Authorization Bypass Vulnerability in MISP by Threatsource

CVE-2026-86451

What is CVE-2026-86451?

A vulnerability in MISP allows authenticated users to access object-reference records using a UUID without proper authorization checks. This occurs through the EventGraphTool::get_reference_data() method, where object references can be queried directly. If a user has knowledge of a reference UUID, they can retrieve corresponding object information beyond their assigned access permissions, since the system fails to enforce parent-object access control lists (ACLs). The vulnerability is addressed by modifying the code to include checks that prevent unauthorized access, returning a NotFoundException when a user attempts to access a restricted parent object.

References