CVE-2026-91851
Received Received - Intake

MISP Dashboard Template Permission Bypass via Numeric Coercion

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: CIRCL

Description
Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag. DashboardsController::listTemplates() allowed a template when either:  - its restrict_to_permission_flag matched one of the current user’s permission flags, or  - restrict_to_permission_flag equaled integer 0 However, restrict_to_permission_flag is a varchar. MySQL therefore performed numeric coercion when comparing the column against integer 0. Strings such as perm_site_admin convert numerically to zero, making expressions such as perm_site_admin = 0 evaluate true and causing the “unrestricted” branch to match permission-restricted templates as well. Version affected: ≤2.5.45

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91851
EUVD
EUVD-2026-78333

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp to 2.5.45 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-697 The product compares two entities in a security-relevant context, but the comparison is incorrect.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MISP versions 2.5.45 or earlier involves incorrect filtering of dashboard templates based on permission flags. The system checks if a template's restrict_to_permission_flag matches a user's permission flags or equals 0. However, since restrict_to_permission_flag is a string, MySQL converts non-empty strings like 'perm_site_admin' to 0 during comparison, making permission-restricted templates appear unrestricted.

Detection Guidance

Check MISP dashboard template access logs for unauthorized template retrievals. Review MySQL queries involving the restrict_to_permission_flag column for improper numeric coercion. Inspect user permissions assigned to dashboard templates to identify mismatches between intended and actual access.

Impact Analysis

An attacker with limited permissions could access restricted dashboard templates by exploiting this flaw. This may lead to unauthorized data exposure or manipulation within the MISP system, potentially compromising sensitive information or system integrity.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data. GDPR and HIPAA mandate strict access controls; this flaw undermines those controls, potentially leading to data breaches and non-compliance penalties.

Mitigation Strategies

Upgrade MISP to version 2.5.46 or later. Review and correct any permission assignments for dashboard templates that may have been incorrectly granted due to this issue. Monitor for unauthorized access attempts to restricted templates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91851. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart