CVE-2026-94394 in MISP
Summary
by MITRE • 09/21/2026
When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user.
Because of this, someone who can view an event could potentially access attributes or objects inside that event that were meant to be restricted to a specific sharing group or distribution level.
The vulnerability affects authenticated users who are not site administrators and who already have access to an event containing more restricted data.
The main impact is that users may be able to view sensitive attribute values, object details, or related object data that they should not normally be allowed to see.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/21/2026
This vulnerability represents a critical authorization flaw within the MISP platform, specifically categorized under CWE-284 Improper Access Control and aligned with MITRE ATT&CK technique T1078 Valid Accounts for lateral movement or data exfiltration contexts. The core technical deficiency lies in the application's logic when handling references between objects or attributes. When an authenticated user who is not a site administrator attempts to add such a reference, the system performs a validation check on the parent event level but fails to recursively validate access permissions against the individual child elements involved in that relationship. This oversight creates a scenario where the security boundary defined by sharing groups and distribution levels is effectively bypassed through indirect object references rather than direct resource access.
The operational impact of this flaw allows users with legitimate, albeit limited, access rights to escalate their privileges regarding specific data points within an event they are already permitted to view. If such a user constructs or modifies a reference linking to attributes or objects that have been assigned stricter sharing group constraints or lower distribution levels than the parent event, the system erroneously grants visibility into those restricted components. This means sensitive intelligence, personally identifiable information, or proprietary threat indicators intended for exclusive consumption by specific organizations can be exposed to unauthorized parties within the same MISP instance. The vulnerability specifically targets authenticated non-administrative users who already possess baseline access to an event containing more broadly distributed data, leveraging that existing trust relationship to peek into restricted silos of information.
From a security architecture perspective, this issue highlights a failure in implementing granular authorization checks during state-changing operations involving related resources. Standard secure design principles dictate that every individual resource accessed or modified must undergo its own independent access control verification, regardless of the permissions granted for container objects like events. The absence of these fine-grained checks undermines the integrity of MISP's multi-tenant and sharing group model, which relies on strict isolation to maintain trust between participating organizations in threat intelligence communities.
To mitigate this vulnerability, immediate action is required at both the application code level and through administrative controls. Developers must patch the reference handling logic to ensure that every attribute or object involved in a new relationship undergoes independent access control validation against the requesting user's permissions and sharing group memberships before the operation is committed. Administrators should enforce strict role-based access policies, limiting who can create complex references between objects until patches are applied. Additionally, implementing comprehensive audit logging for all reference modifications can aid in detecting any potential exploitation attempts while the system remains vulnerable to this specific authorization bypass mechanism.