A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'theming_enabled*' (with a trailing asterisk) instead of the correct 'theming_enabled'. In the MISP ACL system, the array values define which role or permission grants access to a given controller action. The adjacent entry previewEventObjects correctly uses ['theming_enabled'], confirming the intended restriction. The malformed key 'theming_enabled*' does not match any valid permission identifier, causing the access control check for previewEventAttributes to malfunction. Depending on the ACL evaluation logic, this could result in either unauthorized users gaining access to the previewEventAttributes endpoint (authorization bypass) or legitimate users being denied access (availability impact).
The previewEventAttributes endpoint exposes event attribute data within MISP so an authorization bypass could expose sensitive indicator and attribute data to users who should not have access.
"}],"value":"A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'theming_enabled*' (with a trailing asterisk) instead of the correct 'theming_enabled'. In the MISP ACL system, the array values define which role or permission grants access to a given controller action. The adjacent entry previewEventObjects correctly uses ['theming_enabled'], confirming the intended restriction. The malformed key 'theming_enabled*' does not match any valid permission identifier, causing the access control check for previewEventAttributes to malfunction. Depending on the ACL evaluation logic, this could result in either unauthorized users gaining access to the previewEventAttributes endpoint (authorization bypass) or legitimate users being denied access (availability impact). \n\nThe previewEventAttributes endpoint exposes event attribute data within MISP so an authorization bypass could expose sensitive indicator and attribute data to users who should not have access."}],"impacts":[{"capecId":"CAPEC-126","descriptions":[{"lang":"en","value":"CAPEC-126 Forced Browsing"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.3,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-285","description":"CWE-285 Improper Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-22T14:59:22.041Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/MISP/MISP/commit/5ac8d1e4d"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The fix corrects the ACL permission key for the previewEventAttributes action from the malformed string 'theming_enabled*' to the correct 'theming_enabled', restoring the intended access control restriction so that only users holding the theming_enabled permission can invoke the endpoint, consistent with the adjacent previewEventObjects entry.
"}],"value":"The fix corrects the ACL permission key for the previewEventAttributes action from the malformed string 'theming_enabled*' to the correct 'theming_enabled', restoring the intended access control restriction so that only users holding the theming_enabled permission can invoke the endpoint, consistent with the adjacent previewEventObjects entry."}],"title":"MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"full","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The exact ACL evaluation behavior when a permission string does not match any valid role (default-deny vs. default-allow) is not visible in the patch; the CVSS assumes the more security-relevant interpretation (authorization bypass) but a denial-of-service interpretation is also possible.","The affected version range is inferred from the tag boundary v2.5.47 (227 commits after the fix); the exact first affected version is not stated in the patch.","The CAPEC-126 mapping is the closest available pattern; the actual attack is a configuration typo rather than an active browsing technique, so the mapping is approximate.","The security impact is assumed to be limited to the previewEventAttributes endpoint; no evidence in the patch suggests other endpoints or data stores are affected.","The CVSS assumes the endpoint exposes event attribute data viewable by unauthorized users; the actual data sensitivity depends on MISP deployment configuration."],"capecRationale":[{"capecId":"CAPEC-126","rationale":"The closest plausible attack pattern is Forced Browsing, where an attacker accesses a resource (the previewEventAttributes endpoint) that should be restricted by the ACL. The typo in the ACL key may cause the authorization check to fail to deny access, effectively allowing a user without the theming_enabled permission to reach the endpoint. Uncertainty: the exact ACL evaluation behavior on a non-matching rule (default-deny vs. default-allow) is not visible in the patch, so it is also possible the typo causes a denial rather than a bypass. CAPEC-126 is selected as the best available match for an access-control bypass via misconfiguration."