CVE-2026-86283
Received Received - Intake

Authorization Bypass in MISP UiBeta Theme Collections

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: CIRCL

Description
MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query of member events by UUID without applying the caller's access control list (ACL). The CollectionsController::view() action correctly resolved collection element UUIDs through Event::fetchSimpleEvents($user, ...), which enforces per-user event ACL. However, the view template independently re-queried the same UUIDs using only an Event.uuid IN (...) condition, omitting the createEventConditions() authorization filter. Because collection element UUIDs are stored without server-side authorization against the referenced event (CollectionElementsController::add() accepts whatever UUID the collection owner posts), an authenticated user with view access to a collection could retrieve full details of events they are not permitted to read. The exposed data included event identifiers, info, dates, timestamps, creator organization, all event tags, and galaxy clusters (the latter attached via a cluster-scoped rather than event-scoped ACL check). This constitutes an authorization bypass at the presentation layer, allowing horizontal privilege escalation across event boundaries within the MISP instance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-06
AI Q&A
2026-09-06
EPSS Evaluated
N/A
NVD
CVE-2026-86283
EUVD
EUVD-2026-72137

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp to 2026-86283 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MISP's UiBeta theme allows an authenticated user with view access to a collection to retrieve full details of events they are not permitted to read. The issue occurs because the view template performs a secondary query of member events by UUID without applying the caller's access control list (ACL), bypassing authorization checks enforced by the controller.

Detection Guidance

To detect this vulnerability, inspect the MISP UiBeta theme collection view file for improper ACL enforcement during event lookups. Check if the view template independently re-queries events by UUID without applying createEventConditions(). Review logs for unauthorized access attempts to event data by users with collection view permissions.

Impact Analysis

An attacker with access to a collection could exploit this to view sensitive event data, including identifiers, timestamps, creator organization, tags, and galaxy clusters, even if they lack direct permission to access those events. This could lead to unauthorized data exposure within the MISP instance.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by allowing unauthorized access to sensitive event data. Exposure of personal or protected information without proper authorization may result in regulatory penalties or breaches of data protection obligations.

Mitigation Strategies

Apply the patch from Resource 1 to modify the UiBeta theme collection view file to enforce ACL checks during event lookups. Ensure the patch adds caller identity verification and applies createEventConditions() to filter events based on user permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86283. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart