{"id":"CVE-2026-86408","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-86408","summary":"Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view().\n\n\nThe vulnerable handler queried CryptographicKey…","details":"Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view().\n\n\nThe vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as:\n\n\n\n  *  \ntype\n\n\n  *  \nkey_data\n\n\n  *  \nfingerprint\n\n\n\n\n\nbut did not fetch or authorize the associated parent event first.\n\n\nThe upstream commit explicitly states that cryptographicKeys/view could return a protected event’s signing key to any authenticated user.\n\n\nThe fix adds parent_id and parent_type to the lookup and then enforces authorization through the associated event using fetchSimpleEvent($user, parent_id). If the parent is not an Event, access is limited to site administrators.\n\nVersion affected: ≤2.5.45","published":"2026-09-07T13:20:40.100","modified":"2026-09-07T13:20:40.100","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/MISP/MISP/commit/2edde619b","label":"MISP/MISP@2edde61"},"references":[{"type":"WEB","url":"https://github.com/MISP/MISP/commit/2edde619b"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-09-07T13:20:40.100"}}