CVE-2026-91851 Overview
CVE-2026-91851 affects Malware Information Sharing Platform (MISP) versions ≤2.5.45. The vulnerability lets low-privileged users view dashboard templates that should be restricted to holders of specific permission flags such as perm_site_admin. The flaw resides in DashboardsController::listTemplates(), where the restrict_to_permission_flag column is compared against integer 0 instead of a string. MySQL then coerces the varchar column numerically, and any non-numeric string (including perm_site_admin) evaluates to 0, satisfying the "unrestricted" branch. The result is a broken access control condition classified under [CWE-697] (Incorrect Comparison).
Critical Impact
Authenticated MISP users can enumerate and load dashboard templates restricted to privileged roles, exposing operational configuration intended only for site administrators.
Affected Products
- MISP versions ≤2.5.45
- app/Controller/DashboardsController.php component
- Deployments using MySQL/MariaDB backends where implicit type coercion applies
Discovery Timeline
- 2026-09-15 - CVE-2026-91851 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-91851
Vulnerability Analysis
The vulnerability originates in DashboardsController::listTemplates(), which builds a CakePHP find() conditions array to decide whether a dashboard template is visible to the current user. The intended logic permits a template when its restrict_to_permission_flag value matches one of the user's permission flags, or when the flag is unset. The unset case was implemented by comparing the column against the integer 0.
Because restrict_to_permission_flag is declared as varchar, MySQL applies numeric coercion during the comparison. Any non-numeric string resolves to 0, so predicates like 'perm_site_admin' = 0 evaluate TRUE. The "unrestricted" branch therefore matches every permission-restricted template, collapsing the access control check into a no-op.
Root Cause
The root cause is a type-mismatch comparison between a varchar column and an integer literal. MISP relied on strict equality semantics, but MySQL's implicit type conversion rules cause the string-to-integer coercion. Only the literal '' (column default) and '0' (posted by the save form) should be treated as unrestricted markers.
Attack Vector
Exploitation requires an authenticated MISP account with any role. The attacker requests the dashboard template listing endpoint, and the server returns templates gated by permission flags the user does not hold. No special payload or crafted input is required; the flawed SQL condition is triggered on every list operation.
['Dashboard.restrict_to_role_id' => $this->Auth->user('role_id')],
['Dashboard.restrict_to_role_id' => 0]
]],
+ // 'unrestricted' has to be matched as a STRING.
+ // restrict_to_permission_flag is a varchar, so
+ // comparing it against the integer 0 makes MySQL
+ // coerce the column: 'perm_site_admin' = 0 is TRUE,
+ // and the whole clause becomes a no-op. The two
+ // values that actually mean unrestricted are the
+ // column default '' and the '0' the save form
+ // posts - which is exactly what the !empty() test
+ // in Dashboard::getDashboardTemplate() accepts.
['OR' => [
['Dashboard.restrict_to_permission_flag' => $permission_flags],
- ['Dashboard.restrict_to_permission_flag' => 0]
+ ['Dashboard.restrict_to_permission_flag' => ['', '0']]
]]
]
]
Source: GitHub MISP Commit 245b8d63a
Detection Methods for CVE-2026-91851
Indicators of Compromise
- Access log entries showing non-admin users requesting dashboard template listing endpoints under /dashboards/.
- Unexpected rendering of dashboard widgets or templates tied to perm_site_admin or other privileged flags for standard users.
- Database queries containing predicates like restrict_to_permission_flag = 0 executed against the MISP schema.
Detection Strategies
- Review MISP application logs for template list requests correlated with user roles that lack the corresponding permission flag.
- Enable MySQL general query logging temporarily to identify comparisons of restrict_to_permission_flag against integer 0.
- Audit MISP instance versions across the environment and flag any deployment at or below 2.5.45.
Monitoring Recommendations
- Alert on privileged dashboard template identifiers appearing in responses to non-privileged accounts.
- Track anomalous increases in access to DashboardsController endpoints from newly created or low-privilege accounts.
- Integrate MISP audit logs into a centralized SIEM for correlation with role assignments.
How to Mitigate CVE-2026-91851
Immediate Actions Required
- Upgrade MISP to a version above 2.5.45 that includes commit 245b8d63a.
- Audit dashboard templates and confirm that restrict_to_permission_flag values are stored as expected strings.
- Review recent access to restricted dashboards and revoke any exposed operational data if warranted.
Patch Information
The fix is committed in the MISP repository at commit 245b8d63a. The patch replaces the integer comparison ['Dashboard.restrict_to_permission_flag' => 0] with a string set comparison ['Dashboard.restrict_to_permission_flag' => ['', '0']], matching the semantics of the !empty() check in Dashboard::getDashboardTemplate(). See the GitHub MISP Commit 245b8d63a for the full diff.
Workarounds
- Restrict access to the MISP dashboard functionality at the reverse proxy layer until the patch is applied.
- Manually update the affected condition in app/Controller/DashboardsController.php to compare against the string values '' and '0'.
- Reduce the number of dashboard templates that rely on restrict_to_permission_flag gating until the upgrade is completed.
# Apply the upstream patch directly on an affected instance
cd /var/www/MISP
sudo -u www-data git fetch origin
sudo -u www-data git cherry-pick 245b8d63a
sudo systemctl restart apache2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
