EUVD-2026-84501

A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'themingenabled' with a trailing asterisk instead of the correct 'themingenabled'. In the MISP ACL system, the array values define which role o...

CVE-2026-95805 MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction

A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'themingenabled' with a trailing asterisk instead of the correct 'themingenabled'. In the MISP ACL system, the array values define which role o...

CVE-2026-95805

CVE-2026-95805 affects the MISP ACLComponent , where a typo in the access control list caused the previewEventAttributes action to reference the permission string 'theming_enabled*' (with a trailing asterisk) instead of the correct 'theming_enabled'. Since the malformed key matches no valid permi...

CVE-2026-95805: Improper Authorization

A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'themingenabled' with a trailing asterisk instead of the correct 'themingenabled'. In the MISP ACL system, the array values define which role o...

CVE-2026-95685: Missing Authorization

MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of suggestion content within an event report, was incorrectly mapped to the wildcard permission '' in the ACLComponent, making it accessible to any authenticated...

CVE-2023-24028

CVE-2023-24028 affects MISP 2.4.167 where the decaying import function in app/Controller/Component/ACLComponent.php has incorrect access control. The CVSS 3.1 base score is 9.8 (CRITICAL) with network attack vector, no privileges, and no user interaction; impact to confidentiality, integrity, and...