CVE-2026-56423
Severity CVSS v4.0:
CRITICAL
Type:
Unavailable / Other
Publication date:
22/06/2026
Last modified:
23/06/2026
Description
MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authorized deletion using broad role-level permissions instead of validating authorization for each selected object.<br />
<br />
For Event Reports, EventReportsController::deleteSelection relied on the global perm_add capability rather than a per-report ownership/authorization check. As a result, a contributor-level user could submit report IDs or UUIDs for reports belonging to other organisations and hard-delete them instance-wide. The fix changed the callback to call EventReport::fetchIfAuthorized($user, $itemId, &#39;delete&#39;) for each selected report before deletion.<br />
<br />
<br />
<br />
<br />
For Sharing Groups, SharingGroupsController::deleteSelection relied on the global perm_sharing_group capability rather than verifying ownership of each selected sharing group. This allowed a sharing-group-capable user to hard-delete sharing groups owned by other organisations, bypassing the per-object ownership gate used by the single-object delete action. The fix changed the callback to call SharingGroup::checkIfOwner($user, $itemId) for each selected sharing group.<br />
<br />
<br />
<br />
<br />
An authenticated attacker with the relevant broad role permission could abuse the affected bulk deletion endpoints to delete objects outside their organisation’s authorization scope, causing loss of event-report content or sharing-group configuration across the instance.
Impact
Base Score 4.0
9.40
Severity 4.0
CRITICAL
Base Score 3.x
8.80
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:misp-project:misp:*:*:*:*:*:*:*:* | 2.5.42 (excluding) |
To consult the complete list of CPE names with products and versions, see this page