CVE-2026-94394: MISP Information Disclosure Vulnerability

CVE-2026-94394 Overview

CVE-2026-94394 is a broken access control vulnerability in MISP (Malware Information Sharing Platform). When an authenticated user adds a reference between objects or attributes, MISP validates access to the parent event but does not consistently verify authorization for the individual attributes or objects being referenced. This gap allows a non-administrator with legitimate access to an event to enumerate or view attribute and object data restricted by sharing group or distribution level. The flaw is tracked as a Missing Authorization issue [CWE-862].

Critical Impact
Authenticated MISP users can access attribute values, object details, and related object data that should be restricted by sharing group or distribution controls within an event they can already view.

Affected Products

MISP (Malware Information Sharing Platform) prior to the fix in commit f36634e57
The ObjectReferencesController component handling reference creation between objects and attributes
Deployments where non-site-admin users share events containing mixed distribution levels

Discovery Timeline

2026-09-21 - CVE-2026-94394 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94394

Vulnerability Analysis

MISP allows users to link attributes and objects within an event through object references. The ObjectReferencesController::add action verified that the requesting user could access the containing event but did not re-check the distribution or sharing-group constraints of the referenced attribute or object. A user with event-level access could therefore submit reference operations targeting attributes or objects whose distribution level (sharing_group_id distribution 4, or other restricted distributions) should have excluded them.

The result is unauthorized disclosure of sensitive threat intelligence values, including attribute contents and related object metadata, without triggering integrity or availability impacts.

Root Cause

The root cause is missing per-record authorization checks in the object reference workflow. The code enforced coarse-grained event access but never applied the distribution filters (Attribute.distribution values 1, 2, 3, 5 or distribution 4 gated by authorized sharing group IDs) to the individual Attribute and Object records participating in the reference. This is a classic Missing Authorization pattern [CWE-862].

Attack Vector

An authenticated, low-privileged MISP user who already has access to an event containing mixed-distribution data crafts a reference-creation request naming a restricted attribute or object. Because the controller only validates event access, the request returns data the user should not see. Exploitation requires only standard MISP user privileges and network access to the web interface.

php

// Security patch in app/Controller/ObjectReferencesController.php
// Adds granular distribution and sharing-group checks for non-site-admins
                return $this->RestResponse->describe('ObjectReferences', 'add', false, $this->response->type());
            }

+            $user = $this->Auth->user();
+            $attributeConditions = array('Attribute.deleted' => 0, 'Attribute.object_id' => 0);
+            $objectConditions = array('NOT' => array('Object.id' => $object['Object']['id']), 'Object.deleted' => 0);
+            $objectAttributeConditions = array('Attribute.deleted' => 0);
+            if (empty($user['Role']['perm_site_admin'])) {
+                $ownEventId = (int)$object['Event']['id'];
+                $sgids = $this->ObjectReference->Object->SharingGroup->authorizedIds($user);
+                $attributeConditions[] = array(
+                    'OR' => array(
+                        'Attribute.event_id' => $ownEventId,
+                        'Attribute.distribution' => array(1, 2, 3, 5),
+                        array('Attribute.distribution' => 4, 'Attribute.sharing_group_id' => $sgids),
+                    )
+                );
+                $objectConditions[] = array(
+                    'OR' => array(
+                        'Object.event_id' => $ownEventId,
+                        'Object.distribution' => array(1, 2, 3, 5),
+                        array('Object.distribution' => 4, 'Object.sharing_group_id' => $sgids),
+                    )
+                );
+                $objectAttributeConditions[] = array(
+                    'OR' => array(
+                        'Attribute.event_id' => $ownEventId,
+                        'Attribute.distribution' => array(1, 2, 3, 5),
+                        array('Attribute.distribution' => 4, 'Attribute.sharing_group_id' => $sgids),
+                    )
// Source: https://github.com/MISP/MISP/commit/f36634e57

The patch injects explicit conditions requiring the target Attribute or Object to belong to the user's own event, use an unrestricted distribution level, or match a sharing group the user is authorized to access.

Detection Methods for CVE-2026-94394

Indicators of Compromise

Unexpected POST requests to /objectReferences/add from non-admin accounts targeting attributes or objects outside the user's normal sharing groups.
Application audit log entries showing successful object reference creation involving Attribute or Object records whose sharing_group_id differs from the requesting user's authorized sharing groups.
Access log entries where the same user account creates references across many events in a short time window, suggesting enumeration.

Detection Strategies

Correlate MISP audit logs for ObjectReference.add actions with the user's sharing group membership and flag any mismatch.
Baseline normal reference-creation volume per user and alert on statistical deviations.
Review MISP API access tokens for accounts issuing reference operations outside expected workflows.

Monitoring Recommendations

Forward MISP web server and application audit logs to a centralized analytics platform for continuous review.
Enable verbose audit logging for ObjectReferencesController actions and retain logs for post-incident analysis.
Monitor for privilege changes and new API key creation on MISP user accounts.

How to Mitigate CVE-2026-94394

Immediate Actions Required

Upgrade MISP to the release containing commit f36634e57 or apply the patch directly to app/Controller/ObjectReferencesController.php.
Audit existing object references for records that violate distribution or sharing group rules and remove unauthorized links.
Review recent activity from non-site-admin accounts for signs of enumeration through the reference endpoint.

Patch Information

The fix is available in MISP upstream via GitHub MISP Commit f36634e57. It adds explicit distribution and sharing-group conditions to attribute and object queries within ObjectReferencesController for users lacking the perm_site_admin role. Apply the patched version and restart the MISP web workers.

Workarounds

Temporarily restrict the perm_add or object reference permissions on non-trusted user roles until patching is complete.
Segregate highly sensitive intelligence into dedicated events that only trusted users can access, reducing exposure through shared events.
Increase audit logging and manually review object reference creations pending deployment of the fix.

bash

# Apply the upstream patch to a MISP deployment
cd /var/www/MISP
sudo -u www-data git fetch origin
sudo -u www-data git cherry-pick f36634e57
sudo systemctl restart apache2
sudo -u www-data /var/www/MISP/app/Console/cake Admin runUpdates