CVE-2026-86347 in MISP
Summary
by MITRE • 09/07/2026
Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry for templates/uploadFile used the wildcard *. This bypasses the intended role restrictions applied to neighboring template-management operations.
The upload handler accepts arbitrary content with only minimal checks and writes it into app/tmp/files/. A low-privileged or read-only user can therefore repeatedly upload files and consume server disk space without requiring perm_add or perm_template. The fix changes the ACL requirement from * to perm_add.
The commit also rules out stronger impacts: uploaded files receive random names, path traversal/predictable overwrite is not available, the temporary directory is outside the web root, and the files are not directly served over HTTP. Therefore, the issue should not be described as arbitrary file overwrite, stored XSS, or RCE.
Version affected: ≤2.5.45
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified in versions of MISP up to 2.5.45 represents a significant access control failure within the TemplatesController component, specifically affecting the uploadFile functionality. The core technical flaw stems from an overly permissive Access Control List configuration where the ACL entry for templates/uploadFile was set to use a wildcard asterisk character. This misconfiguration effectively grants all authenticated users, regardless of their assigned role or privilege level, the ability to invoke this endpoint. In secure software architecture, access control mechanisms must strictly enforce least-privilege principles, ensuring that actions such as file uploads are restricted to roles with explicit permission attributes like perm_add. By relying on a wildcard, the system fails to distinguish between high-privileged administrators and low-privileged or read-only users, thereby bypassing the intended role-based restrictions applied to other template management operations within the application.
From an operational perspective, this vulnerability allows for resource exhaustion attacks against the MISP server infrastructure. Because the upload handler accepts arbitrary content with only minimal validation checks before writing files into the app/tmp/files directory, a low-privileged user can repeatedly submit large or numerous file uploads. This activity consumes significant amounts of disk space on the hosting environment without requiring elevated permissions such as perm_add or perm_template. While this does not immediately compromise data integrity or confidentiality through direct exfiltration, it degrades system performance and availability by filling up storage resources. In a shared hosting environment or a containerized deployment, this could lead to service disruption for other processes relying on the same filesystem space, effectively creating a denial-of-service condition driven by legitimate but unauthorized API usage patterns.
It is critical to distinguish this vulnerability from more severe classes of flaws such as arbitrary file overwrite, stored cross-site scripting, or remote code execution. The remediation and technical analysis confirm that uploaded files are assigned random names, which prevents path traversal attacks and predictable overwrites of existing system files. Furthermore, the temporary directory where these files are stored is located outside the web root, ensuring they cannot be directly served or executed via HTTP requests. This architectural safeguard mitigates risks associated with file inclusion vulnerabilities and ensures that even if a malicious actor uploads executable content, it remains isolated from the application's execution context. Consequently, while the vulnerability allows for unauthorized data ingestion and storage consumption, it does not provide an immediate pathway to code execution or direct server compromise through standard web attack vectors.
The resolution involves correcting the ACL configuration by changing the requirement from the wildcard asterisk to the specific perm_add permission attribute. This change ensures that only users with explicit upload privileges can access the file upload functionality, aligning the implementation with security best practices for role-based access control. To further mitigate risks associated with this class of vulnerability, organizations should implement rate limiting on all user-facing endpoints to prevent rapid-fire requests that could accelerate resource exhaustion. Additionally, monitoring disk usage metrics and setting up alerts for abnormal spikes in temporary directory sizes can provide early detection of such abuse patterns. Regular audits of ACL configurations are essential to ensure they remain aligned with the principle of least privilege as roles and permissions evolve within the organization's security framework.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, specifically where a user is granted privileges that exceed their intended role or authorization level. The exploitation technique falls under MITRE ATT&CK Tactic TA0001 Initial Access and Technique T1584 Compromise Infrastructure, as an attacker leverages misconfigured permissions to establish persistence through resource consumption rather than direct system compromise. Understanding these mappings helps security teams contextualize the risk within broader threat landscapes and prioritize remediation efforts based on both technical severity and operational impact. By addressing this access control flaw, MISP deployments can restore proper segregation of duties between administrative functions and user-level interactions, thereby strengthening the overall integrity and availability of the intelligence sharing platform.