MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query of member events by UUID without applying the caller's access control list (ACL). The CollectionsController::view() action correctly resolved collection element UUIDs through Event::fetchSimpleEvents($user, ...), which enforces per-user event ACL. However, the view template independently re-queried the same UUIDs using only an Event.uuid IN (...) condition, omitting the createEventConditions() authorization filter. Because collection element UUIDs are stored without server-side authorization against the referenced event (CollectionElementsController::add() accepts whatever UUID the collection owner posts), an authenticated user with view access to a collection could retrieve full details of events they are not permitted to read. The exposed data included event identifiers, info, dates, timestamps, creator organization, all event tags, and galaxy clusters (the latter attached via a cluster-scoped rather than event-scoped ACL check). This constitutes an authorization bypass at the presentation layer, allowing horizontal privilege escalation across event boundaries within the MISP instance.
" } ], "value": "MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query of member events by UUID without applying the caller's access control list (ACL). The CollectionsController::view() action correctly resolved collection element UUIDs through Event::fetchSimpleEvents($user, ...), which enforces per-user event ACL. However, the view template independently re-queried the same UUIDs using only an Event.uuid IN (...) condition, omitting the createEventConditions() authorization filter. Because collection element UUIDs are stored without server-side authorization against the referenced event (CollectionElementsController::add() accepts whatever UUID the collection owner posts), an authenticated user with view access to a collection could retrieve full details of events they are not permitted to read. The exposed data included event identifiers, info, dates, timestamps, creator organization, all event tags, and galaxy clusters (the latter attached via a cluster-scoped rather than event-scoped ACL check). This constitutes an authorization bypass at the presentation layer, allowing horizontal privilege escalation across event boundaries within the MISP instance." } ], "impacts": [ { "capecId": "CAPEC-1", "descriptions": [ { "lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 7.1, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-285", "description": "CWE-285 Improper Authorization", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-09-06T14:15:06.533Z" }, "references": [ { "name": "Security patch", "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/44573e4a8.patch" } ], "solutions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "The view template now retrieves the authenticated user object and applies Event::createEventConditions($me) to the secondary event query, ensuring the same per-user ACL that the controller enforces is also applied at the view layer. The galaxy cluster attachment call was also updated to use the same authenticated user reference, closing the cluster-scoped ACL gap.
" } ], "value": "The view template now retrieves the authenticated user object and applies Event::createEventConditions($me) to the secondary event query, ensuring the same per-user ACL that the controller enforces is also applied at the view layer. The galaxy cluster attachment call was also updated to use the same authenticated user reference, closing the cluster-scoped ACL gap." } ], "source": { "discovery": "UNKNOWN" }, "title": "MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data", "x_gcve": [ { "extensions": { "bcp-05-x-01": { "ai_annotations": [ { "ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [ { "gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama" } ], "review_status": "none", "scope": "record", "tags": [ "ai-computer-assisted:llm-generated", "ai-computer-assisted:classification" ] } ] } }, "recordType": "advisory", "vulnId": "gcve-1-2026-20028" } ], "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_patch2vuln": { "assumptions": [ "The MISP instance is assumed to be deployed over a network (web application) with multiple users of varying privilege levels.", "The UiBeta theme is assumed to be active or selectable by the affected user; if the theme is not in use, the vulnerability is not reachable.", "The attacker is assumed to have at least read access to a collection that contains elements referencing events outside their ACL.", "No specific MISP version range is identified in the patch; the affected version is marked as unspecified.", "The CVSS assumes the exposed event data constitutes a high confidentiality impact; if the deployment only contains low-sensitivity data, the impact rating would be lower." ], "commit": "44573e4a8e9dff43815f83a91a9c8b9f0f790261", "confidence": "high", "credits": [ { "lang": "en", "type": "reporter", "value": "Scottish Government - National Cyber Team" }, { "lang": "en", "type": "remediation developer", "value": "iglocska" }, { "lang": "en", "type": "remediation developer", "value": "Claude Opus 5 (1M context)" } ], "cvssRationale": "The vulnerability is exploitable over the network (AV:N) via the MISP web interface. Attack complexity is low (AC:L) because the attacker only needs to view a collection whose elements reference events outside their ACL; no race conditions or special timing are required. No attack target manipulation is needed (AT:N). The attacker must be an authenticated MISP user with at least view access to a collection (PR:L). No user interaction is required beyond normal browsing (UI:N). The impact is high on the confidentiality of the vulnerable component (VC:H) because full event metadata, tags, and galaxy cluster data are exposed to unauthorized users. There is no integrity or availability impact on the vulnerable component (VI:N, VA:N) and no impact on external components (SC:N, SI:N, SA:N) since the exposed data resides within the same MISP instance.", "draft": true, "fixSummary": "The view template now retrieves the authenticated user object and applies Event::createEventConditions($me) to the secondary event query, ensuring the same per-user ACL that the controller enforces is also applied at the view layer. The galaxy cluster attachment call was also updated to use the same authenticated user reference, closing the cluster-scoped ACL gap.", "generatedAt": "2026-09-06T13:42:10.775993Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "patchSha256": "3d73a5a5268dbae77114b00d96440a3b5b164e76dbc349cdf8c915ff8f18f72b", "patchSummary": "In app/View/Themed/UiBeta/Collections/view.ctp, the patch adds retrieval of the authenticated user via $this->get('me'), builds an ACL condition array using $_eventModel->createEventConditions($_me), appends the Event.uuid IN clause to that condition array, and passes the combined conditions to the Event::find() call. The attachClustersToEventIndex() call was changed from $this->Session->read('Auth.User') to the same $_me variable for consistency. A guard clause (!empty($_me)) was added to prevent unauthenticated execution of the query.", "patchTruncated": false, "source": "https://github.com/MISP/MISP/commit/44573e4a8.patch", "subject": "fix: [security] Apply the caller's ACL to the beta collection", "weaknessRationale": [ { "cweId": "CWE-862", "rationale": "The view-layer query for events by UUID omitted the authorization check (createEventConditions) that the controller layer applied, resulting in a missing authorization enforcement at the point where data was retrieved for display." }, { "cweId": "CWE-285", "rationale": "The galaxy cluster attachment used a cluster-scoped ACL rather than the event-scoped ACL, and the overall view-layer authorization was weaker than the controller-layer authorization, constituting improper authorization enforcement." } ] } } } }