CVE-2026-54360: MISP sharing group creation mass assignment allows unauthorized takeover of existing sharing groups

Synopsis

A mass assignment vulnerability in MISP's sharing group creation endpoint allows an authenticated attacker to overwrite existing sharing groups they do not have permission to edit. The flaw is reachable over the network with only a low-privilege account and requires no victim interaction. Successful exploitation lets the attacker take over or alter sharing groups, leaking membership and threat-intel data shared through those groups and corrupting their configuration. A patched-image rebuild at version 2.5.40 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the MISP instance via HTTP/HTTPS.

• AuthenticationRequired

  Any low-privilege account with permission to create sharing groups is sufficient to exploit this vulnerability; no admin credentials are needed.

• Victim interactionNot required

  The attacker submits a crafted request directly; no other user needs to take any action for exploitation to succeed.

• Attack complexityDetail

  Exploitation is reliable and condition-free: the attacker simply supplies a target sharing group ID in the creation payload, with no race conditions or environment-specific factors required.

Blast Radius

• Reads the membership list and threat-intelligence content of sharing groups the attacker does not have legitimate access to.
• Overwrites the configuration of an existing sharing group, redirecting or restricting the flow of shared threat-intel data across organizations.
• Corrupts trust relationships between MISP instances by altering which organizations are included in a sharing group without authorization.