CVE-2026-95805: MISP ACL Configuration Auth Bypass Flaw

CVE-2026-95805 Overview

CVE-2026-95805 is an authorization flaw in MISP (Malware Information Sharing Platform) caused by a typo in the ACLComponent access control configuration. The Access Control List (ACL) rule for the previewEventAttributes action references the permission string theming_enabled* with a trailing asterisk instead of the correct theming_enabled. The malformed key does not match any valid permission identifier. Depending on how the ACL evaluation logic handles unknown identifiers, the flaw can either permit unauthorized users to reach the previewEventAttributes endpoint or deny access to legitimate users. The endpoint exposes event attribute data, so an authorization bypass could disclose sensitive indicator and attribute data. This weakness is categorized under CWE-285: Improper Authorization.

Critical Impact
An authenticated user could gain unauthorized read access to event attribute data exposed by the previewEventAttributes endpoint, disclosing sensitive threat indicators.

Affected Products

MISP (Malware Information Sharing Platform) prior to the fix commit 5ac8d1e4d
MISP app/Controller/Component/ACLComponent.php component
Deployments relying on theming_enabled permission gating for event previews

Discovery Timeline

2026-09-22 - CVE CVE-2026-95805 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95805

Vulnerability Analysis

MISP uses an ACL system defined in ACLComponent.php where each controller action is mapped to an array of permission identifiers that grant access. The array values determine which role or permission is required to reach a given action. For the previewEventAttributes action, the entry incorrectly reads ['theming_enabled*'] with an unintended trailing asterisk. The adjacent entry previewEventObjects uses the correct ['theming_enabled'], confirming the intended restriction.

Because theming_enabled* is not a valid permission identifier, the access control check for previewEventAttributes fails to evaluate against any real permission. Depending on how the ACL evaluator treats unknown identifiers, this may open the endpoint to users without the theming_enabled permission or block legitimate users entirely. The previewEventAttributes endpoint returns event attribute data, which typically includes indicators of compromise (IOCs) and other sensitive threat intelligence content.

Root Cause

The root cause is a single-character typo in a static configuration array within ACLComponent.php. The permission literal theming_enabled* does not resolve during ACL evaluation, breaking the intended authorization mapping.

Attack Vector

Exploitation requires network access to the MISP web interface and authenticated low-privilege credentials. An authenticated user sends an HTTP request to the previewEventAttributes endpoint. If the ACL evaluator fails open on unknown permission strings, the request returns event attribute data that the caller was not authorized to view.

php

// Source: https://github.com/MISP/MISP/commit/5ac8d1e4d
// app/Controller/Component/ACLComponent.php
            'index' => ['*'],
            'loadDefaultFeeds' => array(),
            'previewEvent' => ['*'],
-            'previewEventAttributes' => ['theming_enabled*'],
+            'previewEventAttributes' => ['theming_enabled'],
            'previewEventObjects' => ['theming_enabled'],
            'previewIndex' => ['*'],
            'searchCaches' => ['*'],

The patch removes the trailing asterisk so the ACL entry matches the valid theming_enabled permission, aligning previewEventAttributes with the sibling previewEventObjects entry.

Detection Methods for CVE-2026-95805

Indicators of Compromise

HTTP requests to /events/previewEventAttributes/* originating from accounts that lack the theming_enabled permission.
Unexpected access to event attribute previews by low-privilege user roles in MISP audit logs.
Repeated enumeration of event IDs against the previewEventAttributes endpoint from a single session.

Detection Strategies

Review the MISP audit_logs table for previewEventAttributes accesses and correlate the acting user's role permissions.
Grep the deployed ACLComponent.php for the string theming_enabled* to confirm whether the vulnerable configuration is present.
Compare production ACLComponent.php against the upstream file at commit 5ac8d1e4d to identify configuration drift.

Monitoring Recommendations

Enable and centralize MISP application logs, forwarding them to a SIEM for role-versus-endpoint correlation.
Alert on any previewEventAttributes request served with an HTTP 200 response for users whose role lacks theming_enabled.
Baseline expected access patterns to preview endpoints and flag deviations by user, source IP, and event ID range.

How to Mitigate CVE-2026-95805

Immediate Actions Required

Apply the upstream MISP fix from commit 5ac8d1e4d to app/Controller/Component/ACLComponent.php.
Audit which user roles hold the theming_enabled permission and revoke it from roles that should not preview event attributes.
Review recent access logs for the previewEventAttributes endpoint to identify any unauthorized data exposure.

Patch Information

The fix is published in the MISP repository. See the GitHub MISP Commit Update which corrects the ACL entry from theming_enabled* to theming_enabled. Operators should update to a MISP release that incorporates this commit or manually apply the one-line change and restart the web server.

Workarounds

Restrict network access to the MISP instance to trusted analyst networks or VPN users while the patch is being deployed.
Temporarily disable or firewall the previewEventAttributes route at the reverse proxy (for example, Apache or Nginx) until the patch is applied.
Reduce membership in any MISP role that grants broad authenticated access, minimizing the population of users who can reach the endpoint.

bash

# Nginx example: block the vulnerable endpoint until patched
location ~* ^/events/previewEventAttributes(/|$) {
    return 403;
}

# Verify the patched ACL entry after updating
grep -n "previewEventAttributes" app/Controller/Component/ACLComponent.php
# Expected output: 'previewEventAttributes' => ['theming_enabled'],