CVE-2026-103858

Executive Summary

CVE-2026-103858 is an incomplete authorization check in the MISP threat intelligence platform affecting versions before 2.5.48. An authenticated user who is not a member of a thread’s sharing group, or who lacks visibility into the associated event, can read restricted discussion thread titles and quoted post content and can inject new posts into that thread. The vulnerability results in information disclosure of restricted discussions and integrity compromise of threaded discussions, with no public exploit or Nuclei template currently available.

Technical Analysis

The vulnerability class is CWE-285: Improper Authorization. According to the NVD description, MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization (org-only distribution). It did not enforce the full thread access control list, including sharing-group membership and event-level visibility.

This means the authorization decision was based on an incomplete condition: the application checked one attribute of the thread’s distribution (org-only restriction) but failed to evaluate the complete set of access controls that should govern thread access. The missing checks include:

• Sharing-group membership: A user outside the relevant sharing group should not be able to access or post to the thread.
• Event-level visibility: A user who does not have visibility on the associated event should not be able to access or post to the thread.

Because these checks are not enforced, an authenticated user can obtain read access to the thread title and the content of the quoted post, and can submit a new post into the discussion thread. The vulnerability is reachable through the discussion posting functionality, which is an authenticated feature. The attack surface is therefore the web interface/API endpoint that handles thread posting and replying. No specific function names, class names, URL endpoints, file paths, or API parameters are provided in the NVD description or CNA Title, so the exact code location cannot be stated without additional technical detail.

The impact is twofold: confidentiality loss (reading restricted thread and post content) and integrity loss (injecting content into a thread the user is not authorized to participate in). Availability is not directly affected. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N reflects a network-accessible flaw requiring low privileges (authenticated user) with no user interaction, causing low confidentiality and integrity impact. This vector is a reasonable representation based on the description; the official CVSS score is N/A.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class and the NVD description. No public PoC is available; the steps below describe the attack at the vulnerability-class level and avoid inventing specific implementation details.

1. Reconnaissance/target identification: An attacker with a valid, low-privileged account on a MISP instance identifies discussion threads that are restricted by sharing group or associated with events the attacker cannot normally view. The attacker may enumerate threads through the MISP UI or API, looking for thread identifiers or titles that are visible due to the missing authorization enforcement. Because the application only checked org-only distribution, threads that are restricted by sharing group or event visibility are candidates for abuse.

2. Triggering the specific flaw class: The attacker submits a post to a thread or replies to an existing post. The application performs an incomplete authorization check: it verifies whether the target thread is restricted to a single organization (org-only distribution) but does not enforce the full thread access control list, including sharing-group membership and event-level visibility. As a result, the request is accepted even though the attacker is outside the relevant sharing group or lacks visibility on the associated event.

3. Payload/execution method at the vulnerability-class level: The exploitation is performed through the normal authenticated discussion posting functionality. The attacker uses the same interface or API that legitimate users use to post or reply. No special payload is required; the “payload” is simply a post or reply submitted to the targeted thread. The missing authorization check allows the request to succeed. No specific endpoint names, parameters, or code patterns are provided in the source data, so they are not fabricated here.

4. Post-exploitation impact: After successful exploitation, the attacker can read the thread title and the content of the quoted post, and can submit new posts into the discussion thread. This constitutes information disclosure (reading restricted thread and post content) and an integrity issue (injecting content into a thread the user is not authorized to participate in). The attacker could use the disclosed information for further intelligence gathering or to post misleading or malicious content into restricted discussions, potentially influencing collaboration or decision-making within the MISP community.

Because no public PoC or exploit code is available, the attack chain is inferred from the vulnerability class and the NVD description. The attacker must be authenticated, and the target MISP instance must be network-accessible. No user interaction is required from a victim, and the attack can be performed programmatically if the discussion posting functionality is exposed via an API.

Impact Assessment

The vulnerability affects MISP instances running versions before 2.5.48. The blast radius is limited to authenticated users who can access the discussion posting functionality. An attacker with a low-privileged account can read restricted thread titles and quoted post content and inject posts into threads they are not authorized to access. This can lead to unauthorized disclosure of threat intelligence discussions and potentially sensitive context, as well as integrity compromise of the discussion record. In a threat intelligence sharing platform, unauthorized access to restricted discussions could expose indicators, attribution details, or operational security information that was intended only for a specific sharing group or event audience.

