Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object.
\nThe commit explains that collection elements themselves only store UUIDs, while the collection view later resolves those UUIDs into their underlying objects. Before this fix, the generic add() path could therefore persist a UUID for an Event or Galaxy Cluster that the caller could not normally read. The patch explicitly notes that this made collections a way to reference another organisation’s private data and had caused disclosure of organisation-only events in the beta collection view.
The fix centralizes authorization in __assertCanUseElements(). Event UUIDs are validated through Event::fetchSimpleEvent() under the current user’s ACL, while Galaxy Cluster UUIDs are checked through GalaxyCluster::fetchGalaxyClusters(). The check is applied both to the CRUD add() path and to addElementToCollection().
Version affected: ≤2.5.45
The fix introduces a dedicated __assertCanUseElements() authorization guard that is invoked in the beforeSave callback of the add() CRUD path (covering both form and REST submission) and in addElementToCollection(). For each element UUID, the method resolves the element type (deducing it if the caller omitted the field, preventing bypass by omission) and performs an ACL-aware lookup: for Events it calls fetchSimpleEvent() scoped to the current user, and for GalaxyClusters it calls fetchGalaxyClusters() with the user context. If the object does not exist or the caller lacks access, a NotFoundException is raised and the save is aborted. This ensures that no collection element can reference an object the caller is not authorized to read.
"}],"value":"The fix introduces a dedicated __assertCanUseElements() authorization guard that is invoked in the beforeSave callback of the add() CRUD path (covering both form and REST submission) and in addElementToCollection(). For each element UUID, the method resolves the element type (deducing it if the caller omitted the field, preventing bypass by omission) and performs an ACL-aware lookup: for Events it calls fetchSimpleEvent() scoped to the current user, and for GalaxyClusters it calls fetchGalaxyClusters() with the user context. If the object does not exist or the caller lacks access, a NotFoundException is raised and the save is aborted. This ensures that no collection element can reference an object the caller is not authorized to read."}],"title":"MISP Collection Element Add Missing Authorization on Referenced Object UUID","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"review","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The affected version range is not explicitly stated in the patch; the tag boundary indicates the fix is 204 commits after v2.5.46, but the exact fixed release version is unconfirmed.","PR:L assumes the attacker needs only a basic authenticated MISP account with collection-element management rights; if a higher privilege level is required, PR should be raised.","The commit message references 'V17' as a related disclosure scenario; this is treated as internal context and not used to expand the affected scope.","The deduceType() fallback path is assumed to be reachable by an attacker omitting the element_type field, which the patch explicitly guards against."],"commit":"334d537095971df4855a4a4d9d9da0d6fd93d0df","confidence":"medium","credits":[{"lang":"en","type":"remediation developer","value":"iglocska"},{"lang":"en","type":"remediation developer","value":"Claude Opus 5 (1M context)"}],"cvssRationale":"AV:N: MISP is a network-accessible web application. AC:L: The attacker simply submits a UUID to the existing add endpoint; no race condition or complex bypass is needed. AT:N: No prior compromise or user interaction is required. PR:L: An authenticated MISP user with permission to manage collection elements is required. UI:N: No victim interaction is needed; the disclosure occurs when the attacker views their own collection. VC:L: The attacker gains read access to Events or GalaxyClusters belonging to other organizations or restricted scopes. VI:L: Unauthorized references are persisted in the collection, altering data integrity. VA:N: No availability impact. SC/SI/SA:N: No impact on adjacent systems.","draft":false,"fixSummary":"The fix introduces a dedicated __assertCanUseElements() authorization guard that is invoked in the beforeSave callback of the add() CRUD path (covering both form and REST submission) and in addElementToCollection(). For each element UUID, the method resolves the element type (deducing it if the caller omitted the field, preventing bypass by omission) and performs an ACL-aware lookup: for Events it calls fetchSimpleEvent() scoped to the current user, and for GalaxyClusters it calls fetchGalaxyClusters() with the user context. If the object does not exist or the caller lacks access, a NotFoundException is raised and the save is aborted. This ensures that no collection element can reference an object the caller is not authorized to read.","generatedAt":"2026-09-15T08:32:37.109406Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":9,"assumptionCount":4,"confidence":"medium","model":"qwen3.8:27b","score":6}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"259d46cb772765da8e97cb71e005610ab690f9f92b29e58b0a95aabe71fb0bdf","patchSummary":"In app/Controller/CollectionElementsController.php, a new private method __assertCanUseElements() is added (approximately 45 lines) that iterates over normalized element UUIDs, deduces the element type when not explicitly supplied, and performs an ACL-scoped existence check via Event::fetchSimpleEvent() or GalaxyCluster::fetchGalaxyClusters(). The add() method's beforeSave closure is modified to call this guard before persisting the row. The addElementToCollection() method is refactored to replace its inline Event-only check with a call to the same __assertCanUseElements() helper, gaining GalaxyCluster coverage. Net change: 53 insertions, 12 deletions in one file.","patchTruncated":false,"patches":[{"commit":"334d537095971df4855a4a4d9d9da0d6fd93d0df","patchSha256":"259d46cb772765da8e97cb71e005610ab690f9f92b29e58b0a95aabe71fb0bdf","source":"https://github.com/MISP/MISP/commit/334d53709.patch","sourceUrl":"https://github.com/MISP/MISP/commit/334d53709.patch","subject":"fix: [acl] Authorise the object a collection element points"}],"source":"https://github.com/MISP/MISP/commit/334d53709.patch","subject":"fix: [acl] Authorise the object a collection element points","tagVersionBoundary":{"commits_after_fix":204,"repository":"https://github.com/MISP/MISP","tag":"v2.5.46","version":"2.5.46","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-862","rationale":"The add() method stored collection element UUIDs without performing any authorization check on the referenced object. The fix adds an explicit ACL verification step before persistence, confirming the original code lacked the required authorization control."},{"cweId":"CWE-639","rationale":"The attacker-supplied UUID (a user-controlled key) was accepted and stored without verifying that the caller held a valid access grant for that specific object, allowing reference to objects outside the caller's authorized scope."}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20267"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-91846","datePublished":"2026-09-15T08:36:22.825Z","dateReserved":"2026-09-15T08:36:20.997Z","dateUpdated":"2026-09-15T08:36:22.825Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-15 09:16:45","lastModifiedDate":"2026-09-15 09:16:45","problem_types":["CWE-639","CWE-862","CWE-862 CWE-862 Missing Authorization","CWE-639 CWE-639 Authorization Bypass Through User-Controlled Key"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"91846","Ordinal":"1","Title":"MISP Collection Element Add Missing Authorization on Referenced ","CVE":"CVE-2026-91846","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"91846","Ordinal":"1","NoteData":"Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object.\n\n\nThe commit explains that collection elements themselves only store UUIDs, while the collection view later resolves those UUIDs into their underlying objects. Before this fix, the generic add() path could therefore persist a UUID for an Event or Galaxy Cluster that the caller could not normally read. The patch explicitly notes that this made collections a way to reference another organisation’s private data and had caused disclosure of organisation-only events in the beta collection view.\n\n\nThe fix centralizes authorization in __assertCanUseElements(). Event UUIDs are validated through Event::fetchSimpleEvent() under the current user’s ACL, while Galaxy Cluster UUIDs are checked through GalaxyCluster::fetchGalaxyClusters(). The check is applied both to the CRUD add() path and to addElementToCollection().\n\nVersion affected: ≤2.5.45","Type":"Description","Title":"MISP Collection Element Add Missing Authorization on Referenced "}]}}}