CVE-2026-56422: Software Security Vulnerability Vulnerability

CRITICAL
Advisory Identifier: GHSA-mf7v-x7r6-fq57
Share
CWE-639
Published
Advisory Summary

CVE-2026-56422 is a CRITICAL security vulnerability vulnerability (CWE-639: Authorization Bypass Through User-Controlled Key) affecting Software libraries in the Maven ecosystem. The weakness occurs when the system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.. Remediation is available in the latest vendor maintenance releases.

CVE-2026-56422 at a Glance

CVE Identifier CVE-2026-56422
GHSA Identifier GHSA-mf7v-x7r6-fq57
Severity CRITICAL
CVSS v3.1 Base Score N/A
CWE Classification CWE-639: Authorization Bypass Through User-Controlled Key
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-56422

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-56422, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key, where the system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Multiple MISP core controllers and model capture paths accepted client-controlled request fields such as primary keys (id) and ownership/scope foreign keys (event_id, org_id, user_id, sharing_group_id, galaxy_cluster_uuid, organisation_uuid, and related nested object identifiers) without consistently stripping, pinning, or revalidating them against the server-authorized object. In affected paths, an authenticated user with access to one authorized object could submit crafted REST or form payloads that caused MISP to save data against a different object than the one checked by the authorization logic. Depending on the endpoint, this could allow object overwrite, object re-parenting, ownership transfer, unauthorized sharing-group scoping, event/object injection, proposal retargeting, or stored attacker-controlled content appearing in another user’s context. The fixes harden affected create/edit/import flows by stripping client-supplied primary keys on create-only saves, re-pinning route- or database-authorized identifiers before save operations, validating effective sharing-group scope, and adding field whitelists where ownership fields must never be editable. The initial broad fix also added a central CRUDComponent::edit() primary-key re-pin so payload-supplied IDs cannot redirect saves away from the already-authorized row. GitHub’s patch for 7acf8220c describes this central issue as CRUDComponent::edit() copying supplied fields, including a payload primary key, onto the loaded record, allowing CakePHP save() to update an arbitrary row unless the loaded ID is re-pinned.

References

NVD — CVE-2026-56422 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56422
Security Fix Commit FIX COMMIT
https://github.com/MISP/MISP/commit/c80a3533b3d787f45f5185a4621cc0f05b0cf2e5
Security Fix Commit FIX COMMIT
https://github.com/MISP/MISP/commit/bc182d55dde5686a36ca2eb88fe6c2adabb9fad9
Security Fix Commit FIX COMMIT
https://github.com/MISP/MISP/commit/ab9619dfa6cb5210fd20fb3b0b57006e4fc93916
Security Fix Commit FIX COMMIT
https://github.com/MISP/MISP/commit/9341690e9b6dde7f0605edea5533e05ba7362e35
Security Fix Commit FIX COMMIT
https://github.com/MISP/MISP/commit/84bafe69f5d0ab7f811371c0801a613f271ebc0b
Security Fix Commit FIX COMMIT
https://github.com/MISP/MISP/commit/8311427c2edd72a8341f0a65e1f11073d7ad9191
Security Fix Commit FIX COMMIT
https://github.com/MISP/MISP/commit/7acf8220cafac58bcfb362da37aca512fe4bb396
Security Fix Commit FIX COMMIT
https://github.com/MISP/MISP/commit/63aebc27a878233b9475c742985aaef909bc755b
Security Fix Commit FIX COMMIT
https://github.com/MISP/MISP/commit/634f1f87c295193486c08c2c7ba1fee8a7339baa
Security Fix Commit FIX COMMIT
https://github.com/MISP/MISP/commit/58f637aaab4d133e72f1454ebb963191d96d3b78
Security Fix Commit FIX COMMIT
https://github.com/MISP/MISP/commit/57433015815e59db5a1f11536f90920952cf3fcd
Security Fix Commit FIX COMMIT
https://github.com/MISP/MISP/commit/3ff6bd9cfdab5d41b4667ea7298d88ffd6f3fcb8
Security Fix Commit FIX COMMIT
https://github.com/MISP/MISP/commit/2cc26f38f3e85c594957899f09043d5193146607
Security Fix Commit FIX COMMIT
https://github.com/MISP/MISP/commit/05aad418c57bb78e6b58a843d70d45de8f50db45
Security Fix Commit FIX COMMIT
https://github.com/MISP/MISP/commit/025f711506850aadb69cde1b57e5e5d57628c87f
Security Fix Commit FIX COMMIT
https://github.com/MISP/MISP/commit/00b2e3dae56fa24ea750eb525cc4709b7e5bee85

