---
id: CVE-2026-91846
title: >-
  Affected versions of MISP allow a collection element to be created from a bare
  UUID without consistently checking whether the acting user is allowed to
  access the referenced object.



  The commit explains that collection elements themselv…
summary: >-
  Affected versions of MISP allow a collection element to be created from a bare
  UUID without consistently checking whether the acting user is allowed to
  access the referenced object.



  The commit explains that collection elements themselv…
severity: high
cvss: 7.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-639
  - CWE-862
vendor: MISP
product: MISP
affected:
  - MISP < 2.5.46
published: '2026-09-15'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T13:42:48.480'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91846'
references:
  - url: 'https://github.com/MISP/MISP/commit/334d53709'
    label: 5a6e4751-2f3f-4070-9419-94fb35b644e8
tags:
  - nvd
  - cve.org
epss: 0.00351
epssPercentile: 0.25941
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T13:41:15.313807Z'
cvssSource: cna
ingestedAt: '2026-09-15T09:34:49.386Z'
---

## Overview

Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object.


The commit explains that collection elements themselves only store UUIDs, while the collection view later resolves those UUIDs into their underlying objects. Before this fix, the generic add() path could therefore persist a UUID for an Event or Galaxy Cluster that the caller could not normally read. The patch explicitly notes that this made collections a way to reference another organisation’s private data and had caused disclosure of organisation-only events in the beta collection view.


The fix centralizes authorization in __assertCanUseElements(). Event UUIDs are validated through Event::fetchSimpleEvent() under the current user’s ACL, while Galaxy Cluster UUIDs are checked through GalaxyCluster::fetchGalaxyClusters(). The check is applied both to the CRUD add() path and to addElementToCollection().

Version affected: ≤2.5.45

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.