CVE-2026-94394: MISP ObjectReferencesController: Granular Distribution and Sharing Group Restrictions Bypassed When Adding Object References
When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user.
Because of this, someone who can view an event could potentially access attributes or objects inside that event that were meant to be restricted to a specific sharing group or distribution level.
The vulnerability affects authenticated users who are not site administrators and who already have access to an event containing more restricted data.
The main impact is that users may be able to view sensitive attribute values, object details, or related object data that they should not normally be allowed to see.
Affected Software
Event History
Frequently Asked Questions
Which users are realistically exposed to this issue?
Authenticated non-site-administrator users who can access an event that also contains attributes or objects restricted by sharing group or distribution level may be able to access data beyond their intended permissions.
What must an attacker be able to do to exploit it?
The attacker needs an authenticated regular-user account with access to the relevant event and must be able to add a reference between objects or attributes. Site administrator access is not required.
Is this limited to event-level access controls?
Yes. The described bypass occurs when event-level access is allowed but the referenced attribute or object has more restrictive sharing-group or distribution settings that are not consistently checked.
What information could be exposed?
A successful exploit may reveal sensitive attribute values, object details, or related object data that the user would not normally be permitted to view.