CVE-2026-94393 Details
Description
When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report’s UUID. Once moved, they could view and change information that they were not originally allowed to access. The vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID. The main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP’s normal access restrictions. Version affected: <2.5.47
A vulnerability in MISP prior to version 2.5.47 allows users with editing rights on one event to improperly access and modify reports from other events. This issue arises because the application can identify reports by their UUID without verifying if they belong to the same event. As a result, an editor could move a report into their event, access, and alter information that was originally restricted. The vulnerability could lead to unauthorized exposure or modification of private event reports, circumventing MISP's access controls.
Users can update to MISP version 2.5.47 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MISP/MISP/commit/43665b9bb | CIRCL | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | CIRCL |
| CWE-639 | Authorization Bypass Through User-Controlled Key | CIRCL |
Affected Products
| Product | Versions |
|---|---|
| MISP | < 2.5.47 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | CIRCL |