CVE-2026-86347

MISP versions 2.5.45 and earlier define the ACL entry for TemplatesController::uploadFile() with a wildcard (*) instead of the intended perm_add requirement, so any authenticated user can call the upload endpoint regardless of role. A low-privileged or read-only user can therefore send repeated upload requests that accept arbitrary content with minimal checks and write files into the app/tmp/files/ directory. The attacker gains a way to consume server disk space, producing a high availability impact (CVSS 4.0 scores this as high), but the commit notes rule out file overwrite, stored XSS, and RCE because uploaded files get random names, the directory is outside the web root, and files are not served over HTTP. Every MISP deployment at or below version 2.5.45 is exposed to this weakness, which is classified under CWE-400 (resource exhaustion) and CWE-862 (missing authorization). No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS puts the 30-day exploitation probability at about 0.3%.

What to do: Upgrade MISP to a release newer than 2.5.45 that includes the ACL fix (perm_add required for templates/uploadFile); as interim mitigation, review which accounts hold low-privilege or read-only credentials on the instance and monitor disk usage of the app/tmp/files/ directory. Do not expect confidentiality or integrity impact — this issue is limited to authenticated users exhausting disk space.