The CVSS subscores reflect low confidentiality and integrity impact, no availability impact, network attack vector, low attack complexity, low privileges required, and no user interaction. The scope is unchanged. The overall severity is likely moderate, but the exact score is N/A per the provided data. The EPSS score is not yet available from FIRST.org, and no CISA KEV entry exists. No public exploit or PoC is available, reducing the immediate likelihood of widespread exploitation, but the vulnerability is still relevant for organizations that run MISP and expose its discussion features to multiple sharing groups.

Detection Guidance

Sigma Rule

title: MISP Incomplete Authorization Check in Discussion Posting
id: 8f4b2c1a-9d3e-4f5a-8b7c-1e2d3f4a5b6c
status: experimental
description: Detects attempts to post to or read MISP discussion threads where the user may be outside the sharing group or lacks event visibility, exploiting CVE-2026-103858.
author: Threat Intelligence Team
date: 2026-01-01
logsource:
    category: web
    product: misp
detection:
    selection_post:
        http.method: 'POST'
        http.url|contains: '/threads'
    selection_reply:
        http.url|contains: '/posts'
    selection_status:
        http.status: 200
    condition: (selection_post or selection_reply) and selection_status
fields:
    - c-ip
    - cs-username
    - cs-uri-stem
    - sc-status
falsepositives:
    - Legitimate users posting to threads they are authorized to access.
level: medium
tags:
    - attack.t1190
    - cve.2026.103858

YARA Rule

rule CVE_2026_103858_MISP_Discussion_AuthBypass
{
    meta:
        description = "Detects indicators of CVE-2026-103858 exploitation in MISP discussion posting functionality"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103858"
        severity = "medium"

    strings:
        $s1 = "threads" ascii nocase
        $s2 = "posts" ascii nocase
        $s3 = "sharing_group" ascii nocase
        $s4 = "org_only" ascii nocase
        $s5 = "event_id" ascii nocase

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and
        any of ($s*) and
        filesize < 5MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103858 MISP Discussion Posting Authorization Bypass Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/threads"; http.uri; content:"/posts"; http.header; content:"MISP"; reference:cve,2026-103858; classtype:attempted-user; sid:10000001; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [network where network.protocol == "http" and http.request.method == "POST" and url.path : ("*threads*" or "*posts*")]
  [network where network.protocol == "http" and http.response.status_code == 200]

Splunk SPL Query

index=web sourcetype=misp_access
(http_method=POST (uri_path="*/threads*" OR uri_path="*/posts*"))
| eval risk_score=case(match(uri_path, "threads|posts"), 50, 0)
| where status=200
| stats count min(_time) as firstTime max(_time) as lastTime by src_ip, user, uri_path, status
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="misp,cve-2026-103858">
  <rule id="100001" level="8">
    <if_sid>31100</if_sid>
    <match>POST /threads</match>
    <description>Possible CVE-2026-103858 exploitation: unauthorized MISP discussion posting attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_103858,</group>
  </rule>
  <rule id="100002" level="8">
    <if_sid>31100</if_sid>
    <match>POST /posts</match>
    <description>Possible CVE-2026-103858 exploitation: unauthorized MISP discussion reply attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_103858,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict access to the MISP discussion posting functionality to trusted users only, if possible, by adjusting role permissions or network access controls.
   • Monitor MISP logs for unusual posting or reading activity involving threads that are restricted by sharing group or event visibility.
   • Apply temporary custom authorization checks at the reverse proxy or API gateway level to block requests that target restricted threads from users outside the sharing group, if such logic can be implemented without modifying MISP.
   • Limit the exposure of the MISP web interface to trusted networks and require strong authentication.

2. Patch/upgrade steps:

   • No official patch is available according to tracked sources. The NVD description suggests that affected versions are before 2.5.48, but no patch reference or vendor fix is provided.
   • Monitor the MISP project’s official channels for a security release that addresses this vulnerability. Once available, upgrade to the fixed version (likely 2.5.48 or later, subject to vendor confirmation).
   • Verify the integrity of the update and test in a staging environment before production deployment.

3. Long-term hardening:

   • Implement complete authorization checks for all discussion thread operations, ensuring that sharing-group membership and event-level visibility are enforced in addition to org-only distribution.
   • Adopt a centralized authorization framework or middleware that consistently applies access control policies across all endpoints.
   • Conduct regular security reviews and penetration tests focusing on authorization flaws in collaboration features.
   • Enable detailed audit logging for discussion thread access and posting, and integrate with SIEM for anomaly detection.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103858
• MISP Project: https://www.misp-project.org/
• CWE-285: https://cwe.mitre.org/data/definitions/285.html
• FIRST EPSS: https://www.first.org/epss/ (not yet scored)
• CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (no entry)