CVE-2026-86283 - MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data
Brief
CVE ID : CVE-2026-86283
Published : Sept. 6, 2026, 3:17 p. m.
- 5 hours, 31 minutes ago
Description : MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view. ctp) performed a secondary query of member events by UUID without applying the caller's access control list (ACL). The CollectionsController::view() action correctly resolved collection element UUIDs through Event::fetchSimpleEvents($user, ...) , which enforces per-user event ACL.
However, the view template independently re-queried the same UUIDs using only an Event. uuid IN (...) condition, omitting the createEventConditions() authorization filter.