Unauthorized Access in MISP Overmind Event View for Threat Intelligence Reports

CVE-2026-95683

What is CVE-2026-95683?

A security vulnerability in MISP allows authenticated users with read access to certain events to view sensitive threat intelligence reports, even if the reports' access permissions exclude them. The issue arises from a flaw in the enrichment logic of the Overmind event view, which retrieves reports based solely on event IDs without considering individual distribution and access control settings. This oversight may lead to unauthorized disclosure of report content, as users are able to access information from soft-deleted reports as well. Proper patching is essential to mitigate this risk and uphold data confidentiality.

References