Common Weakness Enumeration

CWE-639

Allowed

Authorization Bypass Through User-Controlled Key

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

5432 vulnerabilities reference this CWE, most recent first.

CVE-2026-20912 (GCVE-0-2026-20912)

Vulnerability from cvelistv5 – Published: 2026-01-22 22:01 – Updated: 2026-07-15 01:20
VLAI
Title
Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure
Summary
Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-23 17:51 UTC
CWE
  • CWE-284 - Improper Access Control
  • CWE-639 - Authorization Bypass Through User-Controlled Key
  • CWE-283 - Unverified Ownership
Assigner
Gitea CNA under the mitre root
CNA scorecard C 61/100 over 165 records in the last 180 days details
References
Impacted products
Vendor Product Version
Gitea Gitea Open Source Git Server Affected: 0 , ≤ 1.25.3 (semver)
Create a notification for this product.
Red Hat OpenShift Pipelines     cpe:/a:redhat:openshift_pipelines:1
Create a notification for this product.
Credits
spingARbor
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-20912",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-23T17:51:12.073308Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-23T21:53:41.649Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-pipelines/pipelines-opc-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel8",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel8",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-01-22T22:01:52.026Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "An access control flaw has been discovered in Gitea. Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Critical"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-283",
                "description": "Unverified Ownership",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T01:20:07.394Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-20912"
          },
          {
            "name": "RHBZ#2432219",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2432219"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20912.json"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-01-22T23:02:45.929Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-01-22T22:01:52.026Z",
            "value": "Made public."
          }
        ],
        "title": "gitea: Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Gitea Open Source Git Server",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThanOrEqual": "1.25.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "spingARbor"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-22T22:01:52.026Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-vfmv-f93v-37mw"
        },
        {
          "name": "GitHub Pull Request #36320",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/36320"
        },
        {
          "name": "GitHub Pull Request #36355",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/36355"
        },
        {
          "name": "Gitea v1.25.4 Release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.4"
        },
        {
          "name": "Gitea v1.25.4 Release Blog Post",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-1.25.4/"
        }
      ],
      "title": "Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-20912",
    "datePublished": "2026-01-22T22:01:52.026Z",
    "dateReserved": "2026-01-08T23:02:37.548Z",
    "dateUpdated": "2026-07-15T01:20:07.394Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-20904 (GCVE-0-2026-20904)

Vulnerability from cvelistv5 – Published: 2026-01-22 22:01 – Updated: 2026-01-23 21:53
VLAI
Title
Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes
Summary
Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-23 17:52 UTC
CWE
  • CWE-284 - Improper Access Control
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
Gitea CNA under the mitre root
CNA scorecard C 61/100 over 165 records in the last 180 days details
References
Impacted products
Vendor Product Version
Gitea Gitea Open Source Git Server Affected: 0 , ≤ 1.25.3 (semver)
Create a notification for this product.
Credits
spingARbor
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-20904",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-23T17:52:05.088654Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-23T21:53:53.397Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Gitea Open Source Git Server",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThanOrEqual": "1.25.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "spingARbor"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users\u0027 OpenID identities."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-22T22:01:51.762Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-jrpc-w85r-hgqx"
        },
        {
          "name": "GitHub Pull Request #36346",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/36346"
        },
        {
          "name": "GitHub Pull Request #36361",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/36361"
        },
        {
          "name": "Gitea v1.25.4 Release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.4"
        },
        {
          "name": "Gitea v1.25.4 Release Blog Post",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-1.25.4/"
        }
      ],
      "title": "Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-20904",
    "datePublished": "2026-01-22T22:01:51.762Z",
    "dateReserved": "2026-01-08T23:02:37.537Z",
    "dateUpdated": "2026-01-23T21:53:53.397Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-20897 (GCVE-0-2026-20897)

Vulnerability from cvelistv5 – Published: 2026-01-22 22:01 – Updated: 2026-07-15 01:20
VLAI
Title
Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)
Summary
Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-23 17:56 UTC
CWE
  • CWE-284 - Improper Access Control
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
Gitea CNA under the mitre root
CNA scorecard C 61/100 over 165 records in the last 180 days details
References
Impacted products
Vendor Product Version
Gitea Gitea Open Source Git Server Affected: 0 , ≤ 1.25.3 (semver)
Create a notification for this product.
Red Hat OpenShift Pipelines     cpe:/a:redhat:openshift_pipelines:1
Create a notification for this product.
Credits
spingARbor
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-20897",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-23T17:56:55.236953Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-23T21:54:06.525Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-pipelines/pipelines-opc-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel8",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel8",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-01-22T22:01:51.508Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "An access control flaw has been discovered in Gitea. Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Critical"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-639",
                "description": "Authorization Bypass Through User-Controlled Key",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T01:20:11.688Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-20897"
          },
          {
            "name": "RHBZ#2432204",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2432204"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20897.json"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-01-22T23:01:23.773Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-01-22T22:01:51.508Z",
            "value": "Made public."
          }
        ],
        "title": "gitea: Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Gitea Open Source Git Server",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThanOrEqual": "1.25.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "spingARbor"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-22T22:01:51.508Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-rrq5-r9h5-pc7c"
        },
        {
          "name": "GitHub Pull Request #36344",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/36344"
        },
        {
          "name": "GitHub Pull Request #36349",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/36349"
        },
        {
          "name": "Gitea v1.25.4 Release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.4"
        },
        {
          "name": "Gitea v1.25.4 Release Blog Post",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-1.25.4/"
        }
      ],
      "title": "Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-20897",
    "datePublished": "2026-01-22T22:01:51.508Z",
    "dateReserved": "2026-01-08T23:02:37.525Z",
    "dateUpdated": "2026-07-15T01:20:11.688Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-20342 (GCVE-0-2026-20342)

