GCVE-1-2026-20267 (CVE-2026-91846)
Vulnerability from gna-1 – Published: 2026-09-15 08:36 – Updated: 2026-09-15 08:36
VLAI
EPSS
VEX
Title
MISP Collection Element Add Missing Authorization on Referenced Object UUID
Summary
Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object.
The commit explains that collection elements themselves only store UUIDs, while the collection view later resolves those UUIDs into their underlying objects. Before this fix, the generic add() path could therefore persist a UUID for an Event or Galaxy Cluster that the caller could not normally read. The patch explicitly notes that this made collections a way to reference another organisation’s private data and had caused disclosure of organisation-only events in the beta collection view.
The fix centralizes authorization in __assertCanUseElements(). Event UUIDs are validated through Event::fetchSimpleEvent() under the current user’s ACL, while Galaxy Cluster UUIDs are checked through GalaxyCluster::fetchGalaxyClusters(). The check is applied both to the CRUD add() path and to addElementToCollection().
Version affected: ≤2.5.45
Severity
Assigner
GNA-1
This instance
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/334d53709 | patch |
Impacted products
GCVE extensions
AI-generated
Confidence: medium
Model
qwen3.8:27b
advisory
bcp-05-x-01bcp-05-x-02
AI involvement
GCVE-BCP-05-X-01
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
Patch provenance
GCVE-BCP-05-X-02
- Generator
-
patch2vuln.pyon 2026-09-15 08:32 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/334d53709.patch
259d46cb7727… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
334d53709597
|
fix: [acl] Authorise the object a collection element points | 259d46cb7727… |
Fix summary
The fix introduces a dedicated __assertCanUseElements() authorization guard that is invoked in the beforeSave callback of the add() CRUD path (covering both form and REST submission) and in addElementToCollection(). For each element UUID, the method resolves the element type (deducing it if the caller omitted the field, preventing bypass by omission) and performs an ACL-aware lookup: for Events it calls fetchSimpleEvent() scoped to the current user, and for GalaxyClusters it calls fetchGalaxyClusters() with the user context. If the object does not exist or the caller lacks access, a NotFoundException is raised and the save is aborted. This ensures that no collection element can reference an object the caller is not authorized to read.
Patch summary
In app/Controller/CollectionElementsController.php, a new private method __assertCanUseElements() is added (approximately 45 lines) that iterates over normalized element UUIDs, deduces the element type when not explicitly supplied, and performs an ACL-scoped existence check via Event::fetchSimpleEvent() or GalaxyCluster::fetchGalaxyClusters(). The add() method's beforeSave closure is modified to call this guard before persisting the row. The addElementToCollection() method is refactored to replace its inline Event-only check with a call to the same __assertCanUseElements() helper, gaining GalaxyCluster coverage. Net change: 53 insertions, 12 deletions in one file.
CVSS rationale
AV:N: MISP is a network-accessible web application. AC:L: The attacker simply submits a UUID to the existing add endpoint; no race condition or complex bypass is needed. AT:N: No prior compromise or user interaction is required. PR:L: An authenticated MISP user with permission to manage collection elements is required. UI:N: No victim interaction is needed; the disclosure occurs when the attacker views their own collection. VC:L: The attacker gains read access to Events or GalaxyClusters belonging to other organizations or restricted scopes. VI:L: Unauthorized references are persisted in the collection, altering data integrity. VA:N: No availability impact. SC/SI/SA:N: No impact on adjacent systems.
Weakness rationale
- CWE-862 The add() method stored collection element UUIDs without performing any authorization check on the referenced object. The fix adds an explicit ACL verification step before persistence, confirming the original code lacked the required authorization control.
- CWE-639 The attacker-supplied UUID (a user-controlled key) was accepted and stored without verifying that the caller held a valid access grant for that specific object, allowing reference to objects outside the caller's authorized scope.
Assumptions to verify
- The affected version range is not explicitly stated in the patch; the tag boundary indicates the fix is 204 commits after v2.5.46, but the exact fixed release version is unconfirmed.
