Improper Access Control in MISP Report Management
CVE-2026-94393

6.4MEDIUM

Key Information:

Vendor

Misp

Status
Misp
Vendor
CVE Published:
21 September 2026

What is CVE-2026-94393?

The MISP platform has a vulnerability that allows an attacker with editor access to one event to improperly manipulate report management. By knowing or guessing a report's UUID, an attacker can retrieve and modify reports from different events, bypassing intended access controls. This could lead to unauthorized exposure or alteration of sensitive reports, undermining the integrity of data across event boundaries.

Affected Version(s)

MISP 0 < 2.5.47

References

https://github.com/MISP/MISP/commit/43665b9bb
patch

CVSS V4

Score:
6.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

iglocska
Claude Opus 4.8
David André
Jeroen Pinoy
.