Vulnerability from cvelistv5 – Published: 2026-09-16 20:15 – Updated: 2026-09-17 13:40
VLAI
Title
Cisco Secure Firewall Management Center Software Low Privileged Arbitrary File Download Vulnerability
Summary
A vulnerability in a specific file download API of Cisco Secure FMC Software could allow an authenticated, remote attacker to download arbitrary files from an affected system. This vulnerability exists because user input is not being sanitized. An attacker could exploit this vulnerability by sending a crafted HTTPS request. A successful exploit could allow the attacker to download arbitrary files from the affected system. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Security Analyst (read-only).
Severity
7.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 13:32 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
cisco CNA under the mitre root
CNA scorecard C 66/100 over 443 records in the last 180 days details
References
Impacted products
Vendor Product Version
Cisco Cisco Secure Firewall Management Center (FMC) Affected: 7.0.0
Affected: 7.0.0.1
Affected: 7.0.1
Affected: 7.0.1.1
Affected: 7.0.2
Affected: 7.2.0
Affected: 7.0.2.1
Affected: 7.0.3
Affected: 7.2.0.1
Affected: 7.0.4
Affected: 7.2.1
Affected: 7.0.5
Affected: 7.3.0
Affected: 7.2.2
Affected: 7.3.1
Affected: 7.2.3
Affected: 7.2.3.1
Affected: 7.2.4
Affected: 7.0.6
Affected: 7.2.4.1
Affected: 7.2.5
Affected: 7.3.1.1
Affected: 7.4.0
Affected: 7.0.6.1
Affected: 7.2.5.1
Affected: 7.4.1
Affected: 7.2.6
Affected: 7.4.1.1
Affected: 7.0.6.2
Affected: 7.2.7
Affected: 7.2.5.2
Affected: 7.3.1.2
Affected: 7.2.8
Affected: 7.6.0
Affected: 7.4.2
Affected: 7.2.8.1
Affected: 7.0.6.3
Affected: 7.4.2.1
Affected: 7.2.9
Affected: 7.0.7
Affected: 7.7.0
Affected: 7.4.2.2
Affected: 7.2.10
Affected: 7.6.1
Affected: 7.4.2.3
Affected: 7.0.8
Affected: 7.6.2
Affected: 7.7.10
Affected: 7.2.10.1
Affected: 7.0.8.1
Affected: 7.6.2.1
Affected: 7.2.10.2
Affected: 7.7.10.1
Affected: 7.4.2.4
Affected: 7.4.3
Affected: 7.6.3
Affected: 7.7.11
Affected: 7.6.4
Affected: 10.0.0
Affected: 7.4.4
Affected: 7.4.5
Affected: 7.0.9
Affected: 7.2.11
Affected: 7.7.12
Affected: 7.6.5
Affected: 7.4.6
Affected: 10.0.1
Affected: 7.4.7
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-20342",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T13:32:55.850490Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T13:40:58.735Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Secure Firewall Management Center (FMC)",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.0"
            },
            {
              "status": "affected",
              "version": "7.0.0.1"
            },
            {
              "status": "affected",
              "version": "7.0.1"
            },
            {
              "status": "affected",
              "version": "7.0.1.1"
            },
            {
              "status": "affected",
              "version": "7.0.2"
            },
            {
              "status": "affected",
              "version": "7.2.0"
            },
            {
              "status": "affected",
              "version": "7.0.2.1"
            },
            {
              "status": "affected",
              "version": "7.0.3"
            },
            {
              "status": "affected",
              "version": "7.2.0.1"
            },
            {
              "status": "affected",
              "version": "7.0.4"
            },
            {
              "status": "affected",
              "version": "7.2.1"
            },
            {
              "status": "affected",
              "version": "7.0.5"
            },
            {
              "status": "affected",
              "version": "7.3.0"
            },
            {
              "status": "affected",
              "version": "7.2.2"
            },
            {
              "status": "affected",
              "version": "7.3.1"
            },
            {
              "status": "affected",
              "version": "7.2.3"
            },
            {
              "status": "affected",
              "version": "7.2.3.1"
            },
            {
              "status": "affected",
              "version": "7.2.4"
            },
            {
              "status": "affected",
              "version": "7.0.6"
            },
            {
              "status": "affected",
              "version": "7.2.4.1"
            },
            {
              "status": "affected",
              "version": "7.2.5"
            },
            {
              "status": "affected",
              "version": "7.3.1.1"
            },
            {
              "status": "affected",
              "version": "7.4.0"
            },
            {
              "status": "affected",
              "version": "7.0.6.1"
            },
            {
              "status": "affected",
              "version": "7.2.5.1"
            },
            {
              "status": "affected",
              "version": "7.4.1"
            },
            {
              "status": "affected",
              "version": "7.2.6"
            },
            {
              "status": "affected",
              "version": "7.4.1.1"
            },
            {
              "status": "affected",
              "version": "7.0.6.2"
            },
            {
              "status": "affected",
              "version": "7.2.7"
            },
            {
              "status": "affected",
              "version": "7.2.5.2"
            },
            {
              "status": "affected",
              "version": "7.3.1.2"
            },
            {
              "status": "affected",
              "version": "7.2.8"
            },
            {
              "status": "affected",
              "version": "7.6.0"
            },
            {
              "status": "affected",
              "version": "7.4.2"
            },
            {
              "status": "affected",
              "version": "7.2.8.1"
            },
            {
              "status": "affected",
              "version": "7.0.6.3"
            },
            {
              "status": "affected",
              "version": "7.4.2.1"
            },
            {
              "status": "affected",
              "version": "7.2.9"
            },
            {
              "status": "affected",
              "version": "7.0.7"
            },
            {
              "status": "affected",
              "version": "7.7.0"
            },
            {
              "status": "affected",
              "version": "7.4.2.2"
            },
            {
              "status": "affected",
              "version": "7.2.10"
            },
            {
              "status": "affected",
              "version": "7.6.1"
            },
            {
              "status": "affected",
              "version": "7.4.2.3"
            },
            {
              "status": "affected",
              "version": "7.0.8"
            },
            {
              "status": "affected",
              "version": "7.6.2"
            },
            {
              "status": "affected",
              "version": "7.7.10"
            },
            {
              "status": "affected",
              "version": "7.2.10.1"
            },
            {
              "status": "affected",
              "version": "7.0.8.1"
            },
            {
              "status": "affected",
              "version": "7.6.2.1"
            },
            {
              "status": "affected",
              "version": "7.2.10.2"
            },
            {
              "status": "affected",
              "version": "7.7.10.1"
            },
            {
              "status": "affected",
              "version": "7.4.2.4"
            },
            {
              "status": "affected",
              "version": "7.4.3"
            },
            {
              "status": "affected",
              "version": "7.6.3"
            },
            {
              "status": "affected",
              "version": "7.7.11"
            },
            {
              "status": "affected",
              "version": "7.6.4"
            },
            {
              "status": "affected",
              "version": "10.0.0"
            },
            {
              "status": "affected",
              "version": "7.4.4"
            },
            {
              "status": "affected",
              "version": "7.4.5"
            },
            {
              "status": "affected",
              "version": "7.0.9"
            },
            {
              "status": "affected",
              "version": "7.2.11"
            },
            {
              "status": "affected",
              "version": "7.7.12"
            },
            {
              "status": "affected",
              "version": "7.6.5"
            },
            {
              "status": "affected",
              "version": "7.4.6"
            },
            {
              "status": "affected",
              "version": "10.0.1"
            },
            {
              "status": "affected",
              "version": "7.4.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in a specific file download API of Cisco Secure FMC Software could allow an authenticated, remote attacker to download arbitrary files from an affected system.\r\n\r\nThis vulnerability exists because user input is not being sanitized. An attacker could exploit this vulnerability by sending a crafted HTTPS request. A successful exploit could allow the attacker to download arbitrary files from the affected system.\r\nTo exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Security Analyst (read-only)."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T20:15:43.778Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-fmc-mulivulns-4PsnFwvx",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-mulivulns-4PsnFwvx"
        }
      ],
      "source": {
        "advisory": "cisco-sa-fmc-mulivulns-4PsnFwvx",
        "defects": [
          "CSCwu42586"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco Secure Firewall Management Center Software Low Privileged Arbitrary File Download Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-20342",
    "datePublished": "2026-09-16T20:15:43.778Z",
    "dateReserved": "2025-10-08T11:59:15.413Z",
    "dateUpdated": "2026-09-17T13:40:58.735Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1-2026-20285 (CVE-2026-95683)

Vulnerability from gna-1 – Published: 2026-09-22 14:06 – Updated: 2026-09-22 14:06
VLAI
Title
MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL
Summary
In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event's distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed. The result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report's own access-control policy. The vulnerability requires an authenticated MISP user with at least read access to the affected event.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-862 - Missing Authorization
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
CIRCL GNA GNA-1
GNA scorecard A 90/100 over 252 records in the last 180 days details
References
Impacted products
Vendor Product Version
MISP MISP Affected: 0 , < 2.5.47 (semver)
Create a notification for this product.
Credits
Jeroen Pinoy iglocska Claude Fable 5.1
GCVE extensions
bcp-05-x-01
AI-assisted vulnerability information annotation
GCVE-BCP-05-X-01
Whole record AI-generated Not human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
bcp-05-x-02
Patch-to-vulnerability generation provenance
GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-09-22 13:58
Model
qwen3.8:27b
Input
https://github.com/MISP/MISP/commit/6932aace8.patch d3472acf034e…
Confidence
medium
Commit Subject Patch SHA-256
6932aace8445 fix: [security] Apply the caller's ACL to the event view's d3472acf034e…
Fix summary

The report fetch in the Overmind event enrichment now applies the caller's ACL via EventReport::buildACLConditions($user), enforcing the report's own distribution policy in addition to the event-level access. A condition on EventReport.deleted = 0 is also added to exclude soft-deleted reports. The query is further hardened with recursive = -1 and an explicit contain clause to limit the data retrieved.

Patch summary

In app/Controller/EventsController.php, the __enrichEvent() method's report lookup is changed from a simple event_id condition to a composite condition built from EventReport::buildACLConditions($user) combined with EventReport.event_id and EventReport.deleted = 0. The find() call is updated to use the new $reportConditions array, adds 'contain' => EventReport::DEFAULT_CONTAIN, and sets 'recursive' => -1 to prevent unnecessary eager-loading of associated models.

CVSS rationale

AV:N: MISP is a network-accessible web application. AC:L: An authenticated user with read access to any event simply views it in the Overmind interface; no race conditions, special timing, or complex manipulation are required. AT:N: No attack-target manipulation is needed. PR:L: The attacker must be an authenticated MISP user with at least read permission on the event; no administrative privileges are required. UI:N: No victim interaction beyond the attacker's own viewing action. VC:H: Sensitive threat-intelligence report content (IOCs, analysis, context) is disclosed to a user the report's distribution explicitly excludes. VI:N, VA:N: No integrity or availability impact. SC:N, SI:N, SA:N: The impact is confined to the MISP instance's own data; no cross-system impact is evidenced.

