Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-95805— MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction

Quick assessment

Affected

MISP MISP

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MISP 的 ACLComponent 访问控制配置中存在一个拼写错误，导致动作的 ACL 规则引用了权限字符串（末尾带有星号），而非正确的。在 MISP 的 ACL 系统中，数组值用于定义哪个角色或权限可以访问特定的控制器动作。相邻的条目正确使用了，证实了预期的访问限制意图。由于键不包含任何有效权限标识符，导致对的访问控制检查发生故障。根据 ACL 评估逻辑的不同，这可能造成两种后果：要么未授权用户获得对端点的访问权限（授权绕过），要么合法用户被拒绝访问（可用性影响）。端点会暴露 MISP 中的

CVSS 5.3 · Medium EPSS 0.41% · P36 Updated Sep 23, 2026

Possible ATT&CK Techniques 1 AI

T1078 · Valid Accounts

Affected Version Matrix 1

Vendor	Product	Version Range	Status
MISP	MISP	`< 2.5.47`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction

Source: CVE Program / CVE List V5

Vulnerability Description

A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'theming_enabled*' (with a trailing asterisk) instead of the correct 'theming_enabled'. In the MISP ACL system, the array values define which role or permission grants access to a given controller action. The adjacent entry previewEventObjects correctly uses ['theming_enabled'], confirming the intended restriction. The malformed key 'theming_enabled*' does not match any valid permission identifier, causing the access control check for previewEventAttributes to malfunction. Depending on the ACL evaluation logic, this could result in either unauthorized users gaining access to the previewEventAttributes endpoint (authorization bypass) or legitimate users being denied access (availability impact). The previewEventAttributes endpoint exposes event attribute data within MISP so an authorization bypass could expose sensitive indicator and attribute data to users who should not have access.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
MISP	MISP	0 ~ 2.5.47	-

II. Public POCs for CVE-2026-95805

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-95805

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-95805 (1)

🔗 fix: [ACL] typo in previewEventAttributes key · MISP/MISP@5ac8d1e · GitHub patch

https://www.cve.org/CVERecord?id=CVE-2026-95805

Same Patch Batch · MISP · 2026-09-22 · 19 CVEs total

CVE-2026-95806	7.7 HIGH	MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influe
CVE-2026-95658	6.9 MEDIUM	MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution o
CVE-2026-95754	6.9 MEDIUM	MISP: Disabled-user check ineffective in pre-authentication TOTP login branch
CVE-2026-95679	6.9 MEDIUM	MISP Unauthenticated Blind SSRF via XML Body Processing
CVE-2026-95667	6.9 MEDIUM	MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials
CVE-2026-95697	5.3 MEDIUM	MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Me
CVE-2026-95698	5.3 MEDIUM	MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name
CVE-2026-95671	5.3 MEDIUM	MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collecti
CVE-2026-95693	5.3 MEDIUM	MISP Information Disclosure via Forged Upload Path
CVE-2026-95674	5.3 MEDIUM	MISP EventsController queryEnrichment allows querying unavailable or legacy modules withou
CVE-2026-95683	5.3 MEDIUM	MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL
CVE-2026-95685	5.3 MEDIUM	MISP Missing Authorization on replaceSuggestionInReport Event Report Action
CVE-2026-95661	5.1 MEDIUM	MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type
CVE-2026-95665	5.1 MEDIUM	MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON
CVE-2026-95703	5.1 MEDIUM	MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_na
CVE-2026-95701	5.1 MEDIUM	MISP Path Traversal via Organization Name in Org-Statistics Logo Check
CVE-2026-95659	4.8 MEDIUM	MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread
CVE-2026-95682	4.8 MEDIUM	MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View

IV. Related Vulnerabilities

Same product: MISP

Same vendor: MISP

Same weakness: CWE-285