CVE-2026-86451: MISP Authorization Bypass Vulnerability

CVE-2026-86451 Overview

CVE-2026-86451 is an Insecure Direct Object Reference (IDOR) vulnerability in MISP (Malware Information Sharing Platform) affecting versions ≤2.5.45. The flaw resides in the EventGraphTool::get_reference_data() function, which retrieves object-reference records by Universally Unique Identifier (UUID) without validating whether the requester is authorized to view the parent object. Any authenticated user who obtains or guesses a reference UUID can retrieve information tied to objects outside their normal access scope. The weakness is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated MISP users can access object-reference metadata belonging to events and objects they are not authorized to view, breaking the platform's access control boundaries for shared threat intelligence.

Affected Products

MISP versions ≤2.5.45
MISP Project distributions using the vulnerable EventGraphTool.php library
Any MISP deployment exposing the event graph reference endpoint to authenticated users

Discovery Timeline

2026-09-07 - CVE-2026-86451 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86451

Vulnerability Analysis

The vulnerability exists in app/Lib/Tools/EventGraphTool.php within the get_reference_data($uuid) method. The function accepts a UUID from an authenticated caller and queries the ObjectReference model directly using that UUID as the sole selection criterion. Because object_references.uuid is unique, the query returns exactly one row when the reference exists, and MISP returns that row regardless of whether the caller can access the parent object.

MISP typically enforces access control at the event and object level, restricting visibility based on organization, sharing group, and distribution settings. The get_reference_data() path bypassed this model entirely. The upstream commit note explicitly documents that any object reference could be returned by UUID without authorizing its parent object, which contradicts the ACL enforcement performed by ObjectReferencesController::view().

Root Cause

The root cause is a missing authorization check between reference lookup and response. The function trusted the UUID as an identifier without traversing the reference-to-object relationship to validate access. This is a textbook Insecure Direct Object Reference: the object identifier is user-controlled, and no server-side authorization decision is applied before returning data.

Attack Vector

An authenticated MISP user sends a request that reaches EventGraphTool::get_reference_data() with a known or discovered object-reference UUID. If the UUID exists in the database, MISP returns the reference row including fields such as relationship_type, comment, and referenced_uuid, even when the reference belongs to an event or object outside the user's sharing scope. Exploitation requires only low-privilege authenticated access over the network.

php

// Patch from app/Lib/Tools/EventGraphTool.php
public function get_reference_data($uuid)
{
    // object_references.uuid is unique, so this yields at most one row.
    $objectReference = $this->__refModel->ObjectReference->find('all', array(
        'conditions' => array('ObjectReference.uuid' => $uuid, 'ObjectReference.deleted' => false),
        'recursive' => -1,
    ));
    if (empty($objectReference)) {
        throw new NotFoundException('Invalid object reference');
    }
    // Authorise through the object the reference hangs off, exactly as
    // ObjectReferencesController::view() does. The full row is returned
    // once the caller is allowed to see that object: the sole consumer,
    // event-graph.js, reads object_id to build the edit popup.
    $object = $this->__refModel->fetchObjectSimple($this->__user, array(
        'conditions' => array('Object.id' => $objectReference[0]['ObjectReference']['object_id']),
    ));
    if (empty($object)) {
        throw new NotFoundException('Invalid object reference');
    }
    return $objectReference;
}

Source: MISP commit c0cb5c9f8. This patch adds the fetchObjectSimple() authorization call and raises NotFoundException when the current user cannot access the parent object.

Detection Methods for CVE-2026-86451

Indicators of Compromise

Web server access logs showing repeated requests to MISP event graph reference endpoints with varying UUID values from a single authenticated session.
MISP audit log entries where users retrieve object references tied to events outside their organization or sharing group.
Unusual API request volume from low-privilege user accounts targeting object-reference lookup routes.

Detection Strategies

Review MISP application logs for get_reference_data invocations correlated with the requesting user's assigned sharing scope.
Compare ObjectReference.uuid requests against the requesting user's authorized event list to identify cross-scope access.
Alert on high cardinality of unique object-reference UUIDs accessed by a single user account within a short time window.

Monitoring Recommendations

Enable MISP verbose audit logging and forward logs to a centralized Security Information and Event Management (SIEM) platform for correlation.
Baseline normal object-reference access patterns per user role and flag deviations for review.
Track failed authorization events after upgrading to the patched version; a spike in NotFoundException responses may indicate prior enumeration attempts.

How to Mitigate CVE-2026-86451

Immediate Actions Required

Upgrade MISP to a version later than 2.5.45 that includes commit c0cb5c9f8.
Audit user accounts and revoke unnecessary authenticated access to the MISP instance.
Review recent access logs for evidence of object-reference enumeration by non-privileged users.

Patch Information

The fix is delivered in MISP commit c0cb5c9f8. The patch calls fetchObjectSimple() with the current user context after loading the reference. When the user lacks access to the parent object identified by object_id, MISP returns NotFoundException instead of the reference payload. Administrators should apply the official upstream release containing this commit rather than backporting manually.

Workarounds

Restrict network access to the MISP instance to trusted analyst networks until patching is complete.
Temporarily disable or restrict access to event graph functionality for lower-trust user roles where feasible.
Rotate API keys for accounts that may have been used to enumerate object references prior to patching.

bash

# Upgrade MISP to a patched release containing commit c0cb5c9f8
cd /var/www/MISP
sudo -u www-data git fetch origin
sudo -u www-data git checkout v2.5.46
sudo -u www-data git log --oneline | grep c0cb5c9f8