Weakness rationale
  • CWE-862 The report's own ACL/distribution check was entirely absent from the Overmind event-view enrichment path. The code fetched the report by event ID without invoking buildACLConditions(), so the report-level authorization policy was never enforced for this code path.
  • CWE-639 The event ID, which is a user-controllable identifier in the request, was used as the sole key to retrieve a report resource whose access should be independently governed by the report's distribution. This allowed bypass of the report's authorization by leveraging the event-level access.
Attack pattern rationale
  • CAPEC-126 The access control for the EventReport resource was incorrectly configured (or absent) in the Overmind event-view code path: the report's distribution ACL was not applied, effectively leaving the resource accessible to any user who could see the parent event. This is the closest CAPEC to a missing/incomplete authorization check on a specific resource. The mapping is slightly uncertain because the flaw is a missing check rather than a misconfiguration of an existing check, but CAPEC-126 is the best available match for an access-control enforcement gap on a specific object.
Assumptions to verify
  • The tag_version_boundary (v2.5.47, 57 commits after fix) is used as the nearest known version boundary; the exact first fixed release is not explicitly stated in the patch metadata, so the affected range is marked as less_than 2.5.47 with 'unspecified' version.
  • CVSS PR:L assumes the attacker needs only a standard authenticated MISP account with read access to the event; the specific role/permission level required is not detailed in the patch.
  • CVSS VC:H assumes the report content constitutes sensitive threat-intelligence data; the actual sensitivity depends on the report's content and the organization's data classification.
  • CAPEC-126 is selected as the closest match; the flaw is more precisely a missing authorization check (CWE-862) rather than a misconfiguration of an existing control, but no CAPEC entry specifically covers 'missing authorization on a sub-resource' more precisely.
  • The patch does not include test cases or reproduction steps; exploitability assessment is based solely on the code diff and commit message.
  • The 'Overmind' feature is assumed to be a MISP UI component for event viewing; its exact configuration and deployment context are not specified in the patch.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 4 9 medium 6
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "modules": [
            "EventsController (Overmind event view / __enrichEvent)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/EventsController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Fable 5.1"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report\u0027s own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event\u0027s distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed.\u003c/p\u003e\u003cp\u003eThe result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report\u0027s own access-control policy.\u003c/p\u003e\u003cp\u003eThe vulnerability requires an authenticated MISP user with at least read access to the affected event.\u003c/p\u003e"
            }
          ],
          "value": "In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report\u0027s own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event\u0027s distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed.\n\nThe result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report\u0027s own access-control policy.\n\nThe vulnerability requires an authenticated MISP user with at least read access to the affected event."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Exploiting Incorrectly Configured Access Controls"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/6932aace8"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe report fetch in the Overmind event enrichment now applies the caller\u0027s ACL via EventReport::buildACLConditions($user), enforcing the report\u0027s own distribution policy in addition to the event-level access. A condition on EventReport.deleted = 0 is also added to exclude soft-deleted reports. The query is further hardened with recursive = -1 and an explicit contain clause to limit the data retrieved.\u003c/p\u003e"
            }
          ],
          "value": "The report fetch in the Overmind event enrichment now applies the caller\u0027s ACL via EventReport::buildACLConditions($user), enforcing the report\u0027s own distribution policy in addition to the event-level access. A condition on EventReport.deleted = 0 is also added to exclude soft-deleted reports. The query is further hardened with recursive = -1 and an explicit contain clause to limit the data retrieved."
        }
      ],
      "title": "MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "none",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The tag_version_boundary (v2.5.47, 57 commits after fix) is used as the nearest known version boundary; the exact first fixed release is not explicitly stated in the patch metadata, so the affected range is marked as less_than 2.5.47 with \u0027unspecified\u0027 version.",
                  "CVSS PR:L assumes the attacker needs only a standard authenticated MISP account with read access to the event; the specific role/permission level required is not detailed in the patch.",
                  "CVSS VC:H assumes the report content constitutes sensitive threat-intelligence data; the actual sensitivity depends on the report\u0027s content and the organization\u0027s data classification.",
                  "CAPEC-126 is selected as the closest match; the flaw is more precisely a missing authorization check (CWE-862) rather than a misconfiguration of an existing control, but no CAPEC entry specifically covers \u0027missing authorization on a sub-resource\u0027 more precisely.",
                  "The patch does not include test cases or reproduction steps; exploitability assessment is based solely on the code diff and commit message.",
                  "The \u0027Overmind\u0027 feature is assumed to be a MISP UI component for event viewing; its exact configuration and deployment context are not specified in the patch."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The access control for the EventReport resource was incorrectly configured (or absent) in the Overmind event-view code path: the report\u0027s distribution ACL was not applied, effectively leaving the resource accessible to any user who could see the parent event. This is the closest CAPEC to a missing/incomplete authorization check on a specific resource. The mapping is slightly uncertain because the flaw is a missing check rather than a misconfiguration of an existing check, but CAPEC-126 is the best available match for an access-control enforcement gap on a specific object."
                  }
                ],
                "commit": "6932aace844520526819253ea285def97e48189e",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Fable 5.1"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: An authenticated user with read access to any event simply views it in the Overmind interface; no race conditions, special timing, or complex manipulation are required. AT:N: No attack-target manipulation is needed. PR:L: The attacker must be an authenticated MISP user with at least read permission on the event; no administrative privileges are required. UI:N: No victim interaction beyond the attacker\u0027s own viewing action. VC:H: Sensitive threat-intelligence report content (IOCs, analysis, context) is disclosed to a user the report\u0027s distribution explicitly excludes. VI:N, VA:N: No integrity or availability impact. SC:N, SI:N, SA:N: The impact is confined to the MISP instance\u0027s own data; no cross-system impact is evidenced.",
                "fixSummary": "The report fetch in the Overmind event enrichment now applies the caller\u0027s ACL via EventReport::buildACLConditions($user), enforcing the report\u0027s own distribution policy in addition to the event-level access. A condition on EventReport.deleted = 0 is also added to exclude soft-deleted reports. The query is further hardened with recursive = -1 and an explicit contain clause to limit the data retrieved.",
                "generatedAt": "2026-09-22T13:58:09.551694Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 6,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 4
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "d3472acf034e415d9322bc1f5f399efb811afbb547bc230fe69d2e83c2975dd2",
                "patchSummary": "In app/Controller/EventsController.php, the __enrichEvent() method\u0027s report lookup is changed from a simple event_id condition to a composite condition built from EventReport::buildACLConditions($user) combined with EventReport.event_id and EventReport.deleted = 0. The find() call is updated to use the new $reportConditions array, adds \u0027contain\u0027 =\u003e EventReport::DEFAULT_CONTAIN, and sets \u0027recursive\u0027 =\u003e -1 to prevent unnecessary eager-loading of associated models.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "6932aace844520526819253ea285def97e48189e",
                    "patchSha256": "d3472acf034e415d9322bc1f5f399efb811afbb547bc230fe69d2e83c2975dd2",
                    "source": "https://github.com/MISP/MISP/commit/6932aace8.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/6932aace8.patch",
                    "subject": "fix: [security] Apply the caller\u0027s ACL to the event view\u0027s"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/6932aace8.patch",
                "subject": "fix: [security] Apply the caller\u0027s ACL to the event view\u0027s",
                "tagVersionBoundary": {
                  "commits_after_fix": 57,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The report\u0027s own ACL/distribution check was entirely absent from the Overmind event-view enrichment path. The code fetched the report by event ID without invoking buildACLConditions(), so the report-level authorization policy was never enforced for this code path."
                  },
                  {
                    "cweId": "CWE-639",
                    "rationale": "The event ID, which is a user-controllable identifier in the request, was used as the sole key to retrieve a report resource whose access should be independently governed by the report\u0027s distribution. This allowed bypass of the report\u0027s authorization by leveraging the event-level access."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20285"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-95683",
    "datePublished": "2026-09-22T14:06:46.948190Z",
    "dateReserved": "2026-09-22T14:06:57.011Z",
    "dateUpdated": "2026-09-22T14:06:57.790167Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20285"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GCVE-1-2026-20280 (CVE-2026-103237)

