CVE-2026-86342 in MISP
Summary
by MITRE • 09/07/2026
Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlation lookups against attributes from events without applying the requesting user's ACL, allowing restricted event correlations and associated event information to be exposed to users who could not otherwise access those events. The vulnerable queries were scoped only by attribute values and deletion status rather than MISP's event, organization, sharing-group, attribute, and object-level access controls.
The same preview functionality also returned cross-feed correlation information without properly restricting the feed list to feeds visible to the caller. This exposed metadata for feeds that were not marked lookup_visible; one affected response additionally included the configured feed URL even though that value was not required by the feature.
The fixes apply the caller's ACL to attribute correlation searches, remove feed URLs from correlation results, restrict cross-feed results according to feed visibility, and correct host-organization ID comparison so the authorization rules are applied consistently.
Version affected: ≤2.5.45
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/07/2026
Versions of MISP up through 2.5.45 contain a critical improper access control vulnerability within the freetext feed preview functionality that allows unauthorized users to bypass standard security boundaries and expose sensitive intelligence data. The core technical flaw lies in how the system handles correlation lookups when generating previews for feeds. Instead of applying the requesting user's Access Control List permissions, the vulnerable queries were scoped only by attribute values and deletion status. This architectural oversight means that the authorization rules governing event visibility, organization membership, sharing group restrictions, and object-level access controls are effectively ignored during this specific operation. Consequently, users who do not have permission to view certain events can still trigger correlation searches against those restricted attributes, resulting in the exposure of associated event information and correlations that should remain hidden from their perspective.
The operational impact of this vulnerability is significant for organizations relying on MISP for threat intelligence sharing, as it compromises the confidentiality guarantees provided by role-based access controls. An attacker or a malicious insider with limited privileges can exploit this flaw to enumerate restricted events, identify sensitive indicators of compromise, and map relationships between threats that are meant to be isolated within specific trust domains. This capability undermines the fundamental principle of least privilege inherent in MISP's security model. Furthermore, the vulnerability extends beyond just event data; the same preview functionality also returned cross-feed correlation information without properly restricting the feed list to those visible to the caller. This resulted in the exposure of metadata for feeds that were not marked as lookup_visible, effectively leaking intelligence about internal or private threat sharing communities and their contents to unauthorized parties.
In addition to exposing restricted event correlations, the vulnerability led to the leakage of sensitive configuration details through cross-feed results. Specifically, one affected response included the configured feed URL even though this value was not required by the feature's normal operation. The disclosure of these URLs can aid attackers in mapping an organization's threat intelligence infrastructure and identifying potential secondary targets or data sources. The root cause is a failure to enforce host-organization ID comparisons consistently during authorization checks, allowing queries to traverse organizational boundaries that should be strictly enforced. This inconsistency creates a predictable attack vector where the system fails to distinguish between public and private resource access contexts.
The remediation for this issue involves several critical updates to the application logic. The fixes apply the caller's Access Control List directly to attribute correlation searches, ensuring that only attributes accessible to the user are considered during preview generation. Feed URLs have been removed from correlation results to prevent information leakage of infrastructure details. Cross-feed results are now strictly restricted according to feed visibility settings, preventing unauthorized enumeration of private feeds. Additionally, the host-organization ID comparison logic has been corrected to ensure authorization rules are applied consistently across all access control checks. Organizations running affected versions must upgrade immediately to a patched release to restore proper isolation between user roles and prevent further exposure of sensitive threat intelligence data.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, as the system fails to enforce appropriate access controls for critical functions. In terms of adversary tactics, exploitation of this flaw corresponds to ATT&CK technique T1078 Valid Accounts, where an attacker uses legitimate but low-privileged credentials to gather intelligence, and potentially T1592 Gather Victim Host Information if the exposed feed URLs are leveraged for further reconnaissance. The vulnerability highlights the importance of rigorous code review practices that ensure all data retrieval operations respect the full spectrum of security policies defined by the application's access control model rather than relying on partial or superficial filtering mechanisms.