CVE-2026-94393 in MISP
Summary
by MITRE • 09/21/2026
When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event.
As a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report’s UUID. Once moved, they could view and change information that they were not originally allowed to access.
The vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID.
The main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP’s normal access restrictions.
Version affected: <2.5.47
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/21/2026
This vulnerability represents a critical failure in object ownership verification within the Malware Information Sharing Platform, specifically affecting versions prior to 2.5.47. The core technical flaw lies in the application logic governing report management during event creation or editing operations. When a user attempts to associate an existing report with an event, the system relies exclusively on the Universally Unique Identifier of that report for identification purposes. Crucially, the backend implementation fails to validate whether the identified report is already associated with the target event or belongs to a different entity entirely. This lack of cross-reference integrity allows the application to accept any valid UUID provided by the user interface without confirming ownership boundaries. The design assumes that if an object exists and has a valid identifier, it can be linked freely, ignoring the fundamental security principle that access control checks must verify not just existence but also authorization relative to the current context and user permissions.
The operational impact of this flaw is significant for organizations relying on MISP for sensitive threat intelligence sharing. An attacker who possesses editor-level privileges on any single event within a shared instance can exploit this mechanism to infiltrate reports belonging to other events. By supplying the UUID of a report from a different, potentially more restricted or private event, the user effectively hijacks that report into their own workspace. Once moved, the attacker gains full read and write access to the contents of that external report. This bypasses MISP’s standard role-based access controls which are designed to isolate data between events based on organizational boundaries or trust levels. Consequently, confidential threat indicators, private analysis notes, or restricted intelligence summaries can be exposed to unauthorized parties or altered maliciously, compromising both confidentiality and integrity within the platform.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, as it involves failing to enforce proper restrictions on authorized individuals accessing specific resources. It also maps closely to CWE-601 URL Redirection to Untrusted Site via User-Controlled Key if one considers the UUID as an unvalidated key that redirects access privileges. In terms of the MITRE ATT&CK framework, this behavior is consistent with T1530 Data from Information Repositories, where an adversary accesses data stored in remote repositories or databases without proper authorization. The attack vector requires local network access and valid credentials for at least one event, placing it within the scope of insider threats or compromised accounts rather than external unauthenticated attacks.
Mitigation strategies must focus on immediate patching and enhanced validation logic. Organizations running affected versions should upgrade to version 2.5.47 or later where this ownership verification has been corrected. In environments where upgrading is not immediately feasible, administrators can implement compensating controls by restricting editor privileges to only those events that contain non-sensitive data until the patch is applied. Additionally, auditing logs for unusual patterns of report UUID usage across different event IDs may help detect exploitation attempts in real-time. Future development should enforce strict ownership checks at the database level, ensuring that any association between a user’s action and an external object includes explicit verification that the target resource belongs to the same organizational context or has been explicitly shared with the requesting entity.