{"id":"CVE-2026-86408","title":"Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view().\n\n\nThe vulnerable handler queried CryptographicKey directly using the supplied key ID and select…","summary":"Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view().\n\n\nThe vulnerable handler queried CryptographicKey directly using the supplied key ID and select…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-639","CWE-862"],"vendor":"misp-project","product":"misp","affected":["misp <= 2.5.45"],"published":"2026-09-07","updated":"2026-09-09","sourceUpdated":"2026-09-09T15:26:17.753","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86408","references":[{"url":"https://github.com/MISP/MISP/commit/2edde619b","label":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}],"tags":["nvd","cve.org"],"epss":0.00201,"epssPercentile":0.10243,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-08T14:49:41.763889Z"},"scores":{"nvd":6.5,"cna":7.1},"ingestedAt":"2026-09-08T15:33:26.977Z","slug":"CVE-2026-86408","body":"## Overview\n\nAffected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view().\n\n\nThe vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as:\n\n\n\n  *  \ntype\n\n\n  *  \nkey_data\n\n\n  *  \nfingerprint\n\n\n\n\n\nbut did not fetch or authorize the associated parent event first.\n\n\nThe upstream commit explicitly states that cryptographicKeys/view could return a protected event’s signing key to any authenticated user.\n\n\nThe fix adds parent_id and parent_type to the lookup and then enforces authorization through the associated event using fetchSimpleEvent($user, parent_id). If the parent is not an Event, access is limited to site administrators.\n\nVersion affected: ≤2.5.45\n\n## Affected\n\n- `misp <= 2.5.45`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":202130,"id":"CVE-2026-86408","ts":1789400063229,"field":"cvss","old":"7.1","new":"6.5"},{"seq":202129,"id":"CVE-2026-86408","ts":1789400063229,"field":"severity","old":"high","new":"medium"},{"seq":200857,"id":"CVE-2026-86408","ts":1789397617160,"field":"cvss","old":"6.5","new":"7.1"},{"seq":200856,"id":"CVE-2026-86408","ts":1789397617160,"field":"severity","old":"medium","new":"high"},{"seq":199550,"id":"CVE-2026-86408","ts":1789395529757,"field":"cvss","old":"7.1","new":"6.5"},{"seq":199549,"id":"CVE-2026-86408","ts":1789395529757,"field":"severity","old":"high","new":"medium"},{"seq":198795,"id":"CVE-2026-86408","ts":1789392244975,"field":"cvss","old":"6.5","new":"7.1"},{"seq":198794,"id":"CVE-2026-86408","ts":1789392244975,"field":"severity","old":"medium","new":"high"},{"seq":197128,"id":"CVE-2026-86408","ts":1789384293093,"field":"cvss","old":"7.1","new":"6.5"},{"seq":197127,"id":"CVE-2026-86408","ts":1789384293093,"field":"severity","old":"high","new":"medium"},{"seq":194257,"id":"CVE-2026-86408","ts":1789378783797,"field":"cvss","old":"6.5","new":"7.1"},{"seq":194256,"id":"CVE-2026-86408","ts":1789378783797,"field":"severity","old":"medium","new":"high"},{"seq":193044,"id":"CVE-2026-86408","ts":1789376516549,"field":"cvss","old":"7.1","new":"6.5"},{"seq":193043,"id":"CVE-2026-86408","ts":1789376516549,"field":"severity","old":"high","new":"medium"},{"seq":191831,"id":"CVE-2026-86408","ts":1789373631837,"field":"cvss","old":"6.5","new":"7.1"},{"seq":191830,"id":"CVE-2026-86408","ts":1789373631837,"field":"severity","old":"medium