In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event's distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed.
The result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report's own access-control policy.
The vulnerability requires an authenticated MISP user with at least read access to the affected event.
"}],"value":"In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event's distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed.\n\nThe result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report's own access-control policy.\n\nThe vulnerability requires an authenticated MISP user with at least read access to the affected event."}],"impacts":[{"capecId":"CAPEC-126","descriptions":[{"lang":"en","value":"CAPEC-126 Exploiting Incorrectly Configured Access Controls"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.3,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-639","description":"CWE-639 Authorization Bypass Through User-Controlled Key","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-22T14:06:59.969Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/MISP/MISP/commit/6932aace8"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The report fetch in the Overmind event enrichment now applies the caller's ACL via EventReport::buildACLConditions($user), enforcing the report's own distribution policy in addition to the event-level access. A condition on EventReport.deleted = 0 is also added to exclude soft-deleted reports. The query is further hardened with recursive = -1 and an explicit contain clause to limit the data retrieved.
"}],"value":"The report fetch in the Overmind event enrichment now applies the caller's ACL via EventReport::buildACLConditions($user), enforcing the report's own distribution policy in addition to the event-level access. A condition on EventReport.deleted = 0 is also added to exclude soft-deleted reports. The query is further hardened with recursive = -1 and an explicit contain clause to limit the data retrieved."}],"title":"MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"none","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The tag_version_boundary (v2.5.47, 57 commits after fix) is used as the nearest known version boundary; the exact first fixed release is not explicitly stated in the patch metadata, so the affected range is marked as less_than 2.5.47 with 'unspecified' version.","CVSS PR:L assumes the attacker needs only a standard authenticated MISP account with read access to the event; the specific role/permission level required is not detailed in the patch.","CVSS VC:H assumes the report content constitutes sensitive threat-intelligence data; the actual sensitivity depends on the report's content and the organization's data classification.","CAPEC-126 is selected as the closest match; the flaw is more precisely a missing authorization check (CWE-862) rather than a misconfiguration of an existing control, but no CAPEC entry specifically covers 'missing authorization on a sub-resource' more precisely.","The patch does not include test cases or reproduction steps; exploitability assessment is based solely on the code diff and commit message.","The 'Overmind' feature is assumed to be a MISP UI component for event viewing; its exact configuration and deployment context are not specified in the patch."],"capecRationale":[{"capecId":"CAPEC-126","rationale":"The access control for the EventReport resource was incorrectly configured (or absent) in the Overmind event-view code path: the report's distribution ACL was not applied, effectively leaving the resource accessible to any user who could see the parent event. This is the closest CAPEC to a missing/incomplete authorization check on a specific resource. The mapping is slightly uncertain because the flaw is a missing check rather than a misconfiguration of an existing check, but CAPEC-126 is the best available match for an access-control enforcement gap on a specific object."}],"commit":"6932aace844520526819253ea285def97e48189e","confidence":"medium","credits":[{"lang":"en","type":"reporter","value":"Jeroen Pinoy"},{"lang":"en","type":"remediation developer","value":"iglocska"},{"lang":"en","type":"remediation developer","value":"Claude Fable 5.1"}],"cvssRationale":"AV:N: MISP is a network-accessible web application. AC:L: An authenticated user with read access to any event simply views it in the Overmind interface; no race conditions, special timing, or complex manipulation are required. AT:N: No attack-target manipulation is needed. PR:L: The attacker must be an authenticated MISP user with at least read permission on the event; no administrative privileges are required. UI:N: No victim interaction beyond the attacker's own viewing action. VC:H: Sensitive threat-intelligence report content (IOCs, analysis, context) is disclosed to a user the report's distribution explicitly excludes. VI:N, VA:N: No integrity or availability impact. SC:N, SI:N, SA:N: The impact is confined to the MISP instance's own data; no cross-system impact is evidenced.","fixSummary":"The report fetch in the Overmind event enrichment now applies the caller's ACL via EventReport::buildACLConditions($user), enforcing the report's own distribution policy in addition to the event-level access. A condition on EventReport.deleted = 0 is also added to exclude soft-deleted reports. The query is further hardened with recursive = -1 and an explicit contain clause to limit the data retrieved.","generatedAt":"2026-09-22T13:58:09.551694Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":9,"assumptionCount":6,"confidence":"medium","model":"qwen3.8:27b","score":4}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"d3472acf034e415d9322bc1f5f399efb811afbb547bc230fe69d2e83c2975dd2","patchSummary":"In app/Controller/EventsController.php, the __enrichEvent() method's report lookup is changed from a simple event_id condition to a composite condition built from EventReport::buildACLConditions($user) combined with EventReport.event_id and EventReport.deleted = 0. The find() call is updated to use the new $reportConditions array, adds 'contain' => EventReport::DEFAULT_CONTAIN, and sets 'recursive' => -1 to prevent unnecessary eager-loading of associated models.","patchTruncated":false,"patches":[{"commit":"6932aace844520526819253ea285def97e48189e","patchSha256":"d3472acf034e415d9322bc1f5f399efb811afbb547bc230fe69d2e83c2975dd2","source":"https://github.com/MISP/MISP/commit/6932aace8.patch","sourceUrl":"https://github.com/MISP/MISP/commit/6932aace8.patch","subject":"fix: [security] Apply the caller's ACL to the event view's"}],"source":"https://github.com/MISP/MISP/commit/6932aace8.patch","subject":"fix: [security] Apply the caller's ACL to the event view's","tagVersionBoundary":{"commits_after_fix":57,"repository":"https://github.com/MISP/MISP","tag":"v2.5.47","version":"2.5.47","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-862","rationale":"The report's own ACL/distribution check was entirely absent from the Overmind event-view enrichment path. The code fetched the report by event ID without invoking buildACLConditions(), so the report-level authorization policy was never enforced for this code path."},{"cweId":"CWE-639","rationale":"The event ID, which is a user-controllable identifier in the request, was used as the sole key to retrieve a report resource whose access should be independently governed by the report's distribution. This allowed bypass of the report's authorization by leveraging the event-level access."}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20285"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-95683","datePublished":"2026-09-22T14:06:59.969Z","dateReserved":"2026-09-22T14:06:57.011Z","dateUpdated":"2026-09-22T15:28:07.198Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-22 15:17:26","lastModifiedDate":"2026-09-22 16:18:22","problem_types":["CWE-639","CWE-862","CWE-862 CWE-862 Missing Authorization","CWE-639 CWE-639 Authorization Bypass Through User-Controlled Key"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-22T15:27:57.869012Z","id":"CVE-2026-95683","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"95683","Ordinal":"1","Title":"MISP Overmind Event View Discloses Report Content Bypassing Repo","CVE":"CVE-2026-95683","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"95683","Ordinal":"1","NoteData":"In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event's distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed.\n\nThe result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report's own access-control policy.\n\nThe vulnerability requires an authenticated MISP user with at least read access to the affected event.","Type":"Description","Title":"MISP Overmind Event View Discloses Report Content Bypassing Repo"}]}}}