What’s Vulnerable › Vulnerabilities
CVE-2026-94393: MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport
- Severity: medium (CVSS 6.4 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-21 · updated 2026-09-21
- Weakness: CWE-284
Description
When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report’s UUID. Once moved, they could view and change information that they were not originally allowed to access. The vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID. The main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP’s normal access restrictions. Version affected: <2.5.47
Affected products
- MISP: before 2.5.47 — fixed in 2.5.47
How to fix
Upgrade to a fixed version: MISP 2.5.47. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-94393 or the next vulnerability affects your stack