CVE-2026-91851: MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison
Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag.
DashboardsController::listTemplates() allowed a template when either:
- its restricttopermissionflag matched one of the current user’s permission flags, or
- restricttopermissionflag equaled integer 0
However, restricttopermissionflag is a varchar. MySQL therefore performed numeric coercion when comparing the column against integer 0. Strings such as permsiteadmin convert numerically to zero, making expressions such as permsiteadmin = 0 evaluate true and causing the “unrestricted” branch to match permission-restricted templates as well.
Version affected: ≤2.5.45
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.45 - Configuration
In the code path that filters dashboard templates in DashboardsController::listTemplates(), replace the integer literal 0 used in the restrict_to_permission_flag comparison with explicit string values '' and '0' to prevent VARCHAR-to-integer coercion that causes restricted templates to be treated as unrestricted.
MISP DashboardsController::listTemplates() restrict_to_permission_flag comparison literal for unrestricted templates = Use explicit string values '' and '0' instead of integer 0 (i.e., compare restrict_to_permission_flag to '' and to '0')
Event History
Frequently Asked Questions
Who can view the affected dashboard templates?
Any user able to access the template listing may be shown templates restricted to permission flags stored as non-numeric strings, such as perm_site_admin. The faulty comparison can treat those string-valued restrictions as unrestricted.
What does an attacker need to exploit this issue?
The issue is triggered through DashboardController::listTemplates() when listing dashboard templates. No special permission flag matching the template restriction is required for the unrestricted comparison branch to match.
Are default installations affected?
Affected MISP versions through 2.5.45 are vulnerable when dashboard templates use non-numeric permission-flag values in restrict_to_permission_flag. The provided data does not establish whether such restricted templates exist in a default installation.
How can administrators determine whether they are exposed?
Check whether the MISP deployment is version 2.5.45 or earlier and whether dashboard templates have restrict_to_permission_flag values containing permission-flag strings rather than numeric values. Such templates may be returned to users who do not hold the specified flag.