Exploitation observed; activity peaked at 4 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authorized deletion using broad role-level permissions instead of validating authorization for each selected object. For Event Reports, EventReportsController::deleteSelection relied on the global perm_add capability rather than a per-report ownership/authorization check. As a result, a contributor-level user could submit report IDs or UUIDs for reports belonging to other organisations and hard-delete them instance-wide. The fix changed the callback to call EventReport::fetchIfAuthorized($user, $itemId, 'delete') for each selected report before deletion. For Sharing Groups, SharingGroupsController::deleteSelection relied on the global perm_sharing_group capability rather than verifying ownership of each selected sharing group. This allowed a sharing-group-capable user to hard-delete sharing groups owned by other organisations, bypassing the per-object ownership gate used by the single-object delete action. The fix changed the callback to call SharingGroup::checkIfOwner($user, $itemId) for each selected sharing group. An authenticated attacker with the relevant broad role permission could abuse the affected bulk deletion endpoints to delete objects outside their organisation’s authorization scope, causing loss of event-report content or sharing-group configuration across the instance.
Priority
HIGH
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-22 | 4 | Disclosure4 |
| 2026-06-23 | 1 | Patch1 |
| 2026-07-06 | 1 | General1 |
⚠️ Vulnerabilidades en productos MISP ❗ CVE-2026-56447 ❗ CVE-2026-56423 ❗ CVE-2026-56422 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-misp/ https://t.co/VkJ11jLE4b
Post summary
A notice lists three CVEs affecting MISP products and provides a link for more information but supplies no additional technical or mitigation details.
Ep.676 - RadioCSIRT Édition Française - Flash info Au sommaire de cette édition : 🔐 GnuPG corrige la CVE-2026-57062 dans gpgsm : l'analyse du format CMS accepte une longueur ICV de quatre octets au lieu des douze attendus pour AES-GCM, affaiblissant le contrôle d'intégrité. GnuPG jusqu'à 2.5.20 est concerné, en lien avec la CVE-2026-34182. CVSS 3.1 à 2.9. (CVEFeed / MITRE) 🐧 Le noyau Linux 7.1 est publié par Linus Torvalds le 14 juin 2026 : nouveau pilote NTFS en espace noyau (iomap, folios), Intel FRED activé par défaut, contrôles Landlock étendus aux sockets UNIX et suppression de plus de 140 000 lignes de code hérité. (Linux Journal) 🚨 Les agences Five Eyes publient une déclaration commune le 22 juin 2026 sur la transformation du risque cyber par l'intelligence artificielle : réduction de la fenêtre entre découverte et exploitation, appel à traiter le risque comme un enjeu métier, priorité aux fondamentaux et intégration de l'IA dans la défense. (CISA) 🔓 MISP Core corrige la CVE-2026-56423 : un défaut de contrôle d'accès dans les suppressions en masse permettait à un utilisateur contributeur de supprimer définitivement des Event Reports et Sharing Groups d'autres organisations à l'échelle de l'instance. Exploitable à distance. CVSS 3.1 HIGH à 9.4, CVSS 4.0 CRITICAL. (CVEFeed / CIRCL) 🛡️ Le SANS ISC détaille les configurations SonicWall vulnérables après correctif de la CVE-2024-40766 (CVSS 9.3, exploitée par Akira et Fog depuis septembre 2024) : comptes locaux obsolètes, mots de passe non renouvelés, groupe LDAP par défaut trop permissif, portail Virtual Office exposé permettant un contournement MFA. La CVE-2024-12802 vise le contournement MFA sur les équipements Gen 6 en fin de vie. (SANS Internet Storm Center) Pour écouter l'épisode: https://www.radiocsirt.org/podcast/ep-676-radiocsirt-edition-francaise-flash-info-cybersecurite-du-mardi-23-juin-2026/
Post summary
The episode covers multiple CVEs, highlighting available patches for GnuPG and MISP, while also reporting active exploitation of SonicWall devices and outlining mitigation steps from SANS ISC.
🚨Critical - Two MISP Core Flaws: Broken Access Control in Bulk Deletion + rdkafka Config RCE (CVE-2026-56423, CVE-2026-56447) MISP Core, the open-source threat-intelligence sharing platform, was hit by two critical issues. CVE-2026-56423 is a broken access-control flaw in the bulk deletion (deleteSelection) flows for Event Reports and Sharing Groups: the handlers authorized deletion using broad role-level permissions instead of per-object ownership checks, so a contributor- or sharing-group-capable user could hard-delete reports and sharing groups belonging to other organisations instance-wide. CVE-2026-56447 is an arbitrary code execution flaw: an authenticated site admin could point the Kafka_rdkafka_config setting at an arbitrary INI file, and rdkafka options such as plugin.library.paths would load an external library, running code with the MISP process's privileges. An attacker could stage the malicious config in a MISP-writable location like an uploaded file. 👉Affected: MISP <= 2.5.41.
Post summary
The post informs about two critical CVEs in MISP Core—a broken access‑control vulnerability enabling cross‑organization deletions and an arbitrary code execution flaw via a writable rdkafka_config file—and provides technical details but does not mention a PoC, exploit, patch, or active exploitation.
CVE-2026-56423 Broken Access Control in MISP Core Bulk Deletion Flows for Event Reports and Sharing Groups https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-56423
Post summary
The text identifies CVE-2026-56423 as a broken access control issue in MISP Core bulk deletion flows, but provides no exploit details, PoC, or patch information.
🚨*CVE* CVE-2026-56423 MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authorized del… https://www.cve.org/CVERecord?id=CVE-2026-56423 ----- Traducción: CVE-2026-56423 MIS… http://infoflow.cloud`
Post summary
A tweet announces CVE‑2026‑56423, detailing broken access‑control in bulk deletion flows of MISP Core for event reports and sharing groups.
CVE-2026-56423 MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authorized del… https://www.cve.org/CVERecord?id=CVE-2026-56423
Post summary
The CVE is newly disclosed, describing broken access‑control in MISP Core's bulk deletion flows, with no proof of exploitation or mitigation indicated.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | misp-project | misp | - | - | - |