- PR:L assumes the attacker needs only a basic authenticated MISP account with collection-element management rights; if a higher privilege level is required, PR should be raised.
- The commit message references 'V17' as a related disclosure scenario; this is treated as internal context and not used to expand the affected scope.
- The deduceType() fallback path is assumed to be reachable by an attacker omitting the element_type field, which the patch explicitly guards against.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
6 | 9 | medium | 4 |
{
"containers": {
"cna": {
"affected": [
{
"modules": [
"CollectionElementsController"
],
"product": "MISP",
"programFiles": [
"app/Controller/CollectionElementsController.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.46",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object.\u003c/p\u003e\n\u003cp\u003eThe commit explains that collection elements themselves only store UUIDs, while the collection view later resolves those UUIDs into their underlying objects. Before this fix, the generic \u003ccode\u003eadd()\u003c/code\u003e path could therefore persist a UUID for an Event or Galaxy Cluster that the caller could not normally read. The patch explicitly notes that this made collections a way to reference another organisation\u2019s private data and had caused disclosure of organisation-only events in the beta collection view.\u003c/p\u003e\n\u003cp\u003eThe fix centralizes authorization in \u003ccode\u003e__assertCanUseElements()\u003c/code\u003e. Event UUIDs are validated through \u003ccode\u003eEvent::fetchSimpleEvent()\u003c/code\u003e under the current user\u2019s ACL, while Galaxy Cluster UUIDs are checked through \u003ccode\u003eGalaxyCluster::fetchGalaxyClusters()\u003c/code\u003e. The check is applied both to the CRUD \u003ccode\u003eadd()\u003c/code\u003e path and to \u003ccode\u003eaddElementToCollection()\u003c/code\u003e.\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object.\n\n\nThe commit explains that collection elements themselves only store UUIDs, while the collection view later resolves those UUIDs into their underlying objects. Before this fix, the generic add() path could therefore persist a UUID for an Event or Galaxy Cluster that the caller could not normally read. The patch explicitly notes that this made collections a way to reference another organisation\u2019s private data and had caused disclosure of organisation-only events in the beta collection view.\n\n\nThe fix centralizes authorization in __assertCanUseElements(). Event UUIDs are validated through Event::fetchSimpleEvent() under the current user\u2019s ACL, while Galaxy Cluster UUIDs are checked through GalaxyCluster::fetchGalaxyClusters(). The check is applied both to the CRUD add() path and to addElementToCollection().\n\nVersion affected: \u22642.5.45"
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/334d53709"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix introduces a dedicated __assertCanUseElements() authorization guard that is invoked in the beforeSave callback of the add() CRUD path (covering both form and REST submission) and in addElementToCollection(). For each element UUID, the method resolves the element type (deducing it if the caller omitted the field, preventing bypass by omission) and performs an ACL-aware lookup: for Events it calls fetchSimpleEvent() scoped to the current user, and for GalaxyClusters it calls fetchGalaxyClusters() with the user context. If the object does not exist or the caller lacks access, a NotFoundException is raised and the save is aborted. This ensures that no collection element can reference an object the caller is not authorized to read.\u003c/p\u003e"
}
],
"value": "The fix introduces a dedicated __assertCanUseElements() authorization guard that is invoked in the beforeSave callback of the add() CRUD path (covering both form and REST submission) and in addElementToCollection(). For each element UUID, the method resolves the element type (deducing it if the caller omitted the field, preventing bypass by omission) and performs an ACL-aware lookup: for Events it calls fetchSimpleEvent() scoped to the current user, and for GalaxyClusters it calls fetchGalaxyClusters() with the user context. If the object does not exist or the caller lacks access, a NotFoundException is raised and the save is aborted. This ensures that no collection element can reference an object the caller is not authorized to read."