Vulnerability from gna-1 – Published: 2026-09-30 09:56 – Updated: 2026-09-30 09:56
VLAI
Title
MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows
Summary
MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints (attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit), the application sanitizes the flat record by stripping the primary key and pinning the event_id or object_id to the caller's context. However, the underlying ORM's set() method gives priority to a nested key whose name matches the model alias and discards the outer scalar fields. An authenticated user with basic write permissions can exploit this by embedding a nested block under the model alias key inside their request. The sanitization logic (id removal, event_id pinning) is applied to the outer record, but the ORM binds to the inner record instead, which carries an attacker-chosen id and event_id. This allows the attacker to overwrite, re-parent, or soft-delete rows belonging to other organizations or events they have no read access to. Impact: - Cross-tenant data integrity compromise (attribute values rewritten, objects re-parented to attacker events, rows soft-deleted) - Affects multiple entity types: Attribute, Object, EventReport, Sighting, AttributeTag, ShadowAttribute - Requires only a low-privilege authenticated account with perm_add Affected versions: <2.5.48
Severity
8.3 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
  • CWE-20 - Improper Input Validation
Assigner
CIRCL GNA GNA-1
GNA scorecard A 90/100 over 252 records in the last 180 days details
References
Impacted products
Vendor Product Version
MISP MISP Affected: 0 , < 2.5.48 (semver)
    cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Jeroen Pinoy iglocska Claude Opus 5
GCVE extensions
bcp-05-x-01
AI-assisted vulnerability information annotation
GCVE-BCP-05-X-01
Whole record AI-generated Human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
bcp-05-x-02
Patch-to-vulnerability generation provenance
GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-09-30 09:24
Model
qwen3.8:27b
Input
https://github.com/MISP/MISP/commit/9485ae40d.patch 03af388a5ac0…
Confidence
high
Commit Subject Patch SHA-256
9485ae40d334 fix: [security] A nested model alias key no longer selects 03af388a5ac0…
Fix summary

The fix introduces a defensive save() override in the base model class that refuses to persist any record where the data array simultaneously contains a nested key matching the model alias and other top-level scalar fields, logging a warning and returning false. Additionally, all code paths that sanitize and save records (free-text import, module result processing, object delta merge, attribute bulk edit, sighting capture, shadow attribute proposal, event report creation) now explicitly unset the nested alias key from the data array before calling save(), ensuring the ORM cannot be redirected to an attacker-chosen row. Controller-level request reshaping was also corrected to avoid creating self-referencing data structures.

Patch summary

Added a save() override in AppModel.php that detects and rejects ambiguous payloads containing both a nested model-alias key and outer scalars. Added unset($data[$this->alias]) calls in Event.php (free-text, module results, object attribute save), MispAttribute.php (saveAttributes, captureAttribute, editAttributeBulk), MispObject.php (deltaMerge, editObject), ShadowAttribute.php (__preCaptureMassage), and Sighting.php (captureSightings) to strip the nested alias key before save. Changed six controller files to use $this->request->data = array('Model' => $this->request->data) instead of $this->request->data['Model'] = $this->request->data, preventing self-referencing structures. Added a new regression test suite (tests/testregressions.py) with cross-tenant attack scenarios and wired it into the CI workflow.

CVSS rationale

AV:N - MISP is a network-accessible web application. AC:L - The attack requires only crafting a request with a nested alias key; no race condition or complex state is needed. AT:N - No in-transit tampering required. PR:L - An authenticated user with basic write permission (perm_add) suffices; no admin or sync role needed. UI:N - No victim interaction required. VC:N - The attacker does not gain new read access; the impact is on data they can already partially see or infer. VI:H - The attacker can overwrite, re-parent, or soft-delete rows in the same instance, causing high integrity loss to the vulnerable component's data. VA:N - Soft-delete is a state change (integrity) rather than a service disruption. SC:N - No impact on separate components' confidentiality. SI:H - The cross-tenant nature means integrity of other organizations' data (a separate security scope) is compromised. SA:N - No security mechanism is weakened.

Weakness rationale
  • CWE-639 The attacker controls the row identifier (id) inside the nested alias block, which the ORM uses to select the target row. The application's authorization and sanitization (id stripping, event_id pinning) is applied to the outer record and is bypassed because the ORM binds to the inner record. This is a direct case of a user-controlled key selecting an unauthorized resource.
  • CWE-20 The application fails to validate or strip the nested model-alias key from user-supplied data before passing it to the ORM. The ORM's set() method interprets this key as the record to save, contradicting the application's intent. The absence of validation on this structural aspect of the input is the root cause.
Attack pattern rationale
  • CAPEC-24 The attacker tampers with the structure of request parameters by injecting a nested key matching the model alias, causing the ORM to target a different row than the application intended. The outer parameters (sanitized id, pinned event_id) are effectively ignored in favor of the attacker-controlled inner parameters. This is a structural parameter tampering attack exploiting the ORM's data-binding semantics. The mapping is the closest available CAPEC; no more specific pattern for ORM-level key injection exists in the CAPEC catalog.
Assumptions to verify
  • The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48); the exact last affected release and first fixed release are not explicitly stated in the patch.
  • PR:L assumes the attacker needs only a basic authenticated account with perm_add; the regression tests confirm a non-admin, non-sync role suffices, but the minimum permission set is not exhaustively enumerated in the patch.
  • VA:N assumes soft-delete is treated as an integrity impact (data state change) rather than an availability impact; if the organization considers soft-deleted records as unavailable, VA could be raised to L.
  • CAPEC-24 (Parameter Tampering) is the closest available pattern; the specific ORM-level key-binding manipulation does not have a dedicated CAPEC entry, so the mapping is approximate.
  • The Co-Authored-By line references an AI tool (Claude Opus 5); it is listed as a tool credit, not a human remediation developer, per CVE credit role semantics.
  • The commit date is 2026-09-25; the vulnerability may have existed for an unknown duration prior to reporting.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 5 9 high 6
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "AttributesController",
            "EventReportsController",
            "EventsController",
            "ObjectReferencesController",
            "ShadowAttributesController",
            "UsersController",
            "AppModel",
            "Event model",
            "MispAttribute model",
            "MispObject model",
            "ShadowAttribute model",
            "Sighting model"
          ],
          "product": "MISP",
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints (attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit), the application sanitizes the flat record by stripping the primary key and pinning the event_id or object_id to the caller\u0027s context. However, the underlying ORM\u0027s set() method gives priority to a nested key whose name matches the model alias and discards the outer scalar fields.\u003c/p\u003e\u003cp\u003eAn authenticated user with basic write permissions can exploit this by embedding a nested block under the model alias key inside their request. The sanitization logic (id removal, event_id pinning) is applied to the outer record, but the ORM binds to the inner record instead, which carries an attacker-chosen id and event_id. This allows the attacker to overwrite, re-parent, or soft-delete rows belonging to other organizations or events they have no read access to.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Cross-tenant data integrity compromise (attribute values rewritten, objects re-parented to attacker events, rows soft-deleted)\u003c/p\u003e\u003cp\u003e- Affects multiple entity types: Attribute, Object, EventReport, Sighting, AttributeTag, ShadowAttribute\u003c/p\u003e\u003cp\u003e- Requires only a low-privilege authenticated account with perm_add\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48\u003c/p\u003e"
            }
          ],
          "value": "MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints (attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit), the application sanitizes the flat record by stripping the primary key and pinning the event_id or object_id to the caller\u0027s context. However, the underlying ORM\u0027s set() method gives priority to a nested key whose name matches the model alias and discards the outer scalar fields.\n\nAn authenticated user with basic write permissions can exploit this by embedding a nested block under the model alias key inside their request. The sanitization logic (id removal, event_id pinning) is applied to the outer record, but the ORM binds to the inner record instead, which carries an attacker-chosen id and event_id. This allows the attacker to overwrite, re-parent, or soft-delete rows belonging to other organizations or events they have no read access to.\n\nImpact:\n\n- Cross-tenant data integrity compromise (attribute values rewritten, objects re-parented to attacker events, rows soft-deleted)\n\n- Affects multiple entity types: Attribute, Object, EventReport, Sighting, AttributeTag, ShadowAttribute\n\n- Requires only a low-privilege authenticated account with perm_add\n\nAffected versions: \u003c2.5.48"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-24",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-24 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/9485ae40d"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces a defensive save() override in the base model class that refuses to persist any record where the data array simultaneously contains a nested key matching the model alias and other top-level scalar fields, logging a warning and returning false. Additionally, all code paths that sanitize and save records (free-text import, module result processing, object delta merge, attribute bulk edit, sighting capture, shadow attribute proposal, event report creation) now explicitly unset the nested alias key from the data array before calling save(), ensuring the ORM cannot be redirected to an attacker-chosen row. Controller-level request reshaping was also corrected to avoid creating self-referencing data structures.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces a defensive save() override in the base model class that refuses to persist any record where the data array simultaneously contains a nested key matching the model alias and other top-level scalar fields, logging a warning and returning false. Additionally, all code paths that sanitize and save records (free-text import, module result processing, object delta merge, attribute bulk edit, sighting capture, shadow attribute proposal, event report creation) now explicitly unset the nested alias key from the data array before calling save(), ensuring the ORM cannot be redirected to an attacker-chosen row. Controller-level request reshaping was also corrected to avoid creating self-referencing data structures."
        }
      ],
      "title": "MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48); the exact last affected release and first fixed release are not explicitly stated in the patch.",
                  "PR:L assumes the attacker needs only a basic authenticated account with perm_add; the regression tests confirm a non-admin, non-sync role suffices, but the minimum permission set is not exhaustively enumerated in the patch.",
                  "VA:N assumes soft-delete is treated as an integrity impact (data state change) rather than an availability impact; if the organization considers soft-deleted records as unavailable, VA could be raised to L.",
                  "CAPEC-24 (Parameter Tampering) is the closest available pattern; the specific ORM-level key-binding manipulation does not have a dedicated CAPEC entry, so the mapping is approximate.",
                  "The Co-Authored-By line references an AI tool (Claude Opus 5); it is listed as a tool credit, not a human remediation developer, per CVE credit role semantics.",
                  "The commit date is 2026-09-25; the vulnerability may have existed for an unknown duration prior to reporting."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-24",
                    "rationale": "The attacker tampers with the structure of request parameters by injecting a nested key matching the model alias, causing the ORM to target a different row than the application intended. The outer parameters (sanitized id, pinned event_id) are effectively ignored in favor of the attacker-controlled inner parameters. This is a structural parameter tampering attack exploiting the ORM\u0027s data-binding semantics. The mapping is the closest available CAPEC; no more specific pattern for ORM-level key injection exists in the CAPEC catalog."
                  }
                ],
                "commit": "9485ae40d334471882e3bd246651acaa68feef34",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5"
                  }
                ],
                "cvssRationale": "AV:N - MISP is a network-accessible web application. AC:L - The attack requires only crafting a request with a nested alias key; no race condition or complex state is needed. AT:N - No in-transit tampering required. PR:L - An authenticated user with basic write permission (perm_add) suffices; no admin or sync role needed. UI:N - No victim interaction required. VC:N - The attacker does not gain new read access; the impact is on data they can already partially see or infer. VI:H - The attacker can overwrite, re-parent, or soft-delete rows in the same instance, causing high integrity loss to the vulnerable component\u0027s data. VA:N - Soft-delete is a state change (integrity) rather than a service disruption. SC:N - No impact on separate components\u0027 confidentiality. SI:H - The cross-tenant nature means integrity of other organizations\u0027 data (a separate security scope) is compromised. SA:N - No security mechanism is weakened.",
                "fixSummary": "The fix introduces a defensive save() override in the base model class that refuses to persist any record where the data array simultaneously contains a nested key matching the model alias and other top-level scalar fields, logging a warning and returning false. Additionally, all code paths that sanitize and save records (free-text import, module result processing, object delta merge, attribute bulk edit, sighting capture, shadow attribute proposal, event report creation) now explicitly unset the nested alias key from the data array before calling save(), ensuring the ORM cannot be redirected to an attacker-chosen row. Controller-level request reshaping was also corrected to avoid creating self-referencing data structures.",
                "generatedAt": "2026-09-30T09:24:37.816321Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 6,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "03af388a5ac0d93cebef902e0050aa8496aae8d88d1496b80abc0b9a929cb39a",
                "patchSummary": "Added a save() override in AppModel.php that detects and rejects ambiguous payloads containing both a nested model-alias key and outer scalars. Added unset($data[$this-\u003ealias]) calls in Event.php (free-text, module results, object attribute save), MispAttribute.php (saveAttributes, captureAttribute, editAttributeBulk), MispObject.php (deltaMerge, editObject), ShadowAttribute.php (__preCaptureMassage), and Sighting.php (captureSightings) to strip the nested alias key before save. Changed six controller files to use $this-\u003erequest-\u003edata = array(\u0027Model\u0027 =\u003e $this-\u003erequest-\u003edata) instead of $this-\u003erequest-\u003edata[\u0027Model\u0027] = $this-\u003erequest-\u003edata, preventing self-referencing structures. Added a new regression test suite (tests/testregressions.py) with cross-tenant attack scenarios and wired it into the CI workflow.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "9485ae40d334471882e3bd246651acaa68feef34",
                    "patchSha256": "03af388a5ac0d93cebef902e0050aa8496aae8d88d1496b80abc0b9a929cb39a",
                    "source": "https://github.com/MISP/MISP/commit/9485ae40d.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/9485ae40d.patch",
                    "subject": "fix: [security] A nested model alias key no longer selects"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/9485ae40d.patch",
                "subject": "fix: [security] A nested model alias key no longer selects",
                "tagVersionBoundary": {
                  "commits_after_fix": 23,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-639",
                    "rationale": "The attacker controls the row identifier (id) inside the nested alias block, which the ORM uses to select the target row. The application\u0027s authorization and sanitization (id stripping, event_id pinning) is applied to the outer record and is bypassed because the ORM binds to the inner record. This is a direct case of a user-controlled key selecting an unauthorized resource."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "The application fails to validate or strip the nested model-alias key from user-supplied data before passing it to the ORM. The ORM\u0027s set() method interprets this key as the record to save, contradicting the application\u0027s intent. The absence of validation on this structural aspect of the input is the root cause."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20280"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-103237",
    "datePublished": "2026-09-30T09:56:28.525185Z",
    "dateReserved": "2026-09-30T09:56:33.891Z",
    "dateUpdated": "2026-09-30T09:56:33.959884Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20280"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GCVE-1-2026-20267 (CVE-2026-91846)

