Description
When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event.

As a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report’s UUID. Once moved, they could view and change information that they were not originally allowed to access.

The vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID.

The main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP’s normal access restrictions.

Version affected: <2.5.47
Published: 2026-09-21
Score: 6.4 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized report access and modification across events
Action: Patch Immediately
AI Analysis

Impact

The flaw in MISP’s editReport endpoint permits a user with edit rights on an event to resolve a report UUID that belongs to a different event without validating ownership. By supplying such a UUID, the user can reparent the report into their own event, gaining the ability to view and modify private report data that should remain restricted. This results in a breach of confidentiality and integrity for event reports.

Affected Systems

The vulnerability is present in MISP prior to version 2.5.47. It affects installations of the MISP platform that use the editReport functionality to create or modify reports.

Risk and Exploitability

With a CVSS score of 6.4 and no EPSS data, the risk is moderate; the flaw is not currently listed in CISA’s KEV catalog. Exploitation requires that the attacker already has editor privileges on at least one event and can discover or guess a valid report UUID. Once those conditions are met, the attacker can move a report across event boundaries, exposing sensitive information and enabling unauthorized edits. The lack of an immediate kill chain requirement makes it feasible for a legitimate editor acting maliciously, while a remote attacker would need to compromise the MISP UI or obtain privileged access.

Generated by OpenCVE AI on September 21, 2026 at 15:22 UTC.

Remediation

Vendor Solution

The fix adds an ownership check in editReport: before adopting an existing report found by UUID, the code now verifies that the report's event_id matches the event being edited. If the UUID resolves to a report belonging to a different event, the operation is rejected with an error message, preventing cross-event reparenting, unauthorized read, and unauthorized overwrite of reports.

OpenCVE Recommended Actions

  • Upgrade MISP to version 2.5.47 or later to apply the ownership check added to editReport
  • If upgrading cannot be performed immediately, restrict editor rights to trusted administrators for events that contain sensitive reports and disable the ability to edit reports through the UI until the patch is deployed
  • After applying the patch, audit existing reports to confirm that no cross‑event reparenting has occurred and review access logs for unexpected reporting actions

Generated by OpenCVE AI on September 21, 2026 at 15:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 21 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Misp
Misp misp
Vendors & Products Misp
Misp misp

Mon, 21 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report’s UUID. Once moved, they could view and change information that they were not originally allowed to access. The vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID. The main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP’s normal access restrictions. Version affected: <2.5.47
Title MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport
Weaknesses CWE-284
CWE-639
References
Metrics cvssV4_0

{'score': 6.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N'}

Subscriptions

Misp Misp
cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-09-21T15:18:17.855Z

Reserved: 2026-09-21T13:13:54.299Z

Link: CVE-2026-94393

cve-icon Vulnrichment

Updated: 2026-09-21T15:18:10.327Z

cve-icon NVD

Status : Deferred

Published: 2026-09-21T14:17:30.500

Modified: 2026-09-21T16:17:30.677

Link: CVE-2026-94393

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T15:30:16Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-639

    Authorization Bypass Through User-Controlled Key