Frequently Asked Questions

What is CVE-2026-56422?
CVE-2026-56422 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-639: Authorization Bypass Through User-Controlled Key.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-56422?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-56422?
CVE-2026-56422 is classified under CWE-639: Authorization Bypass Through User-Controlled Key (The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.).
How can I check Maven dependencies for CVE-2026-56422?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-mf7v-x7r6-fq57",
  "modified" : "2026-06-22T12:32:02Z",
  "published" : "2026-06-22T12:32:02Z",
  "aliases" : [ "CVE-2026-56422" ],
  "details" : "Multiple MISP core controllers and model capture paths accepted client-controlled request fields such as primary keys (id) and ownership/scope foreign keys (event_id, org_id, user_id, sharing_group_id, galaxy_cluster_uuid, organisation_uuid, and related nested object identifiers) without consistently stripping, pinning, or revalidating them against the server-authorized object.\n\nIn affected paths, an authenticated user with access to one authorized object could submit crafted REST or form payloads that caused MISP to save data against a different object than the one checked by the authorization logic. Depending on the endpoint, this could allow object overwrite, object re-parenting, ownership transfer, unauthorized sharing-group scoping, event/object injection, proposal retargeting, or stored attacker-controlled content appearing in another user’s context.\n\nThe fixes harden affected create/edit/import flows by stripping client-supplied primary keys on create-only saves, re-pinning route- or database-authorized identifiers before save operations, validating effective sharing-group scope, and adding field whitelists where ownership fields must never be editable. The initial broad fix also added a central CRUDComponent::edit() primary-key re-pin so payload-supplied IDs cannot redirect saves away from the already-authorized row. GitHub’s patch for 7acf8220c describes this central issue as CRUDComponent::edit() copying supplied fields, including a payload primary key, onto the loaded record, allowing CakePHP save() to update an arbitrary row unless the loaded ID is re-pinned.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-56422"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MISP/MISP/commit/c80a3533b3d787f45f5185a4621cc0f05b0cf2e5"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MISP/MISP/commit/bc182d55dde5686a36ca2eb88fe6c2adabb9fad9"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MISP/MISP/commit/ab9619dfa6cb5210fd20fb3b0b57006e4fc93916"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MISP/MISP/commit/9341690e9b6dde7f0605edea5533e05ba7362e35"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MISP/MISP/commit/84bafe69f5d0ab7f811371c0801a613f271ebc0b"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MISP/MISP/commit/8311427c2edd72a8341f0a65e1f11073d7ad9191"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MISP/MISP/commit/7acf8220cafac58bcfb362da37aca512fe4bb396"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MISP/MISP/commit/63aebc27a878233b9475c742985aaef909bc755b"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MISP/MISP/commit/634f1f87c295193486c08c2c7ba1fee8a7339baa"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MISP/MISP/commit/58f637aaab4d133e72f1454ebb963191d96d3b78"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MISP/MISP/commit/57433015815e59db5a1f11536f90920952cf3fcd"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MISP/MISP/commit/3ff6bd9cfdab5d41b4667ea7298d88ffd6f3fcb8"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MISP/MISP/commit/2cc26f38f3e85c594957899f09043d5193146607"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MISP/MISP/commit/05aad418c57bb78e6b58a843d70d45de8f50db45"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MISP/MISP/commit/025f711506850aadb69cde1b57e5e5d57628c87f"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MISP/MISP/commit/00b2e3dae56fa24ea750eb525cc4709b7e5bee85"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-639" ],
    "severity" : "CRITICAL",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-06-22T12:16:26Z"
  }
}