Vulnerability from gna-1 – Published: 2026-09-15 08:36 – Updated: 2026-09-15 08:36
VLAI
Title
MISP Collection Element Add Missing Authorization on Referenced Object UUID
Summary
Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object. The commit explains that collection elements themselves only store UUIDs, while the collection view later resolves those UUIDs into their underlying objects. Before this fix, the generic add() path could therefore persist a UUID for an Event or Galaxy Cluster that the caller could not normally read. The patch explicitly notes that this made collections a way to reference another organisation’s private data and had caused disclosure of organisation-only events in the beta collection view. The fix centralizes authorization in __assertCanUseElements(). Event UUIDs are validated through Event::fetchSimpleEvent() under the current user’s ACL, while Galaxy Cluster UUIDs are checked through GalaxyCluster::fetchGalaxyClusters(). The check is applied both to the CRUD add() path and to addElementToCollection(). Version affected: ≤2.5.45
Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-862 - Missing Authorization
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
CIRCL GNA GNA-1
GNA scorecard A 90/100 over 252 records in the last 180 days details
References
Impacted products
Vendor Product Version
MISP MISP Affected: 0 , < 2.5.46 (semver)
Create a notification for this product.
Credits
iglocska Claude Opus 5 (1M context)
GCVE extensions
bcp-05-x-01
AI-assisted vulnerability information annotation
GCVE-BCP-05-X-01
Whole record AI-generated Review: review GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
bcp-05-x-02
Patch-to-vulnerability generation provenance
GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-09-15 08:32
Model
qwen3.8:27b
Input
https://github.com/MISP/MISP/commit/334d53709.patch 259d46cb7727…
Confidence
medium
Commit Subject Patch SHA-256
334d53709597 fix: [acl] Authorise the object a collection element points 259d46cb7727…
Fix summary

The fix introduces a dedicated __assertCanUseElements() authorization guard that is invoked in the beforeSave callback of the add() CRUD path (covering both form and REST submission) and in addElementToCollection(). For each element UUID, the method resolves the element type (deducing it if the caller omitted the field, preventing bypass by omission) and performs an ACL-aware lookup: for Events it calls fetchSimpleEvent() scoped to the current user, and for GalaxyClusters it calls fetchGalaxyClusters() with the user context. If the object does not exist or the caller lacks access, a NotFoundException is raised and the save is aborted. This ensures that no collection element can reference an object the caller is not authorized to read.

Patch summary

In app/Controller/CollectionElementsController.php, a new private method __assertCanUseElements() is added (approximately 45 lines) that iterates over normalized element UUIDs, deduces the element type when not explicitly supplied, and performs an ACL-scoped existence check via Event::fetchSimpleEvent() or GalaxyCluster::fetchGalaxyClusters(). The add() method's beforeSave closure is modified to call this guard before persisting the row. The addElementToCollection() method is refactored to replace its inline Event-only check with a call to the same __assertCanUseElements() helper, gaining GalaxyCluster coverage. Net change: 53 insertions, 12 deletions in one file.

CVSS rationale

AV:N: MISP is a network-accessible web application. AC:L: The attacker simply submits a UUID to the existing add endpoint; no race condition or complex bypass is needed. AT:N: No prior compromise or user interaction is required. PR:L: An authenticated MISP user with permission to manage collection elements is required. UI:N: No victim interaction is needed; the disclosure occurs when the attacker views their own collection. VC:L: The attacker gains read access to Events or GalaxyClusters belonging to other organizations or restricted scopes. VI:L: Unauthorized references are persisted in the collection, altering data integrity. VA:N: No availability impact. SC/SI/SA:N: No impact on adjacent systems.

