MISP CVE-2026-94394

Requires an authenticated MISP account that is NOT a site administrator (perm_site_admin) and that already has legitimate view access to an event containing more restricted attributes/objects. The flaw is triggered through the object-reference add functionality, where the server only validated event-level access and failed to re-check each attribute's/object's distribution level and sharing-group membership. LIMITING FACTORS: valid credentials are needed (PR:L), the target event must contain data restricted to a sharing group or higher distribution level than the attacker, and the deployment must actually use sharing groups/distribution restrictions for segregation - instances with uniformly-distributed data have nothing extra to disclose. No user interaction and no admin rights are required beyond that.

This is a genuine but bounded authorization/information-disclosure flaw, not a high-severity emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) requires an authenticated non-site-admin user who already has legitimate access to an event, which meaningfully limits the attacker population to existing MISP users. The vector reports VC:N but SC:H - the vendor models the disclosure of restricted data belonging to other sharing groups/distribution levels as a subsequent-system confidentiality impact rather than a direct one; a straight CVSS 3.1 reading would express this simply as C:L. There is NO integrity or availability impact (VI/VA and SI/SA all N), so this is strictly a read/disclosure issue. No EPSS score, no CISA KEV listing, and no public POC were provided - combined with PR:L, this points to low real-world exploitation urgency and a targeted-insider risk profile rather than mass exploitation. The patch (commit f36634e57) is confirmed available and directly corroborates the root cause. Bottom line: prioritize for environments that rely on MISP sharing-group segregation to protect sensitive attributes, but this is not a drop-everything internet-facing RCE.

An authenticated MISP user (analyst-level, not site admin) who has view access to a shared event uses the object-reference 'add' workflow to enumerate attributes and objects within that event. Because the reference-picker query only checked event-level access and not each item's distribution/sharing-group restriction, the attacker sees restricted attribute values, object details, and related-object data intended only for a narrower sharing group. No public exploit code was identified; exploitation is manual against the object-reference add endpoint.