CVE-2026-86342 MISP CVE debrief

Who should care

MISP users and administrators should assess exposure and prioritize patching due to potential exposure of restricted event correlations and associated event information. This requires attention from MISP users and administrators to verify MISP version and patch status, and to review compensating controls for exposed systems.

Why it matters

CVE-2026-86342 requires attention from MISP users and administrators due to improper authorization checks in freetext feed preview functionality, potentially exposing restricted event correlations and associated event information. Prioritization of patching and verification of MISP version is necessary.

• Potential exposure of restricted event correlations and associated event information
• Possible unauthorized access to sensitive event data
• Need for verification of MISP version and patch status
• Potential impact on incident response and threat intelligence activities

Technical summary

MISP versions ≤2.5.45 contain improper authorization checks in freetext feed preview functionality, allowing restricted event correlations and associated event information exposure. The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. The fixes apply the caller's ACL to attribute correlation searches, remove feed URLs from correlation results, restrict cross-feed results according to feed visibility, and correct host-organization ID comparison so the authorization rules are applied consistently.

Defensive priority

Medium priority for MISP users and administrators

Recommended defensive actions

• Review and apply patches for MISP versions ≤2.5.45
• Restrict access to MISP freetext feed preview functionality
• Monitor MISP event correlations and associated event information exposure
• Verify MISP version and patch status
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

CVE Program and NVD records detail improper authorization checks in MISP freetext feed preview functionality, allowing restricted event correlations and associated event information exposure. Fixes apply caller's ACL to attribute correlation searches, remove feed URLs from correlation results, restrict cross-feed results according to feed visibility, and correct host-organization ID comparison.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.