MISP: Three Authorization Bypass Vulnerabilities Patched in Single Batch
Key findings • Three MISP vulnerabilities, including two high-severity flaws, were disclosed together between Sept 6-7, 2026. • Flaws include improper authorization checks and ACL bypasses in…
Key findings
- Three MISP vulnerabilities, including two high-severity flaws, were disclosed together between Sept 6-7, 2026.
- Flaws include improper authorization checks and ACL bypasses in file uploads and data previews.
- CVE-2026-86347 allows authenticated users to bypass template upload restrictions.
- CVE-2026-86283 exposes collection elements due to inadequate ACL checks.
- CVE-2026-86342 could leak event correlation data via freetext feed previews.
- All disclosed vulnerabilities have been patched by the MISP team.
The MISP threat intelligence platform has seen three vulnerabilities disclosed in rapid succession, with two high-severity flaws and one medium-severity flaw being patched by the MISP team. The vulnerabilities, disclosed between September 6th and 7th, 2026, primarily revolve around authorization bypasses and improper access control checks within the platform.
One of the high-severity vulnerabilities, CVE-2026-86347, allows any authenticated user to access the TemplatesController::uploadFile() functionality. This is due to an improperly configured ACL entry that used a wildcard, bypassing intended role restrictions for template management operations. The upload handler, as described, accepts arbitrary content.
Another high-severity issue, CVE-2026-86283, stems from the MISP UiBeta theme's collection view. The CollectionsController::view() action performed a secondary query for member events by UUID without adequately checking the caller's access control list (ACL). This could lead to unauthorized access to collection elements.
The medium-severity vulnerability, CVE-2026-86342, involves improper authorization checks in the freetext feed preview feature. The preview function was making correlation lookups against event attributes without enforcing the requesting user's ACL. This could expose restricted event correlations and associated information to unauthorized users.
All three vulnerabilities have been addressed by the MISP development team. Users are advised to update to the latest version to mitigate these security risks. The swift patching by the MISP team indicates a proactive approach to securing the platform against potential exploitation.
These disclosures highlight the importance of rigorous access control and authorization checks in complex platforms like MISP, which handle sensitive threat intelligence data. Ensuring that all actions are properly validated against user permissions is crucial for maintaining data integrity and confidentiality.
The MISP team's prompt response to these vulnerabilities is commendable, providing users with updated versions that rectify these security weaknesses. Users should prioritize applying these updates to protect their MISP instances from potential compromise.