MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport
Summary
| CVE | CVE-2026-94393 |
|---|---|
| State | PUBLISHED |
| Assigner | CIRCL |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-21 14:17:30 UTC |
| Updated | 2026-09-21 16:17:30 UTC |
| Description | When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report’s UUID. Once moved, they could view and change information that they were not originally allowed to access. The vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID. The main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP’s normal access restrictions. Version affected: <2.5.47 |
Risk And Classification
Primary CVSS: v4.0 6.4 MEDIUM from 5a6e4751-2f3f-4070-9419-94fb35b644e8
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.002200000 probability, percentile 0.127200000 (date 2026-09-22)
Problem Types: CWE-284 | CWE-639 | CWE-639 CWE-639 Authorization Bypass Through User-Controlled Key | CWE-284 CWE-284 Improper Access Control
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 5a6e4751-2f3f-4070-9419-94fb35b644e8 | Secondary | 6.4 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 6.4 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/MISP/MISP/commit/43665b9bb | 5a6e4751-2f3f-4070-9419-94fb35b644e8 | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: iglocska (en)
CNA: Claude Opus 4.8 (en)
CNA: David André (en)
CNA: Jeroen Pinoy (en)
Additional Advisory Data
Solutions
CNA: The fix adds an ownership check in editReport: before adopting an existing report found by UUID, the code now verifies that the report's event_id matches the event being edited. If the UUID resolves to a report belonging to a different event, the operation is rejected with an error message, preventing cross-event reparenting, unauthorized read, and unauthorized overwrite of reports.