Executive brief
MISP, a threat intelligence platform used by security teams to share and analyze malware indicators and attack data, contains an access control flaw. Authenticated users can retrieve detailed information about object references outside their normal access scope by guessing or obtaining the unique identifier of a reference. An attacker with a user account could access sensitive threat intelligence they should not be authorized to view.
Technical details
An authorization bypass vulnerability exists in EventGraphTool::get_reference_data() where object reference records are retrieved by UUID without validating whether the requesting user has access to the parent object. The vulnerable code queries ObjectReference.uuid directly and returns matching rows without applying parent-object ACL checks. An authenticated attacker who knows or obtains a reference UUID can retrieve the associated object reference data regardless of their authorization level for that parent object. The fix retrieves the referenced object's object_id and calls fetchObjectSimple() with the current user context, returning NotFoundException if access is denied. Patches are available in versions after 2.5.45.
Affected products
- MISP MISP ≤2.5.45
Timeline
- 2026-09-07: disclosed
- 2026-09-07: patched