Executive brief
MISP, a threat intelligence platform, failed to properly enforce access restrictions when users created references between data items within events. An authenticated user who could view an event could potentially see restricted attributes or objects within that event that should have been hidden based on their sharing group or permission level. This could lead to unauthorized disclosure of sensitive threat intelligence data.
Technical details
The vulnerability is an authorization bypass in MISP's reference creation logic. When a regular (non-admin) authenticated user adds a reference between objects or attributes, MISP only checked event-level access permissions but failed to validate granular per-attribute or per-object access controls. An attacker with event access but without permission to view specific restricted items could bypass distribution level and sharing group restrictions to view sensitive data.
Affected products
- MISP Project MISP
Timeline
- 2026-09-21: disclosed