Auth bypass in Misp
CVE-2026-54398
An authorization flaw in MISP’s object add/edit handling allowed an authenticated user with object editing permissions to assign a MISP object, or attributes contained within an object, to a sharing group that the user was not authorized t…
Vulnerability class: Broken Access Control
EPSS: 0.002 (12.6th percentile) — read the EPSS interpretation.
Affected products
- Misp — versions 0