Weakness rationale
  • CWE-862 The add() method stored collection element UUIDs without performing any authorization check on the referenced object. The fix adds an explicit ACL verification step before persistence, confirming the original code lacked the required authorization control.
  • CWE-639 The attacker-supplied UUID (a user-controlled key) was accepted and stored without verifying that the caller held a valid access grant for that specific object, allowing reference to objects outside the caller's authorized scope.
Assumptions to verify
  • The affected version range is not explicitly stated in the patch; the tag boundary indicates the fix is 204 commits after v2.5.46, but the exact fixed release version is unconfirmed.
  • PR:L assumes the attacker needs only a basic authenticated MISP account with collection-element management rights; if a higher privilege level is required, PR should be raised.
  • The commit message references 'V17' as a related disclosure scenario; this is treated as internal context and not used to expand the affected scope.
  • The deduceType() fallback path is assumed to be reachable by an attacker omitting the element_type field, which the patch explicitly guards against.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 6 9 medium 4
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "modules": [
            "CollectionElementsController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/CollectionElementsController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object.\u003c/p\u003e\n\u003cp\u003eThe commit explains that collection elements themselves only store UUIDs, while the collection view later resolves those UUIDs into their underlying objects. Before this fix, the generic \u003ccode\u003eadd()\u003c/code\u003e path could therefore persist a UUID for an Event or Galaxy Cluster that the caller could not normally read. The patch explicitly notes that this made collections a way to reference another organisation\u2019s private data and had caused disclosure of organisation-only events in the beta collection view.\u003c/p\u003e\n\u003cp\u003eThe fix centralizes authorization in \u003ccode\u003e__assertCanUseElements()\u003c/code\u003e. Event UUIDs are validated through \u003ccode\u003eEvent::fetchSimpleEvent()\u003c/code\u003e under the current user\u2019s ACL, while Galaxy Cluster UUIDs are checked through \u003ccode\u003eGalaxyCluster::fetchGalaxyClusters()\u003c/code\u003e. The check is applied both to the CRUD \u003ccode\u003eadd()\u003c/code\u003e path and to \u003ccode\u003eaddElementToCollection()\u003c/code\u003e.\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object.\n\n\nThe commit explains that collection elements themselves only store UUIDs, while the collection view later resolves those UUIDs into their underlying objects. Before this fix, the generic add() path could therefore persist a UUID for an Event or Galaxy Cluster that the caller could not normally read. The patch explicitly notes that this made collections a way to reference another organisation\u2019s private data and had caused disclosure of organisation-only events in the beta collection view.\n\n\nThe fix centralizes authorization in __assertCanUseElements(). Event UUIDs are validated through Event::fetchSimpleEvent() under the current user\u2019s ACL, while Galaxy Cluster UUIDs are checked through GalaxyCluster::fetchGalaxyClusters(). The check is applied both to the CRUD add() path and to addElementToCollection().\n\nVersion affected: \u22642.5.45"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/334d53709"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces a dedicated __assertCanUseElements() authorization guard that is invoked in the beforeSave callback of the add() CRUD path (covering both form and REST submission) and in addElementToCollection(). For each element UUID, the method resolves the element type (deducing it if the caller omitted the field, preventing bypass by omission) and performs an ACL-aware lookup: for Events it calls fetchSimpleEvent() scoped to the current user, and for GalaxyClusters it calls fetchGalaxyClusters() with the user context. If the object does not exist or the caller lacks access, a NotFoundException is raised and the save is aborted. This ensures that no collection element can reference an object the caller is not authorized to read.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces a dedicated __assertCanUseElements() authorization guard that is invoked in the beforeSave callback of the add() CRUD path (covering both form and REST submission) and in addElementToCollection(). For each element UUID, the method resolves the element type (deducing it if the caller omitted the field, preventing bypass by omission) and performs an ACL-aware lookup: for Events it calls fetchSimpleEvent() scoped to the current user, and for GalaxyClusters it calls fetchGalaxyClusters() with the user context. If the object does not exist or the caller lacks access, a NotFoundException is raised and the save is aborted. This ensures that no collection element can reference an object the caller is not authorized to read."
        }
      ],
      "title": "MISP Collection Element Add Missing Authorization on Referenced Object UUID",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is not explicitly stated in the patch; the tag boundary indicates the fix is 204 commits after v2.5.46, but the exact fixed release version is unconfirmed.",
                  "PR:L assumes the attacker needs only a basic authenticated MISP account with collection-element management rights; if a higher privilege level is required, PR should be raised.",
                  "The commit message references \u0027V17\u0027 as a related disclosure scenario; this is treated as internal context and not used to expand the affected scope.",
                  "The deduceType() fallback path is assumed to be reachable by an attacker omitting the element_type field, which the patch explicitly guards against."
                ],
                "commit": "334d537095971df4855a4a4d9d9da0d6fd93d0df",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The attacker simply submits a UUID to the existing add endpoint; no race condition or complex bypass is needed. AT:N: No prior compromise or user interaction is required. PR:L: An authenticated MISP user with permission to manage collection elements is required. UI:N: No victim interaction is needed; the disclosure occurs when the attacker views their own collection. VC:L: The attacker gains read access to Events or GalaxyClusters belonging to other organizations or restricted scopes. VI:L: Unauthorized references are persisted in the collection, altering data integrity. VA:N: No availability impact. SC/SI/SA:N: No impact on adjacent systems.",
                "draft": false,
                "fixSummary": "The fix introduces a dedicated __assertCanUseElements() authorization guard that is invoked in the beforeSave callback of the add() CRUD path (covering both form and REST submission) and in addElementToCollection(). For each element UUID, the method resolves the element type (deducing it if the caller omitted the field, preventing bypass by omission) and performs an ACL-aware lookup: for Events it calls fetchSimpleEvent() scoped to the current user, and for GalaxyClusters it calls fetchGalaxyClusters() with the user context. If the object does not exist or the caller lacks access, a NotFoundException is raised and the save is aborted. This ensures that no collection element can reference an object the caller is not authorized to read.",
                "generatedAt": "2026-09-15T08:32:37.109406Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 4,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "259d46cb772765da8e97cb71e005610ab690f9f92b29e58b0a95aabe71fb0bdf",
                "patchSummary": "In app/Controller/CollectionElementsController.php, a new private method __assertCanUseElements() is added (approximately 45 lines) that iterates over normalized element UUIDs, deduces the element type when not explicitly supplied, and performs an ACL-scoped existence check via Event::fetchSimpleEvent() or GalaxyCluster::fetchGalaxyClusters(). The add() method\u0027s beforeSave closure is modified to call this guard before persisting the row. The addElementToCollection() method is refactored to replace its inline Event-only check with a call to the same __assertCanUseElements() helper, gaining GalaxyCluster coverage. Net change: 53 insertions, 12 deletions in one file.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "334d537095971df4855a4a4d9d9da0d6fd93d0df",
                    "patchSha256": "259d46cb772765da8e97cb71e005610ab690f9f92b29e58b0a95aabe71fb0bdf",
                    "source": "https://github.com/MISP/MISP/commit/334d53709.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/334d53709.patch",
                    "subject": "fix: [acl] Authorise the object a collection element points"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/334d53709.patch",
                "subject": "fix: [acl] Authorise the object a collection element points",
                "tagVersionBoundary": {
                  "commits_after_fix": 204,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The add() method stored collection element UUIDs without performing any authorization check on the referenced object. The fix adds an explicit ACL verification step before persistence, confirming the original code lacked the required authorization control."
                  },
                  {
                    "cweId": "CWE-639",
                    "rationale": "The attacker-supplied UUID (a user-controlled key) was accepted and stored without verifying that the caller held a valid access grant for that specific object, allowing reference to objects outside the caller\u0027s authorized scope."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20267"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-91846",
    "datePublished": "2026-09-15T08:36:15.273263Z",
    "dateReserved": "2026-09-15T08:36:20.997Z",
    "dateUpdated": "2026-09-15T08:36:21.073370Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20267"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GCVE-1-2026-20228 (CVE-2026-86408)

