Executive brief
MISP, a threat intelligence sharing platform, failed to properly verify user access permissions when creating collection elements from bare UUIDs. An attacker could exploit this to add references to private events or data from other organizations to collections, effectively disclosing organization-only information that the attacker should not have access to. This broke the intended access controls and allowed unauthorized visibility of sensitive intelligence data.
Technical details
The vulnerability is an authorization bypass in MISP's collection element creation logic. Collection elements store only UUIDs, which are resolved to actual objects later in the view layer. The add() method could persist UUIDs for Events and Galaxy Clusters without verifying that the caller had read access to the referenced object under their ACL context. This allowed creating collection elements pointing to private data from other organizations. The fix centralizes authorization checks in __assertCanUseElements(), enforcing ACL validation through Event::fetchSimpleEvent() and GalaxyCluster::fetchGalaxyClusters() for all element creation paths including CRUD add() and addElementToCollection(). The issue was identified during internal review rather than external exploitation.
Affected products
- MISP Project MISP ≤2.5.45
Timeline
- 2026-09-15: disclosed