Vulnerability · Published Sep 22, 2026 · Assigned by CIRCL
CVE-2026-95683MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL
Medium 5.3
In plain English
A medium-severity missing authorization in MISP from MISP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Official description
In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event's distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed. The result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report's own access-control policy. The vulnerability requires an authenticated MISP user with at least read access to the affected event.
Affected products (as reported)
Weakness: CWE-862, CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References
- Security patch patch