Access Control Misconfiguration in MISP by MISP Project

CVE-2026-95805

What is CVE-2026-95805?

A typo in the access control requirements of MISP (Malware Information Sharing Platform) results in potential unauthorized access to sensitive event attribute data. Specifically, an incorrect reference to 'theming_enabled*' in the ACL configuration for the previewEventAttributes action leads to either unauthorized users gaining access or legitimate users being denied access. This misconfiguration could expose sensitive indicators, making them accessible to users without appropriate permissions, which undermines the security of the platform.

References