CVE-2026-86283: MISP UiBeta Theme Auth Bypass Vulnerability

CVE-2026-86283 Overview

CVE-2026-86283 is an authorization bypass in the Malware Information Sharing Platform (MISP), affecting the UiBeta theme's collection view template at app/View/Themed/UiBeta/Collections/view.ctp. The template re-queried event details by UUID without applying the caller's access control list (ACL). An authenticated user with view access to a collection could retrieve event identifiers, info, dates, timestamps, creator organization, event tags, and galaxy clusters for events outside their authorization scope. This maps to Improper Authorization [CWE-285].

Critical Impact
Authenticated MISP users can perform horizontal privilege escalation to read restricted threat intelligence events through the UiBeta collection view.

Affected Products

MISP (Malware Information Sharing Platform) instances using the UiBeta theme
app/View/Themed/UiBeta/Collections/view.ctp template
MISP versions prior to commit 44573e4a8

Discovery Timeline

2026-09-06 - CVE-2026-86283 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86283

Vulnerability Analysis

The flaw resides in the UiBeta theme's collection view rendering path. CollectionsController::view() correctly resolves collection element UUIDs through Event::fetchSimpleEvents($user, ...), which enforces per-user event ACL. The view template then independently re-queried the same UUIDs using only an Event.uuid IN (...) condition. This second query omitted the createEventConditions() authorization filter that scopes results to events the caller is entitled to read.

Because collection element UUIDs are stored without server-side authorization against the referenced event, an attacker who owns a collection can attach arbitrary event UUIDs. Any authenticated user granted view access to that collection then triggers the unfiltered lookup and receives details for events they cannot otherwise access.

Root Cause

The presentation layer duplicated data retrieval logic without replicating the controller's authorization checks. CollectionElementsController::add() accepts whatever UUID the collection owner posts, treating element UUIDs as attacker-controlled input. Galaxy clusters were additionally attached via attachClustersToEventIndex(), which applies a cluster-scoped rather than event-scoped ACL check, compounding the exposure.

Attack Vector

An authenticated MISP user with permission to create collections adds arbitrary event UUIDs as collection elements. The attacker then shares the collection or leverages an existing collection viewable by another user. When the target loads the collection view, the server returns metadata for the referenced events regardless of that user's event-level ACL.

text

// Patch: app/View/Themed/UiBeta/Collections/view.ctp
     return $el['element_uuid'];
 }, $eventElements)));
 
-// Theme-local enrichment for creator org + tags + galaxies
+// Theme-local enrichment for creator org + tags + galaxies.
+//
+// The element UUIDs are attacker-supplied: CollectionElementsController::add()
+// stores whatever UUID the collection's owner posts without authorising it
+// against the referenced event, so this lookup must carry the caller's own
+// event ACL. CollectionsController::view() already resolves the same UUIDs
+// through Event::fetchSimpleEvents($user, ...); re-querying them here without
+// createEventConditions() handed back exactly the events the controller had
+// filtered out - event id, info, date, timestamp, creator org, every event tag
+// and, via attachClustersToEventIndex()'s cluster-scoped (not event-scoped)
+// ACL, the galaxy clusters attributing an event the caller cannot read.
 $eventDetailsByUuid = [];
-if (!empty($eventUuids)) {
+$_me = $this->get('me');
+if (!empty($eventUuids) && !empty($_me)) {
     $_eventModel = ClassRegistry::init('Event');
+    $_conditions = $_eventModel->createEventConditions($_me);
+    $_conditions['AND'][] = ['Event.uuid' => $eventUuids];
     $_events = $_eventModel->find('all', [
         'recursive' => -1,
-        'conditions' => ['Event.uuid' => $eventUuids],
+        'conditions' => $_conditions,
         'contain' => [
             'Orgc' => ['fields' => ['id', 'name', 'uuid']],
             'EventTag' => ['fields' => ['EventTag.event_id', 'EventTag.tag_id', 'EventTag.local', 'EventTag.relationship_type']]

Source: MISP commit 44573e4a8

Detection Methods for CVE-2026-86283

Indicators of Compromise

Unusual POST requests to /collection_elements/add containing event UUIDs the requesting user did not create or previously access.
Collection view (/collections/view/<id>) responses under the UiBeta theme referencing events the viewing user has no direct read entry for in the event ACL tables.
Sudden growth in collection elements owned by low-privilege accounts, particularly those referencing sensitive organization event UUIDs.

Detection Strategies

Audit MISP application logs and correlate Collection.view events against the Event ACL tables to identify accesses that bypass per-user restrictions.
Compare event UUIDs returned by the UiBeta collection view against results from Event::fetchSimpleEvents() for the same user; discrepancies indicate exploitation.
Review MySQL slow query or general query logs for Event.uuid IN (...) lookups originating from the collection view rendering path without accompanying ACL join conditions.

Monitoring Recommendations

Enable verbose MISP audit logging for Collections, CollectionElements, and Events controllers.
Alert on user accounts adding large numbers of external event UUIDs to collections in short time windows.
Monitor for cross-organization data access patterns where a user views events belonging to organizations they are not affiliated with.

How to Mitigate CVE-2026-86283

Immediate Actions Required

Update MISP to a release that includes commit 44573e4a8, which applies createEventConditions() to the UiBeta collection view enrichment query.
Temporarily disable the UiBeta theme instance-wide and revert users to the default theme until the patch is deployed.
Audit existing collections for unauthorized event UUID references and remove entries not owned by the collection creator's organization.

Patch Information

The fix is committed to the MISP repository as 44573e4a8, titled "fix: [security] Apply the caller's ACL to the beta collection view's event lookup." The patch resolves the current user via $this->get('me'), calls $_eventModel->createEventConditions($_me), and merges the ACL conditions with the Event.uuid IN (...) clause. Reference the MISP commit log for the full diff.

Workarounds

Disable the UiBeta theme by removing or renaming app/View/Themed/UiBeta until the patched version is installed.
Restrict collection creation and sharing privileges to trusted roles via MISP role permissions (perm_add, perm_publish).
Manually apply the ACL condition change from commit 44573e4a8 to view.ctp if an immediate upgrade is not feasible.

bash

# Verify the patched commit is present in a MISP deployment
cd /var/www/MISP
git log --oneline app/View/Themed/UiBeta/Collections/view.ctp | grep 44573e4a8

# Temporary mitigation: disable the UiBeta theme
sudo mv app/View/Themed/UiBeta app/View/Themed/UiBeta.disabled
sudo -u www-data ./app/Console/cake Admin setSetting "MISP.default_theme" "default"