CVE-2026-86283

MISP's bundled UiBeta theme contained a presentation-layer authorization bypass: the collection view template (app/View/Themed/UiBeta/Collections/view.ctp) re-queried member event UUIDs using only an Event.uuid IN (...) condition, omitting the createEventConditions() per-user ACL filter that the CollectionsController::view() action correctly applied via Event::fetchSimpleEvents(). Because collection element UUIDs are accepted from the collection owner without server-side validation against the referenced event, any authenticated user who can view a shared collection could trigger the bypass. An attacker gains full details of events they are not permitted to read, including identifiers, info, dates, timestamps, creator organization, all event tags, and galaxy clusters (which used a cluster-scoped rather than event-scoped ACL check). MISP instances running the UiBeta theme where collections are shared across event-level permission boundaries are affected. No public proof-of-concept, KEV listing, or in-the-wild exploitation is known; EPSS estimates only a 0.2% probability of exploitation in the next 30 days.

What to do: Upgrade MISP to the patched release when published (no fixed version number is specified in the available data) and verify whether the UiBeta theme is enabled on your instance. As an interim mitigation, switch affected instances to the default theme and restrict collection sharing to users already authorized to read all referenced events. Audit existing collections for element UUIDs that reference events beyond viewers' ACLs to determine whether restricted event data was exposed.