CVE-2026-91851 MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison
Attackers can bypass dashboard template restrictions in MISP due to MySQL type coercion, accessing restricted templates without proper permissions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-91851?
CVE-2026-91851 is a medium-severity authentication bypass vulnerability in MISP, published on 15 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag.
DashboardsController::listTemplates() allowed a template when either:
- its restrict_to_permission_flag matched one of the current user’s permission flags, or
- restrict_to_permission_flag equaled integer 0
However, restrict_to_permission_flag is a varchar. MySQL therefore performed numeric coercion when comparing the column against integer 0. Strings such as perm_site_admin convert numerically to zero, making expressions such as perm_site_admin = 0 evaluate true and causing the “unrestricted” branch to match permission-restricted templates as well.
Version affected: ≤2.5.45
Which versions are affected by CVE-2026-91851?
How do I fix CVE-2026-91851?
No fix has been published for CVE-2026-91851 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-91851 being exploited?
There is no known exploitation of CVE-2026-91851 in the wild and no public exploit code.
Sources
Also known as GHSA-x44q-9w6w-p22f.