CVE-2026-91846

MISP versions up to and including 2.5.45 fail to consistently enforce access control when collection elements are created from bare UUIDs, because collection elements store only UUIDs that are later resolved to their underlying objects. An authenticated user with low privileges could abuse the generic add() path (and addElementToCollection()) to persist the UUID of an Event or Galaxy Cluster they are not authorized to read, effectively using collections as a reference to another organisation's private data. When the collection view resolves those UUIDs, the underlying objects — including organisation-only events — are disclosed to the unauthorised user, giving high confidentiality impact (CVSS 4.0: 7.1) with minor integrity impact. The flaw affects any self-hosted MISP instance at or below 2.5.45 that has collections enabled and hosts data from multiple organisations or restricted sharing groups. There is no evidence of in-the-wild exploitation and no public PoC is known.

What to do: Upgrade MISP to a release newer than 2.5.45, where authorization is centralized in __assertCanUseElements() and Event/Galaxy Cluster UUIDs are validated against the acting user's ACL on both the add() and addElementToCollection() paths. Audit existing collections for elements referencing event or galaxy cluster UUIDs that their owners could not otherwise access, and review access logs for suspicious collection-element creation by low-privilege users. Restrict or disable the beta collections feature until patched if multi-tenant or organisation-only data is hosted.