Authorization Bypass Vulnerability in MISP UiBeta Theme Collection View
CVE-2026-86283

7.1HIGH

Key Information:

Vendor

Misp

Status
Misp
Vendor
CVE Published:
6 September 2026

What is CVE-2026-86283?

The MISP UiBeta theme collection view has a vulnerability where an authenticated user can bypass access control when querying member events by UUID. This flaw allows users to fetch details of events outside their permissions, including internal identifiers, timestamps, and associated tags. The issue arises as the view does not enforce proper authorization checks, leading to potential data leaks and horizontal privilege escalation across event boundaries.

Affected Version(s)

MISP 0 <= 2.5.45

References

https://github.com/MISP/MISP/commit/44573e4a8.patch
patch

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Scottish Government - National Cyber Team
iglocska
Claude Opus 5 (1M context)
.