CVE-2026-91851
2026-09-15
09h16 +00:00
09h16 +00:00
Thông báo cho một CVE
Luôn được thông báo về mọi thay đổi đối với một CVE cụ thể.
Mô tả CVE
Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag.
DashboardsController::listTemplates() allowed a template when either:
- its restrict_to_permission_flag matched one of the current user’s permission flags, or
- restrict_to_permission_flag equaled integer 0
However, restrict_to_permission_flag is a varchar. MySQL therefore performed numeric coercion when comparing the column against integer 0. Strings such as perm_site_admin convert numerically to zero, making expressions such as perm_site_admin = 0 evaluate true and causing the “unrestricted” branch to match permission-restricted templates as well.
Version affected: ≤2.5.45
Thông tin CVE
Điểm yếu liên quan
| Tên điểm yếu | Nguồn | |
|---|---|---|
| Incorrect Comparison The product compares two entities in a security-relevant context, but the comparison is incorrect. |
||
| Incorrect Authorization The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