Vulnerability from gna-1 – Published: 2026-09-07 12:11 – Updated: 2026-09-07 12:11
VLAI
Title
MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events
Summary
Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view(). The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as: * type * key_data * fingerprint but did not fetch or authorize the associated parent event first. The upstream commit explicitly states that cryptographicKeys/view could return a protected event’s signing key to any authenticated user. The fix adds parent_id and parent_type to the lookup and then enforces authorization through the associated event using fetchSimpleEvent($user, parent_id). If the parent is not an Event, access is limited to site administrators. Version affected: ≤2.5.45
Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-862 - Missing Authorization
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
CIRCL GNA GNA-1
GNA scorecard A 90/100 over 252 records in the last 180 days details
References
Impacted products
Vendor Product Version
MISP MISP Affected: 0 , ≤ 2.5.45 (semver)
Create a notification for this product.
Credits
Scottish Government - National Cyber Team iglocska Claude Opus 5 (1M context)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MISP",
          "programFiles": [
            "app/Controller/CryptographicKeysController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThanOrEqual": "2.5.45",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Scottish Government - National Cyber Team"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAffected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through \u003ccode\u003eCryptographicKeysController::view()\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThe vulnerable handler queried \u003ccode\u003eCryptographicKey\u003c/code\u003e directly using the supplied key ID and selected sensitive fields such as:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003ccode\u003etype\u003c/code\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003ccode\u003ekey_data\u003c/code\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003ccode\u003efingerprint\u003c/code\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003ebut did not fetch or authorize the associated parent event first.\u003c/p\u003e\n\u003cp\u003eThe upstream commit explicitly states that \u003ccode\u003ecryptographicKeys/view\u003c/code\u003e could return a \u003cstrong\u003eprotected event\u2019s signing key to any authenticated user\u003c/strong\u003e.\u003c/p\u003e\n\u003cp\u003eThe fix adds \u003ccode\u003eparent_id\u003c/code\u003e and \u003ccode\u003eparent_type\u003c/code\u003e to the lookup and then enforces authorization through the associated event using \u003ccode\u003efetchSimpleEvent($user, parent_id)\u003c/code\u003e. If the parent is not an Event, access is limited to site administrators.\u003c/p\u003eVersion affected: \u22642.5.45\u003cbr\u003e"
            }
          ],
          "value": "Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view().\n\n\nThe vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as:\n\n\n\n  *  \ntype\n\n\n  *  \nkey_data\n\n\n  *  \nfingerprint\n\n\n\n\n\nbut did not fetch or authorize the associated parent event first.\n\n\nThe upstream commit explicitly states that cryptographicKeys/view could return a protected event\u2019s signing key to any authenticated user.\n\n\nThe fix adds parent_id and parent_type to the lookup and then enforces authorization through the associated event using fetchSimpleEvent($user, parent_id). If the parent is not an Event, access is limited to site administrators.\n\nVersion affected: \u22642.5.45"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/2edde619b"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20228"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-86408",
    "datePublished": "2026-09-07T12:11:00.737706Z",
    "dateReserved": "2026-09-07T12:11:12.888Z",
    "dateUpdated": "2026-09-07T12:11:12.965404Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-20228"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GCVE-1-2026-20227 (CVE-2026-103235)

Vulnerability from gna-1 – Published: 2026-09-30 09:09 – Updated: 2026-09-30 09:12
VLAI
Title
MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events
Summary
MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submitted record, including caller-supplied fields such as the primary key and event_id. An authenticated attacker could inject a primary key or event_id into the delegation payload to retarget an existing delegation record to any event on the instance. Because a delegation row grants the requesting organisation read access to the event it references, this effectively granted read access to arbitrary events belonging to other organisations. If the target organisation subsequently accepted the delegation, ownership of the event was transferred and the original record was deleted. Preconditions: - An authenticated user with the delegation permission (perm_delegate) - The MISP.delegation server setting must be enabled Impact: - Confidentiality: read access to any event on the instance - Integrity: overwriting existing delegation records and transferring event ownership Affected versions: MISP < 2.5.48
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
CWE
  • CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
CIRCL GNA GNA-1
GNA scorecard A 90/100 over 252 records in the last 180 days details
References
Impacted products
Vendor Product Version
MISP MISP Affected: 0 , < 2.5.48 (semver)
    cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Jeroen Pinoy iglocska Claude Opus 5
GCVE extensions
bcp-05-x-01
AI-assisted vulnerability information annotation
GCVE-BCP-05-X-01
Whole record AI-generated Human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
bcp-05-x-02
Patch-to-vulnerability generation provenance
GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-09-30 07:37
Model
qwen3.8:27b
Input
https://github.com/MISP/MISP/commit/d1f5684f9.patch f478751165e6…
Confidence
high
Commit Subject Patch SHA-256
d1f5684f9a19 fix: [security] Delegation requests stay bound to the event f478751165e6…
Fix summary

The delegation record is now constructed from a strict allow-list of fields rather than persisting the raw user-submitted payload. The event_id is always derived from the authorized event in the URL, the requester_org_id is always taken from the authenticated session, and the primary key is never included in the saved data. Only message, distribution, and sharing_group_id are accepted from user input, eliminating the ability to retarget or overwrite existing delegation records.

Patch summary

In EventDelegationsController::delegateEvent(), the code previously saved $this->request->data['EventDelegation'] directly after setting a few fields. The fix replaces this with an explicit allow-list array containing only event_id (from the authorized URL event), requester_org_id (from the session), org_id (resolved from submitted UUID), message, distribution, and sharing_group_id. The primary key id is never included. A regression test class DelegationRequestRetargeting was added to verify that injecting a nested EventDelegation with a foreign id and event_id does not grant read access to the victim event.

CVSS rationale

Network vector: MISP is a web application accessible over HTTP. Low complexity: a single crafted POST request suffices. No attack target manipulation. Low privileges: requires an authenticated user with perm_delegate. No user interaction: read access is granted immediately upon creating the retargeted delegation. High confidentiality: grants read access to any event on the instance. High integrity: overwrites existing delegation records and can transfer event ownership. No availability impact without victim acceptance. Scope change (SC:H, SI:H): the vulnerability crosses organisational boundaries, affecting data owned by other organisations. No sub-system availability impact.

