Description
In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event's distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed.

The result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report's own access-control policy.

The vulnerability requires an authenticated MISP user with at least read access to the affected event.
Published: 2026-09-22
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Report Disclosure
Action: Apply Patch
AI Analysis

Impact

The vulnerability exists in the Overmind event view of MISP, where the system enriches an event with its latest attached report. The report is fetched strictly by event ID and does not apply the report’s own distribution or ACL controls. Consequently, an authenticated user who can read the event may view a report that its distribution explicitly excludes. The failure also includes soft‑deleted reports, which are retrieved despite having been administratively removed. This flaw represents a lack of proper authorization enforcement (CWE‑639) and information disclosure (CWE‑862).

Affected Systems

The vendor and product are MISP MISP. No specific affected versions are listed in the CVE; the issue applies to any MISP installation that uses Overmind event enrichment. Administrators should verify that their MISP instance is updated to the latest patch that adds ACL checks to report fetching.

Risk and Exploitability

The CVSS v3 score is 5.3, indicating a moderate risk level. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. An attacker must be an authenticated MISP user with at least read access to the target event; no further privileges or additional exploits are required. Once ACL enforcement is bypassed, the attacker can read hidden report content and other sensitive threat‑intel data.

Generated by OpenCVE AI on September 22, 2026 at 16:07 UTC.

Remediation

Vendor Solution

The report fetch in the Overmind event enrichment now applies the caller's ACL via EventReport::buildACLConditions($user), enforcing the report's own distribution policy in addition to the event-level access. A condition on EventReport.deleted = 0 is also added to exclude soft-deleted reports. The query is further hardened with recursive = -1 and an explicit contain clause to limit the data retrieved.

OpenCVE Recommended Actions

  • Upgrade MISP to the patched version that enforces ACL conditions for report retrieval (commit 6932aace8).
  • If an upgrade cannot be applied immediately, temporarily disable the Overmind enrichment feature or reconfigure ACL settings to enforce report‑level distribution rules.
  • Ensure that reports marked as soft‑deleted are archived or removed so they cannot be retrieved by users.

Generated by OpenCVE AI on September 22, 2026 at 16:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 24 Sep 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Misp
Misp misp
Vendors & Products Misp
Misp misp

Tue, 22 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Description In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event's distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed. The result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report's own access-control policy. The vulnerability requires an authenticated MISP user with at least read access to the affected event.
Title MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL
Weaknesses CWE-639
CWE-862
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Misp Misp
cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-09-22T15:28:07.198Z

Reserved: 2026-09-22T14:06:57.011Z

Link: CVE-2026-95683

cve-icon Vulnrichment

Updated: 2026-09-22T15:28:02.309Z

cve-icon NVD

Status : Deferred

Published: 2026-09-22T15:17:26.040

Modified: 2026-09-22T16:18:22.837

Link: CVE-2026-95683

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T16:15:08Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key

  • CWE-862

    Missing Authorization