CVE-2026-91846: MISP Information Disclosure Vulnerability

CVE-2026-91846 Overview

CVE-2026-91846 is an authorization flaw in MISP (Malware Information Sharing Platform) versions ≤2.5.45. Affected versions allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object. Because collection elements store only UUIDs, and the collection view later resolves those UUIDs into their underlying Events or Galaxy Clusters, an authenticated user could reference private objects belonging to another organisation. The flaw is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

Critical Impact
Authenticated users can reference and disclose organisation-only Events and Galaxy Clusters they are not permitted to read, breaking the tenant isolation model of shared MISP instances.

Affected Products

MISP versions ≤2.5.45
CollectionElementsController add() path
addElementToCollection() endpoint

Discovery Timeline

2026-09-15 - CVE-2026-91846 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91846

Vulnerability Analysis

MISP collections are container objects whose elements consist of bare UUIDs pointing at Events or Galaxy Clusters. The CollectionElement model never verified those UUIDs against the caller's Access Control List (ACL) on write. The read side, however, dereferenced the stored UUIDs to render full objects when the collection was viewed. This asymmetry let an authenticated user insert a UUID for an object they could not normally read, then retrieve the referenced data through the beta collection view. The upstream commit explicitly attributes disclosure of organisation-only events to this behavior.

Root Cause

The generic add() path and addElementToCollection() in app/Controller/CollectionElementsController.php persisted element UUIDs without invoking any authorization check. Neither CollectionElement::beforeValidate() nor the surrounding controller logic validated that the current user could fetch the referenced Event or Galaxy Cluster. The type field could also be omitted, causing type deduction to occur only at save time, which allowed callers to bypass any type-specific guard by simply leaving element_type blank.

Attack Vector

An authenticated low-privilege user submits a create request to the collection elements endpoint with a target UUID belonging to another organisation's private Event or Galaxy Cluster. The server persists the element without an ACL check. When the collection is later rendered, MISP resolves the UUID and returns the underlying object, disclosing organisation-restricted data to the attacker.

php

// Patch: centralized ACL enforcement in CollectionElementsController.php
// Source: https://github.com/MISP/MISP/commit/334d53709

/**
 * Authorise the objects a collection element points at.
 *
 * A collection element is a bare UUID that the model never checks against
 * the caller's ACL, and the read side resolves those UUIDs back into real
 * objects when the collection is rendered. Both write paths must therefore
 * refuse a UUID the caller cannot read - otherwise a collection is a
 * self-service handle on another organisation's private data, which is
 * what made the beta collection view disclose org-only events (V17).
 */
private function __assertCanUseElements($elementType, array $elementUuids)
{
    $user = $this->Auth->user();
    foreach ($elementUuids as $elementUuid) {
        $type = empty($elementType)
            ? $this->CollectionElement->deduceType($elementUuid)
            : $elementType;
        if ($type === 'Event') {
            // Event::fetchSimpleEvent() applies the current user's ACL
            // GalaxyCluster::fetchGalaxyClusters() enforces cluster ACL
        }
    }
}

Source: MISP Commit 334d53709. The patch centralizes authorization in __assertCanUseElements(), validating Event UUIDs through Event::fetchSimpleEvent() and Galaxy Cluster UUIDs through GalaxyCluster::fetchGalaxyClusters() under the current user's ACL. The guard is applied to both the CRUD add() path and addElementToCollection().

Detection Methods for CVE-2026-91846

Indicators of Compromise

Collection elements whose referenced Event or Galaxy Cluster org_id differs from the creating user's organisation.
Requests to /collection_elements/add or addElementToCollection containing UUIDs the caller has no prior read history for.
Beta collection view reads returning Events flagged distribution=0 (your organisation only) to non-owning users.

Detection Strategies

Audit the collection_elements table and cross-reference each element_uuid against the owning organisation of the underlying Event or Galaxy Cluster.
Review MISP application logs for CollectionElement create actions performed by users outside the target object's sharing group.
Correlate authenticated session identifiers with collection view responses to identify users retrieving objects they cannot fetch directly.

Monitoring Recommendations

Enable verbose MISP audit logging on CollectionElement write operations and forward to a centralized log platform.
Alert on any collection element creation where element_type is omitted from the request body.
Track anomalous spikes in collection view rendering that return objects marked with restricted distribution levels.

How to Mitigate CVE-2026-91846

Immediate Actions Required

Upgrade MISP to a version above 2.5.45 that contains commit 334d53709.
Restrict access to the collection elements endpoints to trusted users until patching is complete.
Review historical collection_elements records to identify unauthorized cross-organisation references and remove them.

Patch Information

The fix is delivered in MISP commit 334d53709. It introduces __assertCanUseElements() in CollectionElementsController.php, which validates each supplied UUID through Event::fetchSimpleEvent() or GalaxyCluster::fetchGalaxyClusters() under the acting user's ACL. The check applies to both the generic add() path and addElementToCollection(), closing the write-side authorization gap.

Workarounds

Disable the beta collection view feature on the MISP instance until the patch is applied.
Temporarily revoke the perm_add permission on collections for non-administrative roles.
Enforce role-based restrictions that limit collection element creation to synchronisation or administrator accounts.

bash

# Verify installed MISP version and apply the upstream patch
cat /var/www/MISP/VERSION.json
cd /var/www/MISP
sudo -u www-data git fetch origin
sudo -u www-data git cherry-pick 334d53709
sudo -u www-data /var/www/MISP/app/Console/cake Admin runUpdates