CVE-2026-86408

MISP versions up to and including 2.5.45 fail to enforce parent-event visibility in CryptographicKeysController::view(), a missing object-level authorization check (CWE-639/CWE-862). Any authenticated MISP user can send a request to the cryptographic keys view endpoint with a key ID and receive sensitive fields (type, key_data, fingerprint) for keys attached to events they are not authorized to see, including the signing keys of protected events. An attacker gains disclosure of key material and fingerprints belonging to restricted or protected events, which can undermine event-level protection and key-based verification workflows. All MISP deployments running version 2.5.45 or earlier are affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates a 0.2% chance of exploitation within 30 days.

What to do: Upgrade MISP to a release later than 2.5.45 that includes the upstream patch adding parent_id/parent_type lookup and event-level authorization via fetchSimpleEvent. As an interim mitigation, restrict cryptographicKeys/view access to trusted authenticated users and limit site-admin-only access for non-event key parents. Review access logs for authenticated requests to this endpoint that returned keys belonging to protected events.