Data Exposure Vulnerability in MISP by CIS

CVE-2026-94394

What is CVE-2026-94394?

A vulnerability exists in MISP where regular users can access sensitive information within an event. Although the system checks user permissions at the event level, it inadequately verifies access to specific attributes or objects. Consequently, authenticated users who are not site administrators may be able to view restricted data intended for specific sharing groups, leading to potential exposure of sensitive attribute values and object details. This gap in permission checks poses significant risks for organizations relying on MISP for managing their security information and could lead to unauthorized disclosure of confidential information.

References