CVE-2026-86283: MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data
MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query of member events by UUID without applying the caller's access control list (ACL). The CollectionsController::view() action correctly resolved collection element UUIDs through Event::fetchSimpleEvents($user, ...), which enforces per-user event ACL. However, the view template independently re-queried the same UUIDs using only an Event.uuid IN (...) condition, omitting the createEventConditions() authorization filter. Because collection element UUIDs are stored without server-side authorization against the referenced event (CollectionElementsController::add() accepts whatever UUID the collection owner posts), an authenticated user with view access to a collection could retrieve full details of events they are not permitted to read. The exposed data included event identifiers, info, dates, timestamps, creator organization, all event tags, and galaxy clusters (the latter attached via a cluster-scoped rather than event-scoped ACL check). This constitutes an authorization bypass at the presentation layer, allowing horizontal privilege escalation across event boundaries within the MISP instance.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the UiBeta collection view template so that the secondary member-event lookup by UUID applies Event::createEventConditions($me); do not query solely with Event.uuid IN (...), since that omits per-user Event ACL enforcement.
MISP UiBeta collection view (app/View/Themed/UiBeta/Collections/view.ctp) Secondary event query authorization filter = Apply Event::createEventConditions($me) (instead of only Event.uuid IN (...)) - Configuration
Adjust the galaxy cluster attachment logic in the UiBeta collection view to use the same authenticated user object ($me) for ACL evaluation, closing the cluster-scoped authorization gap mentioned in the report.
MISP galaxy cluster attachment in UiBeta collection view Authenticated user reference for cluster-scoped ACL check = Use the same authenticated $me user reference
Event History
Frequently Asked Questions
Who can access data they are not authorized to view?
An authenticated user who can view a collection is exposed to this issue. The user can obtain details for event UUIDs included in that collection even when their event ACL does not permit access to those events.
What does an attacker need to exploit this?
The attacker needs authenticated access and view access to a collection. Collection owners can submit arbitrary event UUIDs when adding collection elements, so a collection can reference events without server-side authorization of those references.
What information may be disclosed?
The collection view can disclose event identifiers, info fields, dates, timestamps, creator organizations, event tags, and galaxy clusters. Galaxy clusters are affected because their check is cluster-scoped rather than event-scoped.
How can I determine whether the vulnerable code is present?
Inspect app/View/Themed/UiBeta/Collections/view.ctp for a secondary event query using Event.uuid IN (...) without the createEventConditions() authorization filter. The controller's use of Event::fetchSimpleEvents($user, ...) alone does not prevent the template's independent query from bypassing per-user event ACLs.