}],"commit":"5ac8d1e4dea72f71bec3789350b748f0ad21c42c","confidence":"medium","credits":[{"lang":"en","type":"remediation developer","value":"Thomas Lacroix"}],"cvssRationale":"AV:N: MISP is a network-accessible web application. AC:L: The vulnerability is a static typo in configuration; no race or complex condition is needed. AT:N: No attack target manipulation required. PR:L: The attacker must be an authenticated MISP user to reach the endpoint. UI:N: No victim interaction needed. VC:L: If the ACL bypass is confirmed, an unauthorized user could view event attribute data (limited confidentiality impact). VI:N and VA:N: No integrity or availability impact is evident from the patch. SC/SI/SA:N: No secondary system impact. The overall severity is Low, reflecting a single-endpoint access control misconfiguration with limited data exposure.","fixSummary":"The fix corrects the ACL permission key for the previewEventAttributes action from the malformed string 'theming_enabled*' to the correct 'theming_enabled', restoring the intended access control restriction so that only users holding the theming_enabled permission can invoke the endpoint, consistent with the adjacent previewEventObjects entry.","generatedAt":"2026-09-22T14:55:18.958107Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":9,"assumptionCount":5,"confidence":"medium","model":"qwen3.8:27b","score":5}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"c102952ebfaba16a0d028044d1bc0ab063381442b99de01bfc592144f2de9cc5","patchSummary":"In app/Controller/Component/ACLComponent.php (line 473), the ACL array value for the 'previewEventAttributes' key was changed from ['theming_enabled*'] to ['theming_enabled'], removing the erroneous trailing asterisk that made the permission string non-matching. One line changed, one insertion, one deletion.","patchTruncated":false,"patches":[{"commit":"5ac8d1e4dea72f71bec3789350b748f0ad21c42c","patchSha256":"c102952ebfaba16a0d028044d1bc0ab063381442b99de01bfc592144f2de9cc5","source":"https://github.com/MISP/MISP/commit/5ac8d1e4d.patch","sourceUrl":"https://github.com/MISP/MISP/commit/5ac8d1e4d.patch","subject":"fix: [ACL] typo in previewEventAttributes key"}],"source":"https://github.com/MISP/MISP/commit/5ac8d1e4d.patch","subject":"fix: [ACL] typo in previewEventAttributes key","tagVersionBoundary":{"commits_after_fix":227,"repository":"https://github.com/MISP/MISP","tag":"v2.5.47","version":"2.5.47","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-285","rationale":"The ACL rule for previewEventAttributes contained a typo ('theming_enabled*') that prevented the authorization check from matching the intended permission, causing the access control mechanism to not enforce the restriction as designed. This is a direct failure of the authorization logic due to a misconfigured rule."}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20240"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-95805","datePublished":"2026-09-22T14:59:22.041Z","dateReserved":"2026-09-22T14:59:19.797Z","dateUpdated":"2026-09-22T15:53:42.092Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-22 16:18:24","lastModifiedDate":"2026-09-22 16:18:24","problem_types":["CWE-285","CWE-285 CWE-285 Improper Authorization"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-22T15:53:31.726592Z","id":"CVE-2026-95805","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"95805","Ordinal":"1","Title":"MISP ACLComponent: Typo in previewEventAttributes ACL key bypass","CVE":"CVE-2026-95805","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"95805","Ordinal":"1","NoteData":"A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'theming_enabled*' (with a trailing asterisk) instead of the correct 'theming_enabled'. In the MISP ACL system, the array values define which role or permission grants access to a given controller action. The adjacent entry previewEventObjects correctly uses ['theming_enabled'], confirming the intended restriction. The malformed key 'theming_enabled*' does not match any valid permission identifier, causing the access control check for previewEventAttributes to malfunction. Depending on the ACL evaluation logic, this could result in either unauthorized users gaining access to the previewEventAttributes endpoint (authorization bypass) or legitimate users being denied access (availability impact). \n\nThe previewEventAttributes endpoint exposes event attribute data within MISP so an authorization bypass could expose sensitive indicator and attribute data to users who should not have access.","Type":"Description","Title":"MISP ACLComponent: Typo in previewEventAttributes ACL key bypass"}]}}}