MISP CVE-2026-86451

Exploitation requires a valid authenticated MISP user account (PR:L) on the target instance; unauthenticated access is not possible. The attacker must know or be able to enumerate a valid ObjectReference UUID belonging to an object outside their authorized scope - UUIDs in MISP are version 4 (random), making blind guessing impractical, but an attacker who can observe UUIDs in their own accessible events may attempt to enumerate adjacent references. The vulnerability is present in the EventGraphTool code path, which is active whenever MISP's event-graph visualization feature is used; no special non-default configuration is required to expose the flaw. Impact is limited to read-only disclosure of reference metadata (relationship type, comment, referenced UUID), not full event or attribute content.

The CVSS 4.0 score of 5.3 (PR:L/VC:L) accurately reflects the moderate and bounded nature of this vulnerability. Exploitation requires valid MISP credentials (PR:L), meaning unauthenticated external actors cannot abuse it directly. The information exposed is limited to object-reference metadata - relationship types, comments, and referenced UUIDs - rather than full event or attribute data (VC:L). There is no integrity or availability impact. Real-world risk is highest in multi-organization MISP deployments where users from different sharing communities have accounts on the same instance, since the flaw allows a user from one org to enumerate reference data belonging to another org's restricted events. EPSS data is not present in the input, no POC has been identified, and the vulnerability is not in CISA KEV, all consistent with the moderate CVSS score. The attack surface is limited to authenticated users with knowledge of or the ability to guess/enumerate reference UUIDs.

An authenticated MISP user belonging to Organization A, who has been granted access to the platform but not to Organization B's restricted event, discovers or brute-forces a reference UUID (e.g., by observing UUIDs in events they can legitimately access and incrementing or guessing adjacent ones). The user calls the event-graph endpoint with that UUID, triggering get_reference_data() to return the full ObjectReference row - exposing relationship types, comments, and cross-referenced UUIDs from a restricted event - without any access check on the parent object. No public exploit code has been identified.