---
id: CVE-2026-86283
title: >-
  MISP's UiBeta theme collection view
  (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query of
  member events by UUID without applying the caller's access control list (ACL)
summary: >-
  MISP's UiBeta theme collection view
  (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query of
  member events by UUID without applying the caller's access control list (ACL).
  The CollectionsController::view() action corr…
severity: high
cvss: 7.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-285
  - CWE-862
vendor: MISP
product: MISP
affected:
  - MISP <= 2.5.45
published: '2026-09-06'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T19:20:12.520'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86283'
references:
  - url: 'https://github.com/MISP/MISP/commit/44573e4a8'
    label: 5a6e4751-2f3f-4070-9419-94fb35b644e8
  - url: 'https://github.com/MISP/MISP/commit/44573e4a8.patch'
    label: 5a6e4751-2f3f-4070-9419-94fb35b644e8
tags:
  - nvd
  - cve.org
  - exploit-available
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-08T18:18:11.942447Z'
cvssSource: cna
epss: 0.00372
epssPercentile: 0.28437
ingestedAt: '2026-09-07T05:05:30.718Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/Freire007-byte/sentric-core'
  checkedAt: '2026-09-26T09:06:03.456Z'
exploitAvailable: true
---

## Overview

MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query of member events by UUID without applying the caller's access control list (ACL). The CollectionsController::view() action correctly resolved collection element UUIDs through Event::fetchSimpleEvents($user, ...), which enforces per-user event ACL. However, the view template independently re-queried the same UUIDs using only an Event.uuid IN (...) condition, omitting the createEventConditions() authorization filter. Because collection element UUIDs are stored without server-side authorization against the referenced event (CollectionElementsController::add() accepts whatever UUID the collection owner posts), an authenticated user with view access to a collection could retrieve full details of events they are not permitted to read. The exposed data included event identifiers, info, dates, timestamps, creator organization, all event tags, and galaxy clusters (the latter attached via a cluster-scoped rather than event-scoped ACL check). This constitutes an authorization bypass at the presentation layer, allowing horizontal privilege escalation across event boundaries within the MISP instance.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.