CVE-2026-86347 MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion

Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts...