing-group membership and event-level visibility. As a result, an authenticated user who is outside the relevant sharing group or who does not have visibility on the associated event could: - Read the thread title and the content of the quoted post - Submit a new post into the discussion thread This constitutes both an information disclosure (reading restricted thread and post content) and an integrity issue (injecting content into a thread the user is not authorized to participate in). Affected: <2.5.48
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
Supplier · CNA (v2.0.3)
Decision recorded 2026-10-01 11:16 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
MISP MISP Affected: unspecified , < 2.5.48 (semver)
    cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Bastien Bossiroy and Célien Desteucq of NCIA iglocska Claude Opus 5.5 (1M context)
GCVE extensions
bcp-05-x-01
AI-assisted vulnerability information annotation
GCVE-BCP-05-X-01
Whole record AI-generated Human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
bcp-05-x-02
Patch-to-vulnerability generation provenance
GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-10-01 11:16
Model
qwen3.8:27b
Input
https://github.com/MISP/MISP/commit/79fbd4c75.patch 04551eba9b01…
Confidence
medium
Commit Subject Patch SHA-256
79fbd4c7580a fix: [security] Apply the thread ACL when posting to a 04551eba9b01…
Fix summary

The fix replaces the limited org-only distribution check with a call to the thread's full authorization method (checkIfAuthorised), which enforces the complete access control list including sharing groups and event-level visibility. The thread is only read after successful authorization, preventing disclosure of the title and content to unauthorized users. An additional null-check on the post's thread_id was added to prevent referencing posts without a valid thread association.

Patch summary

In PostsController.php add() method: (1) For the 'thread' target case, replaced the inline distribution==0 and org_id comparison with a call to Thread->checkIfAuthorised() before reading the thread; removed the separate _isSiteAdmin() bypass. (2) For the 'post' target case, added a check that the post has a non-empty thread_id, replaced the same limited distribution/org check with Thread->checkIfAuthorised(), and reordered the thread read to occur after the authorization check. Net: 8 insertions, 12 deletions in one file.

CVSS rationale

AV:N: web application accessible over network. AC:L: attacker only needs a valid thread_id or post_id, no race conditions or special timing. AT:N: no special attack prerequisites beyond authentication. PR:L: requires an authenticated MISP user account. UI:N: no victim interaction needed; the attacker directly issues the request. VC:L: attacker can read thread titles and quoted post content they should not see. VI:L: attacker can inject posts into unauthorized threads. VA:N: no availability impact. SC/SI/SA:N: no impact on subsequent components. The impact is bounded to the MISP instance's data and does not compromise the server or other systems.

