MISP EUVD-2026-72137

Requires an authenticated MISP user account (PR:L) with either write access to a collection (to add arbitrary event UUIDs as elements) or view access to a collection that already contains references to events outside their ACL. The UiBeta theme must be active on the instance - the classic MISP theme does not share this code path. The attacker must know or be able to guess the UUID of a restricted event; UUIDs are typically shared as part of threat intelligence exchange, so within a MISP instance this is often achievable by participants who receive partial event data through other channels. No special admin privileges are required. Exploitation is limited to confidentiality impact; no write or destructive capability is exposed. Single-organization MISP instances with flat ACLs gain no attacker advantage from this bug since all events are already accessible.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N scores 7.1, reflecting network-accessible, low-complexity exploitation by any authenticated user. There is no CISA KEV listing and no public POC identified; EPSS data was not provided. Despite a moderate aggregate score, real-world risk in multi-organization MISP deployments is elevated: MISP's event ACL model is the primary data segregation mechanism in shared instances (ISACs, national CERTs, sector-specific sharing hubs), and event metadata including threat actor attributions and galaxy clusters carries operational sensitivity. The horizontal privilege escalation is systematic - it is not a race condition or edge-case bypass but a persistent architectural gap in the UiBeta theme's query path. The UiBeta theme is the newer default interface being promoted by the MISP project, so exposure is not limited to legacy deployments. Because CollectionElementsController::add() does not validate UUID authorization at write time, any collection owner can pre-position restricted UUIDs that viewers of that collection will then inadvertently receive data on. No CVSS integrity or availability impact is present; the risk is entirely confidentiality-focused.

An authenticated MISP user who owns or has write access to a collection adds the UUID of a restricted event - one they know exists but cannot access due to ACL - to their collection via CollectionElementsController::add(), which accepts the UUID without authorization checks. When the attacker (or any user with view access to that collection) loads the UiBeta collection view page, the template's unfiltered Event.uuid IN (...) query returns full event details including info, timestamps, creator organization, all tags, and galaxy cluster attributions for the restricted event. No exploit tooling has been publicly identified; the attack is straightforward to execute with knowledge of a restricted event's UUID.