CVE-2026-95683 in MISP
Summary
by MITRE • 09/22/2026
In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event's distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed.
The result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report's own access-control policy.
The vulnerability requires an authenticated MISP user with at least read access to the affected event.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
This vulnerability represents a critical failure in access control logic within the Misinformation, Intelligence Sharing Platform (MISP), specifically affecting the Overmind event view feature which is designed to enrich events by displaying their most recent attached report for preview purposes. The core technical flaw lies in how the application constructs its database queries when retrieving these reports. Instead of validating the retrieved object against all applicable security policies, the system relies solely on the parent event's identifier as the lookup condition. This approach fundamentally ignores the independent distribution settings and Access Control Lists (ACLs) that are attached to individual MISP reports. In a properly secured environment, each report should be treated as an autonomous entity with its own visibility constraints, which may be significantly more restrictive than those of the parent event it is associated with. By bypassing these granular checks, the application creates a path for unauthorized data retrieval where the security boundary defined by the event does not align with or enforce the stricter boundaries defined by the report itself.
The operational impact of this flaw is an unauthorized disclosure of sensitive threat intelligence content to users who are explicitly excluded from viewing it under normal circumstances. An authenticated user possessing only read access to a specific event can exploit this logic error to retrieve and view reports that were intended for a different audience or restricted group. This undermines the principle of least privilege, as the user gains visibility into information they should not have based on their assigned role and permissions relative to the report's distribution settings. Furthermore, the vulnerability extends beyond just bypassing access controls; it also fails to filter out soft-deleted reports from the query results. This means that administrators or users who had previously removed a report for compliance, accuracy, or other administrative reasons can still retrieve its content through this endpoint. The combination of ignoring ACLs and failing to respect deletion states significantly amplifies the risk profile, allowing access to both restricted active data and archived sensitive information that should be inaccessible.
From a classification perspective, this issue aligns with CWE-284 Improper Access Control, as the application fails to enforce proper authorization checks on critical resources. It also relates closely to CWE-601 URL Redirection to Untrusted Site or Resource in terms of logic flow, but more accurately fits CWE-732 Incorrect Permission Assignment for Critical Resource because the permissions assigned to the report object are not being correctly applied during retrieval. In the context of the MITRE ATT&CK framework, this vulnerability facilitates Information Discovery and potentially Data Exfiltration if an attacker leverages this access to gather intelligence about other organizations or sensitive operational details contained within the reports. The attack vector is straightforward for any authenticated user with basic read privileges on a targeted event, requiring no special privileges beyond standard account access, which makes it particularly dangerous in multi-tenant environments where data isolation between different trust levels is paramount.
To mitigate this vulnerability, developers must refactor the enrichment logic to ensure that every retrieved report undergoes a comprehensive validation process against its specific distribution and ACL settings before being returned to the user interface. This involves querying not just for reports linked by event ID but also verifying that the requesting user's permissions satisfy the individual constraints of each report object. Additionally, the database query must be updated to explicitly exclude soft-deleted records from the result set, ensuring that administrative removals are respected and do not leak historical data. Implementing these fixes requires a thorough review of all endpoints that handle attached objects to ensure consistent application of security policies across different entity types. Regular penetration testing focused on access control bypasses and unit tests covering edge cases for deleted or restricted items will help prevent similar logical flaws in future updates, ensuring that the integrity of threat intelligence sharing remains robust against internal privilege escalation attempts.