Executive brief
MISP is a threat intelligence platform that manages sensitive event and campaign data. Dashboard templates can be restricted to users with specific permissions. A flaw in the permission check logic allowed users to access permission-restricted templates by exploiting MySQL's automatic type conversion—string permission names like "perm_site_admin" are coerced to zero when compared numerically, bypassing the restriction check.
Technical details
The vulnerability is a logic error in DashboardsController::listTemplates() involving unsafe type comparison. The restrict_to_permission_flag column is defined as varchar but compared directly against integer 0 using loose equality. MySQL performs implicit numeric coercion, converting non-numeric strings to 0, which causes permission flag strings (e.g., "perm_site_admin") to match the "unrestricted" branch (restrict_to_permission_flag = 0). This allows unauthorized users to list and potentially access dashboard templates restricted to specific permissions. The attack requires no authentication bypass—users simply enumerate templates normally, and the flawed logic grants access to restricted templates. A fix compares the permission flag as a string rather than numeric.
Affected products
- MISP Project MISP ≤2.5.45
Timeline
- 2026-09-15: disclosed: CVE-2026-91851 published
- 2026: patched: Fix committed via comparison of permission flag as string