}
],
"title": "MISP Collection Element Add Missing Authorization on Referenced Object UUID",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "review",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version range is not explicitly stated in the patch; the tag boundary indicates the fix is 204 commits after v2.5.46, but the exact fixed release version is unconfirmed.",
"PR:L assumes the attacker needs only a basic authenticated MISP account with collection-element management rights; if a higher privilege level is required, PR should be raised.",
"The commit message references \u0027V17\u0027 as a related disclosure scenario; this is treated as internal context and not used to expand the affected scope.",
"The deduceType() fallback path is assumed to be reachable by an attacker omitting the element_type field, which the patch explicitly guards against."
],
"commit": "334d537095971df4855a4a4d9d9da0d6fd93d0df",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The attacker simply submits a UUID to the existing add endpoint; no race condition or complex bypass is needed. AT:N: No prior compromise or user interaction is required. PR:L: An authenticated MISP user with permission to manage collection elements is required. UI:N: No victim interaction is needed; the disclosure occurs when the attacker views their own collection. VC:L: The attacker gains read access to Events or GalaxyClusters belonging to other organizations or restricted scopes. VI:L: Unauthorized references are persisted in the collection, altering data integrity. VA:N: No availability impact. SC/SI/SA:N: No impact on adjacent systems.",
"draft": false,
"fixSummary": "The fix introduces a dedicated __assertCanUseElements() authorization guard that is invoked in the beforeSave callback of the add() CRUD path (covering both form and REST submission) and in addElementToCollection(). For each element UUID, the method resolves the element type (deducing it if the caller omitted the field, preventing bypass by omission) and performs an ACL-aware lookup: for Events it calls fetchSimpleEvent() scoped to the current user, and for GalaxyClusters it calls fetchGalaxyClusters() with the user context. If the object does not exist or the caller lacks access, a NotFoundException is raised and the save is aborted. This ensures that no collection element can reference an object the caller is not authorized to read.",
"generatedAt": "2026-09-15T08:32:37.109406Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 4,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 6
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "259d46cb772765da8e97cb71e005610ab690f9f92b29e58b0a95aabe71fb0bdf",
"patchSummary": "In app/Controller/CollectionElementsController.php, a new private method __assertCanUseElements() is added (approximately 45 lines) that iterates over normalized element UUIDs, deduces the element type when not explicitly supplied, and performs an ACL-scoped existence check via Event::fetchSimpleEvent() or GalaxyCluster::fetchGalaxyClusters(). The add() method\u0027s beforeSave closure is modified to call this guard before persisting the row. The addElementToCollection() method is refactored to replace its inline Event-only check with a call to the same __assertCanUseElements() helper, gaining GalaxyCluster coverage. Net change: 53 insertions, 12 deletions in one file.",
"patchTruncated": false,
"patches": [
{
"commit": "334d537095971df4855a4a4d9d9da0d6fd93d0df",
"patchSha256": "259d46cb772765da8e97cb71e005610ab690f9f92b29e58b0a95aabe71fb0bdf",
"source": "https://github.com/MISP/MISP/commit/334d53709.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/334d53709.patch",
"subject": "fix: [acl] Authorise the object a collection element points"
}
],
"source": "https://github.com/MISP/MISP/commit/334d53709.patch",
"subject": "fix: [acl] Authorise the object a collection element points",
"tagVersionBoundary": {
"commits_after_fix": 204,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.46",
"version": "2.5.46",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-862",
"rationale": "The add() method stored collection element UUIDs without performing any authorization check on the referenced object. The fix adds an explicit ACL verification step before persistence, confirming the original code lacked the required authorization control."
},
{
"cweId": "CWE-639",
"rationale": "The attacker-supplied UUID (a user-controlled key) was accepted and stored without verifying that the caller held a valid access grant for that specific object, allowing reference to objects outside the caller\u0027s authorized scope."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20267"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"cveId": "CVE-2026-91846",
"datePublished": "2026-09-15T08:36:15.273263Z",
"dateReserved": "2026-09-15T08:36:20.997Z",
"dateUpdated": "2026-09-15T08:36:21.073370Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1-2026-20267"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…