CVE-2026-86451 MISP CVE debrief

Who should care

MISP administrators and users, security teams responsible for patching and vulnerability management, and operators of MISP platforms should prioritize patching and verify authorization checks to prevent potential information disclosure. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-86451 is a medium-severity vulnerability in MISP that allows authenticated users to access object-reference records without proper authorization. Defenders should prioritize patching and verify authorization checks to prevent potential information disclosure.

• Potential information disclosure for unauthorized users
• Need to verify and apply patches to prevent exploitation
• Possible impact on data confidentiality

Technical summary

The vulnerability allows authenticated users to retrieve object-reference records by UUID without checking if they are authorized to view the parent object. This could potentially expose sensitive information. The fix adds authorization checks before returning object references. The vulnerable code queried ObjectReference.uuid directly and returned the matching row whenever it existed. Because no parent-object ACL was applied, a user who knew or obtained a reference UUID could retrieve information associated with an object outside their normal access scope.

Defensive priority

Medium-priority patching and verification recommended

Recommended defensive actions

• Apply patches or updates to MISP versions ≤2.5.45
• Verify authorization checks for object-reference records
• Monitor for potential information disclosure
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fix. However, additional information on potential exploitation or impact is limited. There is no evidence of public exploitation or specific attacks. The fix retrieves the referenced object's object_id and calls fetchObjectSimple() with the current user. If the user cannot access that parent object, MISP now returns NotFoundException instead of exposing the reference. The commit explicitly states that any object reference could be returned byUUID

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.