CVE-2026-86451 in MISP
Summary
by MITRE • 09/07/2026
Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data() without first checking whether the requester is authorized to view the object the reference belongs to.
The vulnerable code queried ObjectReference.uuid directly and returned the matching row whenever it existed. Because no parent-object ACL was applied, a user who knew or obtained a reference UUID could retrieve information associated with an object outside their normal access scope. The commit explicitly states that any object reference could be returned by UUID without authorizing its parent object.
The fix retrieves the referenced object's object_id and calls fetchObjectSimple() with the current user. If the user cannot access that parent object, MISP now returns NotFoundException instead of exposing the reference.
Version affected: ≤2.5.45
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
Insecure Direct Object Reference vulnerabilities represent a critical class of security flaws where an application exposes internal implementation objects to users without proper authorization checks. In the context of the Multiple Information Sharing Platform, commonly known as MISP, this vulnerability manifests within the EventGraphTool component through its get_reference_data method. The core technical flaw lies in the direct querying of ObjectReference records using a universally unique identifier provided by the user input. When an authenticated user supplies a specific UUID for an object reference, the system retrieves and returns the associated data without verifying whether that user possesses the necessary permissions to view the parent event or object to which this reference belongs. This oversight effectively bypasses the standard Access Control List mechanisms designed to restrict visibility of sensitive threat intelligence based on organizational boundaries or trust levels.
The operational impact of this flaw is significant for organizations relying on MISP for secure sharing of cyber threat indicators. An attacker with valid authentication credentials can enumerate and access object references that are intended to be restricted to specific groups or users. By iterating through known or guessed UUIDs, an adversary could potentially reconstruct parts of the threat intelligence landscape belonging to other tenants in a multi-tenant deployment or expose sensitive details about internal investigations within their own organization. This unauthorized data exposure violates the principle of least privilege and compromises the confidentiality guarantees that MISP is designed to provide for shared indicators of compromise and related metadata.
From an industry standard perspective, this vulnerability aligns directly with CWE-602, which describes Client-Side Enforcement of Server-Side Access Control, or more accurately in server-side terms, it falls under CWE-862: Missing Authorization. The attack vector is classified within the MITRE ATT&CK framework as T1078: Valid Accounts, since exploitation requires prior authentication but leverages improper access control to escalate privileges over data visibility. It also relates to T1530: Data from Cloud Storage Objects if the references point to external resources, though primarily it represents a failure in server-side authorization logic for internal objects.
The remediation strategy implemented in versions greater than 2.5.45 addresses this issue by enforcing strict parent-object validation before returning any reference data. The updated code first extracts the object_id associated with the requested reference and then invokes fetchObjectSimple() while passing the current user context as a parameter. This function performs a comprehensive check against the application's access control lists to ensure the requesting user has explicit permission to view the parent object. If this authorization check fails, the system now returns a NotFoundException rather than exposing the underlying data. This change ensures that all indirect object references are validated against the appropriate security policies before any information is disclosed, thereby closing the bypass path and restoring proper access control integrity for MISP deployments.