Weakness rationale
  • CWE-285 The authorization check was present but incomplete: it only verified org-level distribution (distribution==0) and org_id match, failing to enforce sharing-group membership and event-level ACL. This is a classic case of insufficient authorization logic rather than a completely missing check, making CWE-285 more precise than CWE-862.
Attack pattern rationale
  • CAPEC-10 The attacker manipulates the target_id parameter (thread_id or post_id) in the posts/add request to reference a thread or post they do not have full access to. The incomplete server-side authorization check then permits the operation. CAPEC-10 is the closest available pattern for exploiting a server's failure to properly validate the authorization context of a user-supplied resource identifier. Uncertainty: no CAPEC specifically named 'Insecure Direct Object Reference' or 'Broken Access Control via Incomplete ACL' exists in the CAPEC catalog, so Parameter Tampering is the best available match.
Assumptions to verify
  • The exact affected version range is uncertain; the tag boundary v2.5.48 with 42 commits after the fix suggests the fix landed around or before v2.5.48, but the precise first-affected and first-fixed versions are not stated in the patch.
  • The checkIfAuthorised() method is assumed to enforce the full thread ACL including sharing groups and event visibility, based on the commit message description; the method's implementation is not included in the patch.
  • CAPEC-10 (Parameter Tampering) is the closest available CAPEC mapping; no CAPEC specifically covers 'incomplete authorization check on a direct object reference' was identified in the catalog.
  • The CVSS assumes the attacker already possesses a valid MISP account (PR:L); unauthenticated access is not indicated by the patch.
  • The AI co-author (Claude Opus 5.5) is credited as a tool rather than a person, per the Co-Authored-By line.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 7 11 medium 5
bcp-05-x-03
Vulnerability handling and disclosure timeline
GCVE-BCP-05-X-03
  1. 2026-09-23 13:27 UTC Fix developed Corrective change authored (79fbd4c7580adc0518581351c3d8c3d5b3ac7c97): fix: [security] Apply the thread ACL when posting to a
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "PostsController (discussion/thread posting)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/PostsController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "unspecified",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Bastien Bossiroy and C\u00e9lien Desteucq of NCIA"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization (org-only distribution). It did not enforce the full thread access control list, including sharing-group membership and event-level visibility.\u003c/p\u003e\u003cp\u003eAs a result, an authenticated user who is outside the relevant sharing group or who does not have visibility on the associated event could:\u003c/p\u003e\u003cp\u003e- Read the thread title and the content of the quoted post\u003c/p\u003e\u003cp\u003e- Submit a new post into the discussion thread\u003c/p\u003e\u003cp\u003eThis constitutes both an information disclosure (reading restricted thread and post content) and an integrity issue (injecting content into a thread the user is not authorized to participate in).\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48\u003c/p\u003e"
            }
          ],
          "value": "MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization (org-only distribution). It did not enforce the full thread access control list, including sharing-group membership and event-level visibility.\n\nAs a result, an authenticated user who is outside the relevant sharing group or who does not have visibility on the associated event could:\n\n- Read the thread title and the content of the quoted post\n\n- Submit a new post into the discussion thread\n\nThis constitutes both an information disclosure (reading restricted thread and post content) and an integrity issue (injecting content into a thread the user is not authorized to participate in).\n\nAffected: \u003c2.5.48"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-10",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-10 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-01T11:16:47Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/79fbd4c75"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix replaces the limited org-only distribution check with a call to the thread\u0027s full authorization method (checkIfAuthorised), which enforces the complete access control list including sharing groups and event-level visibility. The thread is only read after successful authorization, preventing disclosure of the title and content to unauthorized users. An additional null-check on the post\u0027s thread_id was added to prevent referencing posts without a valid thread association.\u003c/p\u003e"
            }
          ],
          "value": "The fix replaces the limited org-only distribution check with a call to the thread\u0027s full authorization method (checkIfAuthorised), which enforces the complete access control list including sharing groups and event-level visibility. The thread is only read after successful authorization, preventing disclosure of the title and content to unauthorized users. An additional null-check on the post\u0027s thread_id was added to prevent referencing posts without a valid thread association."
        }
      ],
      "title": "MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact affected version range is uncertain; the tag boundary v2.5.48 with 42 commits after the fix suggests the fix landed around or before v2.5.48, but the precise first-affected and first-fixed versions are not stated in the patch.",
                  "The checkIfAuthorised() method is assumed to enforce the full thread ACL including sharing groups and event visibility, based on the commit message description; the method\u0027s implementation is not included in the patch.",
                  "CAPEC-10 (Parameter Tampering) is the closest available CAPEC mapping; no CAPEC specifically covers \u0027incomplete authorization check on a direct object reference\u0027 was identified in the catalog.",
                  "The CVSS assumes the attacker already possesses a valid MISP account (PR:L); unauthenticated access is not indicated by the patch.",
                  "The AI co-author (Claude Opus 5.5) is credited as a tool rather than a person, per the Co-Authored-By line."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-10",
                    "rationale": "The attacker manipulates the target_id parameter (thread_id or post_id) in the posts/add request to reference a thread or post they do not have full access to. The incomplete server-side authorization check then permits the operation. CAPEC-10 is the closest available pattern for exploiting a server\u0027s failure to properly validate the authorization context of a user-supplied resource identifier. Uncertainty: no CAPEC specifically named \u0027Insecure Direct Object Reference\u0027 or \u0027Broken Access Control via Incomplete ACL\u0027 exists in the CAPEC catalog, so Parameter Tampering is the best available match."
                  }
                ],
                "commit": "79fbd4c7580adc0518581351c3d8c3d5b3ac7c97",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Bastien Bossiroy and C\u00e9lien Desteucq of NCIA"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: web application accessible over network. AC:L: attacker only needs a valid thread_id or post_id, no race conditions or special timing. AT:N: no special attack prerequisites beyond authentication. PR:L: requires an authenticated MISP user account. UI:N: no victim interaction needed; the attacker directly issues the request. VC:L: attacker can read thread titles and quoted post content they should not see. VI:L: attacker can inject posts into unauthorized threads. VA:N: no availability impact. SC/SI/SA:N: no impact on subsequent components. The impact is bounded to the MISP instance\u0027s data and does not compromise the server or other systems.",
                "fixSummary": "The fix replaces the limited org-only distribution check with a call to the thread\u0027s full authorization method (checkIfAuthorised), which enforces the complete access control list including sharing groups and event-level visibility. The thread is only read after successful authorization, preventing disclosure of the title and content to unauthorized users. An additional null-check on the post\u0027s thread_id was added to prevent referencing posts without a valid thread association.",
                "generatedAt": "2026-10-01T11:16:47.016611Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "04551eba9b017a1a2ccf05a79c21466f3fd7095a42750bd2704d57b2e3730938",
                "patchSummary": "In PostsController.php add() method: (1) For the \u0027thread\u0027 target case, replaced the inline distribution==0 and org_id comparison with a call to Thread-\u003echeckIfAuthorised() before reading the thread; removed the separate _isSiteAdmin() bypass. (2) For the \u0027post\u0027 target case, added a check that the post has a non-empty thread_id, replaced the same limited distribution/org check with Thread-\u003echeckIfAuthorised(), and reordered the thread read to occur after the authorization check. Net: 8 insertions, 12 deletions in one file.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "79fbd4c7580adc0518581351c3d8c3d5b3ac7c97",
                    "date": "Wed, 23 Sep 2026 15:27:08 +0200",
                    "patchSha256": "04551eba9b017a1a2ccf05a79c21466f3fd7095a42750bd2704d57b2e3730938",
                    "source": "https://github.com/MISP/MISP/commit/79fbd4c75.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/79fbd4c75.patch",
                    "subject": "fix: [security] Apply the thread ACL when posting to a"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/79fbd4c75.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-01T11:16:47Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [security] Apply the thread ACL when posting to a",
                "tagVersionBoundary": {
                  "commits_after_fix": 42,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-285",
                    "rationale": "The authorization check was present but incomplete: it only verified org-level distribution (distribution==0) and org_id match, failing to enforce sharing-group membership and event-level ACL. This is a classic case of insufficient authorization logic rather than a completely missing check, making CWE-285 more precise than CWE-862."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (79fbd4c7580adc0518581351c3d8c3d5b3ac7c97): fix: [security] Apply the thread ACL when posting to a",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/79fbd4c75.patch"
                    ],
                    "timestamp": "2026-09-23T13:27:08Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20244"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-103858",
    "datePublished": "2026-10-01T11:31:25.274200Z",
    "dateReserved": "2026-10-01T11:31:31.101Z",
    "dateUpdated": "2026-10-01T11:31:31.176439Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20244"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.