","new":"high"},{"seq":190616,"id":"CVE-2026-86408","ts":1789369476764,"field":"cvss","old":"7.1","new":"6.5"},{"seq":190615,"id":"CVE-2026-86408","ts":1789369476764,"field":"severity","old":"high","new":"medium"},{"seq":189403,"id":"CVE-2026-86408","ts":1789368429602,"field":"cvss","old":"6.5","new":"7.1"},{"seq":189402,"id":"CVE-2026-86408","ts":1789368429602,"field":"severity","old":"medium","new":"high"},{"seq":188186,"id":"CVE-2026-86408","ts":1789365231544,"field":"cvss","old":"7.1","new":"6.5"},{"seq":188185,"id":"CVE-2026-86408","ts":1789365231544,"field":"severity","old":"high","new":"medium"},{"seq":186973,"id":"CVE-2026-86408","ts":1789363472041,"field":"cvss","old":"6.5","new":"7.1"},{"seq":186972,"id":"CVE-2026-86408","ts":1789363472041,"field":"severity","old":"medium","new":"high"},{"seq":185759,"id":"CVE-2026-86408","ts":1789361229879,"field":"cvss","old":"7.1","new":"6.5"},{"seq":185758,"id":"CVE-2026-86408","ts":1789361229879,"field":"severity","old":"high","new":"medium"},{"seq":184546,"id":"CVE-2026-86408","ts":1789358364555,"field":"cvss","old":"6.5","new":"7.1"},{"seq":184545,"id":"CVE-2026-86408","ts":1789358364555,"field":"severity","old":"medium","new":"high"},{"seq":182796,"id":"CVE-2026-86408","ts":1789354317945,"field":"cvss","old":"7.1","new":"6.5"},{"seq":182795,"id":"CVE-2026-86408","ts":1789354317945,"field":"severity","old":"high","new":"medium"},{"seq":181589,"id":"CVE-2026-86408","ts":1789353318465,"field":"cvss","old":"6.5","new":"7.1"},{"seq":181588,"id":"CVE-2026-86408","ts":1789353318465,"field":"severity","old":"medium","new":"high"},{"seq":180382,"id":"CVE-2026-86408","ts":1789350285538,"field":"cvss","old":"7.1","new":"6.5"},{"seq":180381,"id":"CVE-2026-86408","ts":1789350285538,"field":"severity","old":"high","new":"medium"},{"seq":179175,"id":"CVE-2026-86408","ts":1789348293670,"field":"cvss","old":"6.5","new":"7.1"},{"seq":179174,"id":"CVE-2026-86408","ts":1789348293670,"field":"severity","old":"medium","new":"high"},{"seq":177968,"id":"CVE-2026-86408","ts":1789346370795,"field":"cvss","old":"7.1","new":"6.5"},{"seq":177967,"id":"CVE-2026-86408","ts":1789346370795,"field":"severity","old":"high","new":"medium"},{"seq":176761,"id":"CVE-2026-86408","ts":1789343185261,"field":"cvss","old":"6.5","new":"7.1"},{"seq":176760,"id":"CVE-2026-86408","ts":1789343185261,"field":"severity","old":"medium","new":"high"},{"seq":174878,"id":"CVE-2026-86408","ts":1789334876437,"field":"cvss","old":"7.1","new":"6.5"},{"seq":174877,"id":"CVE-2026-86408","ts":1789334876437,"field":"severity","old":"high","new":"medium"},{"seq":173673,"id":"CVE-2026-86408","ts":1789333701568,"field":"cvss","old":"6.5","new":"7.1"},{"seq":173672,"id":"CVE-2026-86408","ts":1789333701568,"field":"severity","old":"medium","new":"high"},{"seq":172487,"id":"CVE-2026-86408","ts":1789331093823,"field":"cvss","old":"7.1","new":"6.5"},{"seq":172486,"id":"CVE-2026-86408","ts":1789331093823,"field":"severity","old":"high","new":"medium"},{"seq":171301,"id":"CVE-2026-86408","ts":1789328781604,"field":"cvss","old":"6.5","new":"7.1"},{"seq":171300,"id":"CVE-2026-86408","ts":1789328781604,"field":"severity","old":"medium","new":"high"},{"seq":170096,"id":"CVE-2026-86408","ts":1789327197913,"field":"cvss","old":"7.1","new":"6.5"},{"seq":170095,"id":"CVE-2026-86408","ts":1789327197913,"field":"severity","old":"high","new":"medium"}]}