PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54398 misp CVE debrief

CVE-2026-54398 is a MEDIUM severity vulnerability in MISP, allowing an authenticated user to assign a MISP object or attributes to a sharing group without being authorized to use or view it. The flaw occurs due to incorrect sharing group validation when editing objects, enabling an attacker to potentially disclose non-visible sharing groups and modify distribution metadata.

Vendor
misp
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-12
Original CVE updated
2026-06-15
Advisory published
2026-06-12
Advisory updated
2026-06-15

Who should care

Users of MISP (Malware Information Sharing Platform) who have object editing permissions are potentially affected by this vulnerability.

Technical summary

The vulnerability arises from an authorization flaw in MISP's object add/edit handling. Specifically, when editing objects, the sharing group validation is performed against the wrong request data structure after object fields have been merged to the top level, causing the check to be bypassed. Additionally, attributes embedded in objects are not individually validated for authorized sharing group use. This allows an authenticated user with object editing permissions to assign a MISP object, or attributes contained within an object, to a sharing group that the user is not authorized to use or view.

Defensive priority

MEDIUM

Recommended defensive actions

  • Apply the patch referenced in [ref-4](https://github.com/MISP/MISP/commit/4fe48c523e66999d65f99fdec9508adb3aa1c0f3) to fix the authorization flaw.
  • Restrict object editing permissions to authorized users.
  • Monitor MISP instance for suspicious activity related to object and attribute sharing group modifications.

Evidence notes

The CVE-2026-54398 vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. The vulnerability was published and modified on June 12, 2026.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-54398 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-54398

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-54398 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54398

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/MISP/MISP/commit/4fe48c523e66999d65f99fdec9508adb3aa1c0f3

    5a6e4751-2f3f-4070-9419-94fb35b644e8

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.