CVE-2026-86342: MISP Authorization Bypass Vulnerability

CVE-2026-86342 Overview

CVE-2026-86342 is an improper authorization vulnerability in the Malware Information Sharing Platform (MISP) affecting versions ≤2.5.45. The freetext feed preview functionality performs correlation lookups against event attributes without applying the requesting user's access control list (ACL). Authenticated users can view restricted event correlations, feed metadata, and configured feed URLs they should not be able to access. The vulnerability is tracked under CWE-862: Missing Authorization.

Critical Impact
Authenticated MISP users with low privileges can obtain metadata about restricted events, cross-feed correlations, and internal feed URLs by abusing the freetext preview endpoint.

Affected Products

MISP versions ≤ 2.5.45
MISP feed correlation subsystem (app/Model/Feed.php)
MISP feeds controller (app/Controller/FeedsController.php)

Discovery Timeline

2026-09-07 - CVE-2026-86342 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86342

Vulnerability Analysis

The MISP freetext feed preview allows analysts to paste indicators and view correlations against known events and other feeds before ingestion. The preview code path executes attribute lookups scoped only by attribute value and deletion status. It bypasses MISP's normal event, organization, sharing-group, attribute, and object-level access controls.

A second defect resides in the cross-feed correlation query. The lookup enumerates every cached feed on the instance instead of restricting results to feeds visible to the caller. The response also includes the url field for each feed, even though the frontend never renders that value. A third issue affects the host-organization comparison in __canViewFeed, where a strict type comparison caused legitimate host-org members to be treated as outsiders.

Root Cause

The root cause is missing authorization enforcement across three code paths in the freetext preview feature. Attribute correlation queries did not receive the caller's user context. Feed enumeration queries were scoped only by Feed.id != without filtering on lookup_visible. The host-org check compared a database string against an integer using PHP's strict !== operator, causing the visibility carve-out to silently fail.

Attack Vector

An authenticated user with permission to preview a freetext feed submits attribute values through the preview endpoint. The server returns correlation matches drawn from events and feeds the user is not authorized to view. The attacker harvests event IDs, feed identifiers, provider names, and configured feed URLs from the JSON response.

php

// Patch: enforce host-org comparison as integers in __canViewFeed
// Source: https://github.com/MISP/MISP/commit/1fb622046
private function __canViewFeed($feed)
{
    $host_org_id = (int)Configure::read('MISP.host_org_id');
    // (int) on the session value too: it arrives from the database as a
    // string, so under strict !== the host-org carve-out could never
    // match and every host-org user was treated as an outsider.
    if (!$this->_isSiteAdmin() && (int)$this->Auth->user('org_id') !== $host_org_id && !$feed['Feed']['lookup_visible']) {
        return false;
    }
    return true;
}

php

// Patch: remove feed URL disclosure from freetext preview correlations
// Source: https://github.com/MISP/MISP/commit/4b6916086
$feeds = $this->find('all', array(
    'recursive' => -1,
    'conditions' => array('Feed.id !=' => $feedId),
    'fields' => array('id', 'name', 'provider', 'source_format')
));

Detection Methods for CVE-2026-86342

Indicators of Compromise

Unusual volume of requests to the freetext feed preview endpoint (/feeds/previewIndex or /feeds/previewFreetext) from non-administrative accounts.
REST API responses containing feed_correlations entries referencing feeds the calling user cannot list through the normal /feeds/index view.
Preview responses that include url values for feeds other than the one being previewed on unpatched instances.

Detection Strategies

Review MISP audit logs for calls to FeedsController::previewIndex and previewFreetext correlated with user roles lacking perm_site_admin or host-org membership.
Compare event IDs returned in preview correlations against the events each requesting user is authorized to view under their sharing-group memberships.
Alert on spikes in freetext preview traffic from single accounts, which may indicate scripted enumeration of the attribute space.

Monitoring Recommendations

Ingest MISP application logs and reverse-proxy access logs into a centralized SIEM for retention and correlation.
Track baseline freetext preview usage per user and flag deviations exceeding two standard deviations.
Monitor /feeds/* endpoints for authenticated but low-privileged access patterns, particularly outside normal analyst working hours.

How to Mitigate CVE-2026-86342

Immediate Actions Required

Upgrade MISP to a version above 2.5.45 that includes commits 1fb622046, 4b6916086, dc1a0f7c2, and dedb4b297.
Audit user accounts and remove freetext preview permissions from roles that do not require them.
Review recent freetext preview API activity for signs of enumeration by non-privileged users.

Patch Information

The MISP project addressed the issue in four commits: Commit 1fb622046 corrects the integer comparison in __canViewFeed. Commit 4b6916086 removes feed URL disclosure from correlation results. Commit dc1a0f7c2 scopes freetext preview feed correlations to the caller's ACL. Commit dedb4b297 applies the caller's ACL to attribute correlation searches.

Workarounds

Restrict the freetext preview permission to trusted analysts until the upgrade is applied.
Place a reverse proxy rule in front of /feeds/previewFreetext that limits access to specific roles or source networks.
Set Feed.lookup_visible explicitly to 0 on sensitive feeds to reduce exposure surface for non-host-org users.

bash

# Verify installed MISP version and apply upgrade
cd /var/www/MISP
sudo -u www-data git fetch --tags
sudo -u www-data git checkout v2.5.46
sudo -u www-data /var/www/MISP/app/Console/cake Admin runUpdates