CVE-2026-95805 in MISP
Summary
by MITRE • 09/22/2026
A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'theming_enabled*' (with a trailing asterisk) instead of the correct 'theming_enabled'. In the MISP ACL system, the array values define which role or permission grants access to a given controller action. The adjacent entry previewEventObjects correctly uses ['theming_enabled'], confirming the intended restriction. The malformed key 'theming_enabled*' does not match any valid permission identifier, causing the access control check for previewEventAttributes to malfunction. Depending on the ACL evaluation logic, this could result in either unauthorized users gaining access to the previewEventAttributes endpoint (authorization bypass) or legitimate users being denied access (availability impact).
The previewEventAttributes endpoint exposes event attribute data within MISP so an authorization bypass could expose sensitive indicator and attribute data to users who should not have access.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/22/2026
A configuration error in the Misp ACLComponent of the Malware Information Sharing Platform introduces a critical flaw in role-based access control logic, specifically affecting the previewEventAttributes controller action. The root cause is a typographical error where the permission string required for this endpoint was defined as 'theming_enabled' with a trailing asterisk instead of the correct identifier 'theming_enabled'. This discrepancy arises because the adjacent configuration entry for previewEventObjects correctly utilizes the standard 'theming_enabled' permission, indicating that the inclusion of the wildcard character in the former is an unintentional mistake rather than a deliberate design choice. In typical access control systems, specific string matching or regex evaluation determines whether a user's assigned roles satisfy the requirements to execute a given action. When the system encounters the malformed key 'theming_enabled', it fails to map this value to any valid permission identifier within the defined role hierarchy.
The operational impact of this misconfiguration is twofold and depends heavily on how the underlying ACL engine handles undefined or non-matching permission strings. In many implementations, if a required permission string does not match any known grantable permissions for the current user context, the system may default to denying access, resulting in an availability issue where legitimate users are incorrectly blocked from viewing event attributes they should be able to see. However, depending on the specific implementation details of the ACL evaluation logic, there is also a significant risk that the failure to match a valid permission could result in a fallback behavior that grants broad or default access. This scenario would constitute an authorization bypass vulnerability, allowing unauthorized users to interact with the previewEventAttributes endpoint without proper authentication credentials or sufficient privileges.
The security implications of such an authorization bypass are severe given the nature of the exposed functionality. The previewEventAttributes endpoint is designed to expose detailed indicator and attribute data associated with specific events within MISP. This data often contains sensitive threat intelligence, including IP addresses, domain names, file hashes, URLs, and other technical indicators of compromise that organizations rely on for detection and response activities. If an attacker or unauthorized user can access this endpoint due to the ACL malfunction, they gain visibility into potentially confidential security operations data. This exposure could aid adversaries in refining their attack strategies by identifying which indicators are being monitored or shared within a specific community, thereby reducing the effectiveness of defensive measures.
To mitigate this vulnerability, immediate remediation is required to correct the configuration file containing the ACL rules for the MISP application administrators must locate the definition for the previewEventAttributes action and replace the erroneous 'theming_enabled*' string with the correct 'theming_enabled' identifier. This change ensures that the access control check functions as intended by properly mapping the endpoint to its designated permission level. Following this correction, it is advisable to conduct a thorough review of other ACL configurations within the system to identify any similar typographical errors or inconsistencies in permission strings. Additionally organizations should implement regular audits of their role-based access controls and verify that all controller actions are correctly mapped to valid permissions as defined by industry standards such as CWE-284 Improper Access Control. Continuous monitoring for unauthorized access attempts to sensitive endpoints can also help detect any exploitation of this flaw before it is fully patched in production environments.