MISP CVE-2026-95805

Requires an authenticated MISP user account on the instance (PR:L) reaching the previewEventAttributes controller action over the network; no user interaction is needed. Exploitation is gated by the ACL system's behavior on an unmatched permission key: only if the malformed 'theming_enabled*' key causes the check to fail open does an under-privileged account gain access to event attribute data - if it fails closed, the effect is instead denial of access to legitimate theming_enabled users (availability). No special non-default configuration is described; the flaw is present wherever the affected ACLComponent.php version ships.

This is a genuinely low-to-moderate-risk authorization flaw, not a high-severity emergency. The vendor CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L) is consistent with the evidence: the single-character ACL typo ('theming_enabled*' vs 'theming_enabled') affects one endpoint, requires an already-authenticated MISP user (PR:L), and yields only limited confidentiality impact (VC:L) - exposure of event attribute/indicator data to users who should not see it. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation; the signals are internally consistent (low CVSS, no KEV, no POC) rather than conflicting. One real ambiguity is worth flagging: the description and the malformed-key mechanism mean the outcome is ACL-evaluation-dependent - it could manifest as an authorization BYPASS (unauthorized read, the confidentiality case the vendor scored) OR as a denial of legitimate access (availability impact), and the input does not confirm which MISP's evaluator actually produces. The CWE is CWE-285 (improper authorization), so the 'Authentication Bypass' tag overstates it - no authentication is bypassed. Overall this is a low-priority hygiene fix rather than a widely-exploitable threat.

An authenticated MISP user without the theming_enabled permission navigates to the previewEventAttributes endpoint; because the ACL rule references a non-existent permission key, the access-control check malfunctions and (in the bypass case) returns event attribute and indicator data the user should not be able to view. No public exploit code was identified, and exploitation requires an existing low-privileged account on the instance.