Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-91846— MISP Collection Element Add Missing Authorization on Referenced Object UUID

Quick assessment

Affected
MISP MISP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

受影响的 MISP 版本允许从裸 UUID 创建集合元素，但并未一致地检查操作用户是否有权访问该 UUID 所引用的对象。 提交说明指出，集合元素本身仅存储 UUID，而集合视图稍后会将这些 UUID 解析为对应的底层对象。在修复之前，通用的 add() 路径可能会持久化一个调用者通常无权读取的 Event 或 Galaxy Cluster 的 UUID。补丁明确指出，这使得集合成为引用其他组织私有数据的一种途径，并在 beta 集合视图中导致了仅限组织可见的事件被泄露。 该修复在 中集中处理授权逻辑。Event

CVSS 7.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-91846

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MISP Collection Element Add Missing Authorization on Referenced Object UUID
Source: CVE Program / CVE List V5
Vulnerability Description
Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object. The commit explains that collection elements themselves only store UUIDs, while the collection view later resolves those UUIDs into their underlying objects. Before this fix, the generic add() path could therefore persist a UUID for an Event or Galaxy Cluster that the caller could not normally read. The patch explicitly notes that this made collections a way to reference another organisation’s private data and had caused disclosure of organisation-only events in the beta collection view. The fix centralizes authorization in __assertCanUseElements(). Event UUIDs are validated through Event::fetchSimpleEvent() under the current user’s ACL, while Galaxy Cluster UUIDs are checked through GalaxyCluster::fetchGalaxyClusters(). The check is applied both to the CRUD add() path and to addElementToCollection(). Version affected: ≤2.5.45
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MISP MISP 0 ~ 2.5.46 -

II. Public POCs for CVE-2026-91846

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-91846

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-91846 (1)

Same Patch Batch · MISP · 2026-09-15 · 6 CVEs total

CVE-2026-91825 7.1 HIGH MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitt
CVE-2026-91819 6.9 MEDIUM MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent
CVE-2026-91851 5.3 MEDIUM MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission F
CVE-2026-91857 5.3 MEDIUM MISP: State-changing actions accessible via GET request enabling CSRF
CVE-2026-91859 5.3 MEDIUM MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass

IV. Related Vulnerabilities

Same product: MISP
Same vendor: MISP
Same weakness: CWE-862

V. Comments for CVE-2026-91846

No comments yet

Leave a comment