CVE-2026-86347: MISP Authentication Bypass Vulnerability

CVE-2026-86347 Overview

CVE-2026-86347 is a broken access control vulnerability in MISP (Malware Information Sharing Platform) affecting versions ≤2.5.45. The Access Control List (ACL) entry for templates/uploadFile used the wildcard *, allowing any authenticated user to invoke TemplatesController::uploadFile(). This bypasses role restrictions applied to neighboring template-management endpoints. Low-privileged or read-only accounts can repeatedly upload files to app/tmp/files/ without holding perm_add or perm_template, consuming server disk space [CWE-400]. The upstream fix changes the required permission from * to perm_add.

Critical Impact
Any authenticated MISP user, including read-only accounts, can exhaust server disk space by repeatedly uploading files through an endpoint that should be restricted to users with template-management permissions.

Affected Products

MISP (misp-project) versions ≤2.5.45
Deployments exposing MISP to multiple authenticated user roles
Shared/community MISP instances with low-privileged accounts

Discovery Timeline

2026-09-07 - CVE-2026-86347 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86347

Vulnerability Analysis

MISP enforces per-controller and per-action authorization through the ACLComponent, which maps controller actions to required permissions. The entry for templates/uploadFile was declared with the wildcard *, meaning any authenticated session satisfied the check. Neighboring actions such as saveElementSorting and submitEventPopulation correctly required perm_template or perm_add.

The uploadFile handler accepts arbitrary content with only minimal validation and writes it into app/tmp/files/. Because the ACL check is permissive, a read-only user can call the endpoint repeatedly and grow the file store without bound. This is a classic resource exhaustion condition tracked as [CWE-400].

The upstream commit explicitly rules out stronger impacts. Uploaded files are assigned random names, so path traversal and predictable overwrite are not possible. The temporary directory sits outside the web root and files are not served over HTTP, ruling out stored cross-site scripting (XSS) or remote code execution (RCE) through this vector.

Root Cause

The root cause is an overly permissive ACL entry in app/Controller/Component/ACLComponent.php. The uploadFile action inherited the wildcard permission * instead of an action-appropriate grant such as perm_add.

Attack Vector

Exploitation requires only valid credentials to the MISP instance. An attacker authenticates, then issues repeated HTTP POST requests to the templates/uploadFile endpoint with arbitrary file content. Each request consumes disk space in app/tmp/files/ until the volume fills, degrading or halting MISP operations.

php

            'saveElementSorting' => array('perm_template'),
            'submitEventPopulation' => array('perm_add'),
            'templateChoices' => array('*'),
-            'uploadFile' => array('*'),
+            'uploadFile' => array('perm_add'),
            'view' => array('*'),
        ),
        'threads' => array(

Source: MISP commit 8e8885971 — the patch narrows the ACL requirement from the wildcard * to perm_add, aligning uploadFile with the permission model used by other template-management actions.

Detection Methods for CVE-2026-86347

Indicators of Compromise

Repeated HTTP POST requests to /templates/uploadFile originating from a single authenticated user session.
Rapid growth in the size or file count of the app/tmp/files/ directory on the MISP host.
Upload activity from accounts that do not hold perm_add or perm_template.

Detection Strategies

Review MISP application and web server access logs for high-frequency requests to the templates/uploadFile action.
Correlate upload events with the acting user's role to flag activity from read-only or low-privileged accounts.
Alert on anomalous file creation rates within app/tmp/files/ using file integrity monitoring or auditd rules.

Monitoring Recommendations

Track disk utilization on the MISP server partition hosting app/tmp/files/ and alert on rapid consumption.
Enable MISP audit logging for controller actions and forward events to a centralized log platform for retention and analysis.
Baseline normal upload volume per user role and alert on deviations that suggest abuse.

How to Mitigate CVE-2026-86347

Immediate Actions Required

Upgrade MISP to a version that includes commit 8e8885971, which restricts uploadFile to users with perm_add.
Audit user accounts and revoke unnecessary access, particularly for shared or community-facing instances.
Purge stale content from app/tmp/files/ and confirm sufficient free disk space on the hosting volume.

Patch Information

The fix is published in the MISP repository as commit 8e8885971, which updates app/Controller/Component/ACLComponent.php to require perm_add for the uploadFile action. See the MISP security commit for the full diff and apply the corresponding release for versions after 2.5.45.

Workarounds

Temporarily restrict network access to the MISP instance to trusted administrators until the patch is applied.
Apply the one-line ACL change from the upstream commit manually to ACLComponent.php if an immediate upgrade is not feasible.
Configure filesystem quotas or a dedicated volume for app/tmp/files/ to contain the impact of unbounded uploads.

bash

# Manual ACL hardening in app/Controller/Component/ACLComponent.php
sed -i "s/'uploadFile' => array('\*')/'uploadFile' => array('perm_add')/" \
    app/Controller/Component/ACLComponent.php

# Verify the change
grep -n "uploadFile" app/Controller/Component/ACLComponent.php