MISP: Twelve Authorization and Validation Vulnerabilities Disclosed Together
Key findings • Twelve vulnerabilities disclosed for MISP between Sept 6-7, 2026, focusing on authorization bypasses and input validation. • Four high-severity flaws identified, including issu…
Key findings
- Twelve vulnerabilities disclosed for MISP between Sept 6-7, 2026, focusing on authorization bypasses and input validation.
- Four high-severity flaws identified, including issues with password reset, outbound HTTP destinations, cryptographic key access, and file uploads.
- Multiple vulnerabilities stem from inconsistent or missing authorization checks in dashboard widgets and data retrieval functions.
- Input validation weaknesses allow for issues like improper handling of email addresses in password resets and unsafe URLs in dashboard widgets.
- All disclosed vulnerabilities have been patched by the MISP team; users are urged to update.
On September 7, 2026, a batch of twelve vulnerabilities was disclosed for the MISP threat intelligence platform. These vulnerabilities, spanning a 23-hour window from September 6th to September 7th, 2026, primarily revolve around authorization bypasses and insufficient input validation, with several high-severity flaws identified. The disclosures highlight weaknesses in how MISP handles user permissions and validates external data, potentially exposing sensitive information or allowing unauthorized actions.
Several vulnerabilities stem from inconsistent or missing authorization checks across different platform components. CVE-2026-86451, a medium-severity issue, allows authenticated users to retrieve object-reference records by UUID without proper authorization checks. Similarly, CVE-2026-86441 and CVE-2026-86418, both low-severity, reveal that dashboard widgets displaying organization information do not consistently enforce visibility restrictions, potentially allowing unauthorized users to enumerate organizations. CVE-2026-86408, a high-severity flaw, permits any authenticated user to access cryptographic keys without parent-event visibility checks. Another high-severity vulnerability, CVE-2026-86347, allows any authenticated user to access the TemplatesController::uploadFile() endpoint due to a wildcard ACL entry, bypassing intended role restrictions. CVE-2026-86342, a medium-severity issue, involves improper authorization checks in the freetext feed preview functionality, potentially exposing restricted event correlations.
Input validation weaknesses are also a significant concern within this batch. CVE-2026-86452, a high-severity vulnerability, arises from unauthenticated or weakly constrained request paths in the password reset endpoint, which accepts attacker-controlled email values without adequate bounds or format validation. CVE-2026-86419, also high-severity, involves insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery, where redirects are followed without validating the scheme or destination, potentially leading to further exploitation. CVE-2026-86351, a medium-severity flaw, concerns the insufficient validation of user-configurable homepages, allowing protocol-relative URLs to resolve to external origins. CVE-2026-86440, another medium-severity issue, points to insufficient URL validation in dashboard widgets, particularly the Button widget, where the logic for considering URLs safe was inadequate.
The batch of vulnerabilities includes four high-severity, six medium-severity, and two low-severity issues. The disclosures were coordinated, with the majority published on September 7, 2026, and one on September 6, 2026.
According to related reporting, three of these vulnerabilities (CVE-2026-86283, CVE-2026-86342, CVE-2026-86347) were specifically highlighted as authorization bypasses, with two being high-severity. These included improper authorization checks and ACL bypasses in file uploads and data previews. CVE-2026-86347 allows bypassing template upload restrictions, CVE-2026-86283 exposes collection elements due to inadequate ACL checks, and CVE-2026-86342 could leak event correlation data via freetext feed previews.
The MISP team has addressed all disclosed vulnerabilities. Users are advised to update their MISP instances to the latest patched versions to mitigate these security risks.
This coordinated disclosure of twelve vulnerabilities underscores the importance of regular security audits and prompt patching for critical platforms like MISP. Users should remain vigilant and ensure their systems are updated to prevent potential exploitation of these authorization and validation flaws. The breadth of the issues suggests a need for thorough review of access control mechanisms and input handling across the platform.