CVE-2026-94394

Executive Summary

CVE-2026-94394 is an authorization enforcement flaw (CWE-862: Missing Authorization) in MISP (Malware Information Sharing Platform) affecting authenticated, non-administrative users who already possess access to an event containing more restricted data. When a user creates a reference between objects or attributes, the platform validates the user's access to the parent event but does not consistently validate whether the referenced individual attributes or objects fall within the user's permitted sharing group or distribution level. The result is a horizontal authorization bypass that can expose sensitive attribute values, object details, or related object data to users who should not be able to view them, undermining the confidentiality guarantees MISP is specifically designed to enforce.

Technical Analysis

MISP is an open-source threat intelligence sharing platform whose core security model rests on fine-grained distribution controls. Events, attributes, and objects can each carry distribution settings and sharing group assignments, allowing organizations to share an event broadly while restricting specific indicators to a narrower audience. The platform is designed so that access control is evaluated at the level of each discrete data element, not merely at the event container.

CVE-2026-94394 is an instance of CWE-862, Missing Authorization. Per the NVD description, the flaw manifests in the "add reference" workflow: when a regular (non-site-administrator) user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user. The authorization decision therefore stops at the event boundary and fails to recurse into the per-element distribution and sharing group constraints that govern the referenced attributes and objects.

The vulnerability class here is a classic broken object-level authorization (BOLA/IDOR-style) problem expressed at the API/service layer: validating the parent container while neglecting child-resource authorization. From the information provided, the mechanism is:

1. Access to the event is confirmed — the user passes the event-level authorization gate.
2. A reference operation is performed between objects or attributes.
3. The per-element authorization check (sharing group membership, distribution level) is skipped or incompletely applied.
4. The user is consequently able to reach attribute values, object details, or related object data that were intended to be restricted to a specific sharing group or distribution level.

No specific function names, class names, controller methods, URL endpoints, or API parameter names are available in the source data, and none are asserted here. The precise code path that omits the per-element check is not disclosed in the NVD description. What can be stated with confidence is that the defect lies in mismatch between event-level and element-level authorization enforcement during reference creation, which is consistent across the CWE-862 classification and the described behavior.

Attack surface: the MISP web interface and its underlying REST API, specifically the functionality used to create references (relationships) between attributes and objects. Because MISP is commonly deployed as a shared, multi-tenant intelligence platform, the set of potentially impacted actors is any authenticated non-admin user with event visibility — a broad population by design.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-94394. The attack chain below is inferred from the vulnerability class (CWE-862, broken object-level authorization) and the behaviors explicitly described in the NVD entry. It does not rely on any invented function, endpoint, or parameter names.

1. Reconnaissance / target identification. The attacker requires a valid, authenticated account on a MISP instance that is not a site administrator account, and must already have access to an event that contains more restricted data. This is a low bar in collaborative sharing environments where external partners, analysts, or junior staff are granted event-level visibility while certain indicators inside those events are compartmentalized by sharing group or distribution level. The attacker identifies or is granted access to such an event.

2. Triggering the specific flaw class. The attacker initiates the reference-creation workflow between objects or attributes within the accessible event. Because MISP authorizes the action against the event as a whole and does not always check the individual data elements, the per-element distribution/sharing-group restriction is not enforced at this step.

3. Execution at the vulnerability-class level. The missing element-level authorization check permits the operation to proceed against data the user is not entitled to access. Through this gap, the attacker reaches attribute values, object details, or related object data that were meant to be restricted. Because references link data elements, the reference relationship itself can reveal structure and content beyond what the user's distribution rights permit.

4. Post-exploitation impact. The attacker obtains read access to sensitive, restricted threat intelligence — attribute values, object details, and related object data. Given that MISP data frequently contains victim indicators, internal naming conventions, attribution details, and indicators intentionally compartmentalized from certain sharing partners, disclosure can cause intelligence leakage, loss of trust among sharing partners, and potential operational exposure of the originating organizations.

No public PoC exists; the chain above is a conceptual reconstruction of the attack at the vulnerability-class level. Actual exploitability varies with the specific deployment's data compartmentalization and the attacker's pre-existing event access.

Impact Assessment

The impact is confidentiality-only. An authenticated, non-administrative user who already holds event-level access can view sensitive attribute values, object details, or related object data that should have been restricted to a specific sharing group or distribution level. There is no described impact to integrity or availability in the NVD entry.

Using the estimated CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the subscores are:

• Attack Vector: Network (N) — MISP is typically reachable over the network via its web/API interface.
• Attack Complexity: Low (L) — no specialized conditions are described beyond the pre-existing access requirement.
• Privileges Required: Low (L) — the attacker must be an authenticated non-admin user with event access.
• User Interaction: None (N) — the described flaw is triggered through the attacker's own reference-creation action.
• Scope: Unchanged (U) — the vulnerable component (MISP authorization logic) and impacted component are the same.
• Confidentiality: High (H) — restricted attribute values, object details, and related object data are exposed.
• Integrity / Availability: None (N) — no integrity or availability impact is described.