Weakness rationale
  • CWE-915 The application persisted the entire user-submitted record including fields (id, event_id) that should not be attacker-controllable, allowing mass assignment of sensitive fields to retarget the delegation.
  • CWE-639 The authorization check validated only the event in the URL, but the attacker-supplied primary key or event_id in the payload redirected the operation to a different record, bypassing the intended authorization boundary.
Attack pattern rationale
  • CAPEC-12 The attacker manipulates hidden or additional fields in a form/API request (injecting id and event_id into the EventDelegation payload) to modify data beyond what the application intended to accept. This is the canonical mass assignment pattern: the server processes user-supplied fields it should have ignored. The mapping is direct and well-supported by the patch evidence.
Assumptions to verify
  • The affected version boundary (< 2.5.48) is inferred from the tag_version_boundary metadata showing v2.5.48 as the nearest tag with 22 commits after the fix; the exact last affected release is not explicitly stated in the patch.
  • PR:L assumes the attacker needs only the perm_delegate permission, which is a non-admin role; the exact role configuration may vary by deployment.
  • VA:N assumes the availability impact (deletion of the original event) requires victim acceptance and is therefore not a direct availability impact of the vulnerability itself.
  • The CAPEC-12 mapping is the closest standard pattern; the vulnerability also has IDOR characteristics (CWE-639) but CAPEC-12 best captures the mass-assignment mechanism demonstrated in the patch.
  • The MISP.delegation server setting must be enabled for the vulnerability to be exploitable; this is a deployment configuration assumption.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 6 9 high 5
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "EventDelegationsController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/EventDelegationsController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submitted record, including caller-supplied fields such as the primary key and event_id.\u003c/p\u003e\u003cp\u003eAn authenticated attacker could inject a primary key or event_id into the delegation payload to retarget an existing delegation record to any event on the instance. Because a delegation row grants the requesting organisation read access to the event it references, this effectively granted read access to arbitrary events belonging to other organisations. If the target organisation subsequently accepted the delegation, ownership of the event was transferred and the original record was deleted.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- An authenticated user with the delegation permission (perm_delegate)\u003c/p\u003e\u003cp\u003e- The MISP.delegation server setting must be enabled\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Confidentiality: read access to any event on the instance\u003c/p\u003e\u003cp\u003e- Integrity: overwriting existing delegation records and transferring event ownership\u003c/p\u003e\u003cp\u003eAffected versions: MISP \u0026lt; 2.5.48\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submitted record, including caller-supplied fields such as the primary key and event_id.\n\nAn authenticated attacker could inject a primary key or event_id into the delegation payload to retarget an existing delegation record to any event on the instance. Because a delegation row grants the requesting organisation read access to the event it references, this effectively granted read access to arbitrary events belonging to other organisations. If the target organisation subsequently accepted the delegation, ownership of the event was transferred and the original record was deleted.\n\nPreconditions:\n\n- An authenticated user with the delegation permission (perm_delegate)\n\n- The MISP.delegation server setting must be enabled\n\nImpact:\n\n- Confidentiality: read access to any event on the instance\n\n- Integrity: overwriting existing delegation records and transferring event ownership\n\nAffected versions: MISP \u003c 2.5.48"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-12",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-12 Mass Assignment"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-915",
              "description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/d1f5684f9"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe delegation record is now constructed from a strict allow-list of fields rather than persisting the raw user-submitted payload. The event_id is always derived from the authorized event in the URL, the requester_org_id is always taken from the authenticated session, and the primary key is never included in the saved data. Only message, distribution, and sharing_group_id are accepted from user input, eliminating the ability to retarget or overwrite existing delegation records.\u003c/p\u003e"
            }
          ],
          "value": "The delegation record is now constructed from a strict allow-list of fields rather than persisting the raw user-submitted payload. The event_id is always derived from the authorized event in the URL, the requester_org_id is always taken from the authenticated session, and the primary key is never included in the saved data. Only message, distribution, and sharing_group_id are accepted from user input, eliminating the ability to retarget or overwrite existing delegation records."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary (\u003c 2.5.48) is inferred from the tag_version_boundary metadata showing v2.5.48 as the nearest tag with 22 commits after the fix; the exact last affected release is not explicitly stated in the patch.",
                  "PR:L assumes the attacker needs only the perm_delegate permission, which is a non-admin role; the exact role configuration may vary by deployment.",
                  "VA:N assumes the availability impact (deletion of the original event) requires victim acceptance and is therefore not a direct availability impact of the vulnerability itself.",
                  "The CAPEC-12 mapping is the closest standard pattern; the vulnerability also has IDOR characteristics (CWE-639) but CAPEC-12 best captures the mass-assignment mechanism demonstrated in the patch.",
                  "The MISP.delegation server setting must be enabled for the vulnerability to be exploitable; this is a deployment configuration assumption."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-12",
                    "rationale": "The attacker manipulates hidden or additional fields in a form/API request (injecting id and event_id into the EventDelegation payload) to modify data beyond what the application intended to accept. This is the canonical mass assignment pattern: the server processes user-supplied fields it should have ignored. The mapping is direct and well-supported by the patch evidence."
                  }
                ],
                "commit": "d1f5684f9a193ea0a8a4f7709703011aa69d9682",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5"
                  }
                ],
                "cvssRationale": "Network vector: MISP is a web application accessible over HTTP. Low complexity: a single crafted POST request suffices. No attack target manipulation. Low privileges: requires an authenticated user with perm_delegate. No user interaction: read access is granted immediately upon creating the retargeted delegation. High confidentiality: grants read access to any event on the instance. High integrity: overwrites existing delegation records and can transfer event ownership. No availability impact without victim acceptance. Scope change (SC:H, SI:H): the vulnerability crosses organisational boundaries, affecting data owned by other organisations. No sub-system availability impact.",
                "fixSummary": "The delegation record is now constructed from a strict allow-list of fields rather than persisting the raw user-submitted payload. The event_id is always derived from the authorized event in the URL, the requester_org_id is always taken from the authenticated session, and the primary key is never included in the saved data. Only message, distribution, and sharing_group_id are accepted from user input, eliminating the ability to retarget or overwrite existing delegation records.",
                "generatedAt": "2026-09-30T07:37:05.841152Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "f478751165e658f2b26822845ec034386d8a1740527cf30863792e9521f24611",
                "patchSummary": "In EventDelegationsController::delegateEvent(), the code previously saved $this-\u003erequest-\u003edata[\u0027EventDelegation\u0027] directly after setting a few fields. The fix replaces this with an explicit allow-list array containing only event_id (from the authorized URL event), requester_org_id (from the session), org_id (resolved from submitted UUID), message, distribution, and sharing_group_id. The primary key id is never included. A regression test class DelegationRequestRetargeting was added to verify that injecting a nested EventDelegation with a foreign id and event_id does not grant read access to the victim event.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "d1f5684f9a193ea0a8a4f7709703011aa69d9682",
                    "patchSha256": "f478751165e658f2b26822845ec034386d8a1740527cf30863792e9521f24611",
                    "source": "https://github.com/MISP/MISP/commit/d1f5684f9.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/d1f5684f9.patch",
                    "subject": "fix: [security] Delegation requests stay bound to the event"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/d1f5684f9.patch",
                "subject": "fix: [security] Delegation requests stay bound to the event",
                "tagVersionBoundary": {
                  "commits_after_fix": 22,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-915",
                    "rationale": "The application persisted the entire user-submitted record including fields (id, event_id) that should not be attacker-controllable, allowing mass assignment of sensitive fields to retarget the delegation."
                  },
                  {
                    "cweId": "CWE-639",
                    "rationale": "The authorization check validated only the event in the URL, but the attacker-supplied primary key or event_id in the payload redirected the operation to a different record, bypassing the intended authorization boundary."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20227"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-103235",
    "datePublished": "2026-09-30T09:09:00.000Z",
    "dateReserved": "2026-09-30T09:09:00.000Z",
    "dateUpdated": "2026-09-30T09:12:45.330040Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20227"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GCVE-1-2026-20223 (CVE-2026-86451)

Vulnerability from gna-1 – Published: 2026-09-07 12:59 – Updated: 2026-09-07 12:59
VLAI
Title
MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects
Summary
Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data() without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid directly and returned the matching row whenever it existed. Because no parent-object ACL was applied, a user who knew or obtained a reference UUID could retrieve information associated with an object outside their normal access scope. The commit explicitly states that any object reference could be returned by UUID without authorizing its parent object. The fix retrieves the referenced object's object_id and calls fetchObjectSimple() with the current user. If the user cannot access that parent object, MISP now returns NotFoundException instead of exposing the reference. Version affected: ≤2.5.45
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
  • CWE-862 - Missing Authorization
Assigner
CIRCL GNA GNA-1
GNA scorecard A 90/100 over 252 records in the last 180 days details
References
Impacted products
Vendor Product Version
MISP MISP Affected: 0 , ≤ 2.5.45 (semver)
Create a notification for this product.
Credits
Scottish Government - National Cyber Team iglocska Claude Opus 5 (1M context)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MISP",
          "programFiles": [
            "app/Lib/Tools/EventGraphTool.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThanOrEqual": "2.5.45",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Scottish Government - National Cyber Team"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAffected versions of MISP allow authenticated users to retrieve object-reference records by UUID through \u003ccode\u003eEventGraphTool::get_reference_data()\u003c/code\u003e without first checking whether the requester is authorized to view the object the reference belongs to.\u003c/p\u003e\n\u003cp\u003eThe vulnerable code queried \u003ccode\u003eObjectReference.uuid\u003c/code\u003e directly and returned the matching row whenever it existed. Because no parent-object ACL was applied, a user who knew or obtained a reference UUID could retrieve information associated with an object outside their normal access scope. The commit explicitly states that \u003cstrong\u003eany object reference could be returned by UUID without authorizing its parent object\u003c/strong\u003e.\u003c/p\u003e\n\u003cp\u003eThe fix retrieves the referenced object\u0027s \u003ccode\u003eobject_id\u003c/code\u003e and calls \u003ccode\u003efetchObjectSimple()\u003c/code\u003e with the current user. If the user cannot access that parent object, MISP now returns \u003ccode\u003eNotFoundException\u003c/code\u003e instead of exposing the reference.\u003c/p\u003eVersion affected: \u22642.5.45\u003cbr\u003e"
            }
          ],
          "value": "Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data() without first checking whether the requester is authorized to view the object the reference belongs to.\n\n\nThe vulnerable code queried ObjectReference.uuid directly and returned the matching row whenever it existed. Because no parent-object ACL was applied, a user who knew or obtained a reference UUID could retrieve information associated with an object outside their normal access scope. The commit explicitly states that any object reference could be returned by UUID without authorizing its parent object.\n\n\nThe fix retrieves the referenced object\u0027s object_id and calls fetchObjectSimple() with the current user. If the user cannot access that parent object, MISP now returns NotFoundException instead of exposing the reference.\n\nVersion affected: \u22642.5.45"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/c0cb5c9f8"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20223"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-86451",
    "datePublished": "2026-09-07T12:59:35.971838Z",
    "dateReserved": "2026-09-07T12:59:41.676Z",
    "dateUpdated": "2026-09-07T12:59:41.744409Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-20223"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}
Mitigation
Architecture and Design

For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.

Mitigation
Architecture and Design Implementation

Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Mitigation
Architecture and Design

Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list