Note on CVSS: No official CVSS score or vector is provided in the source data; the vector above is an analytical estimate and must not be represented as vendor- or NVD-assigned.

Blast radius: Any MISP deployment hosting events where distribution levels and sharing groups are used to compartmentalize data within a broader event. Multi-tenant and consortium deployments are most at risk because event-level access is commonly granted broadly while element-level restrictions carry the sensitive compartmentation.

Business impact: Loss of control over sensitive threat intelligence, degradation of trust in a platform whose central value proposition is controlled sharing, potential regulatory or contractual implications if restricted indicators are disclosed to unauthorized parties, and possible downstream exposure of victim organizations identified in the leaked indicators.

Detection Guidance

Sigma Rule

title: MISP Reference Creation by Non-Admin User Accessing Restricted Data
id: 3c9f7a12-8d4b-4e21-9a6f-misp202694394
status: experimental
description: Detects reference creation activity in MISP by non-administrator accounts that may trigger missing element-level authorization (CVE-2026-94394).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94394
author: valtersit.com
date: 2026/01/01
logsource:
  product: misp
  service: audit
detection:
  selection_action:
    action|contains:
      - 'addReference'
      - 'reference'
      - 'attachReference'
  selection_role:
    user_role|contains:
      - 'User'
      - 'non_admin'
      - 'analyst'
  filter_admin:
    user_role|contains: 'admin'
  condition: selection_action and selection_role and not filter_admin
falsepositives:
  - Legitimate analysts creating references within their authorized sharing group
level: medium
tags:
  - attack.t1213
  - cwe.862

YARA Rule

rule CVE_2026_94394_MISP_Missing_Element_AuthZ
{
    meta:
        description = "Detects indicators of MISP missing element-level authorization on reference creation (CVE-2026-94394)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94394"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $misp1 = "MISP" ascii wide nocase
        $a1 = "reference" ascii wide nocase
        $a2 = "sharing_group" ascii wide nocase
        $a3 = "distribution" ascii wide nocase
    condition:
        $misp1 and 2 of ($a*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94394 MISP Potential Missing Element-Level Authorization on Reference Creation"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"reference"; nocase; http.uri; content:"misp"; nocase; classtype:attempted-recon; sid:202694394; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-94394;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ authentication where event.category == "authentication" and event.outcome == "success" ]
  [ http where http.request.method == "POST" and
      http.request.body.content : ("reference" or "Reference") and
      http.request.body.content : ("sharing_group" or "distribution") ]

Splunk SPL Query

index=misp sourcetype=misp:audit OR sourcetype=misp:access
(action="addReference" OR uri_path="*reference*")
user_role!="admin"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths
        values(action) as actions by src_ip, user, user_role
| where count > 5
| sort - count
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"),
       last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")

Wazuh OSSEC Rule

<group name="misp,cve-2026-94394,">
  <rule id="202694" level="10">
    <decoded_as>json</decoded_as>
    <field name="user_role">\.+</field>
    <match>addReference|reference</match>
    <description>CVE-2026-94394: Possible MISP missing element-level authorization on reference creation by non-admin user</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>cwe_862,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations (no vendor patch available):

• Restrict the population of accounts that can create references between objects and attributes to trusted, vetted users, reducing exposure to the described attack flow.
• Review sharing group and distribution configurations to ensure that sensitive attributes and objects are not embedded within broadly distributed events, minimizing the data that could be exposed through element-level authorization gaps.
• Enforce least privilege: avoid granting event-level visibility to users who do not require it, since the flaw is preconditioned on event access.
• Monitor and alert on reference-creation actions by non-administrative users (see Detection Guidance above).
• Where feasible, apply compensating network controls that limit MISP web/API access to trusted networks or VPN segments.

2) Patch/upgrade steps:

• No patch, fixed version, or advisory is available in the tracked sources for this CVE. Continuously monitor the MISP project's official release channels, security advisories, and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-94394 for an update.
• When a fix is released, upgrade to the vendor-designated fixed version promptly, prioritizing internet-exposed and multi-tenant deployments.
• Validate post-upgrade that element-level authorization is enforced during reference creation across sharing group and distribution boundaries.

3) Long-term hardening:

• Adopt defense-in-depth for authorization: enforce per-element checks at the service layer for every data element, not just at the event container.
• Perform authorization testing (BOLA/IDOR and missing-function-level checks) against MISP during integration and after every upgrade.
• Segment sharing groups so that compartmentalized indicators are hosted in dedicated events rather than nested within broadly shared events.
• Maintain audit logging of all reference and relationship operations and periodically review for anomalous access patterns by non-admin users.

References

• NVD — CVE-2026-94394: https://nvd.nist.gov/vuln/detail/CVE-2026-94394
• MITRE CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• MISP Project (official site / release notes): https://www.misp-project.org/
• MISP GitHub repository (source of truth for security fixes): https://github.com/MISP/MISP
• CISA KEV Catalog: Not applicable — CVE-2026-94394 is not listed in CISA KEV, and no exploit-in-the-wild evidence or threat actor campaign is available in the provided data.