CVE-2026-94393: MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport
When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event.
As a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report’s UUID. Once moved, they could view and change information that they were not originally allowed to access.
The vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID.
The main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP’s normal access restrictions.
Version affected: <2.5.47
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.47 - Configuration
In editReport, add/ensure an ownership check so that when resolving an existing report by UUID, the code verifies the report's event_id matches the event being edited before adopting/moving it.
MISP editReport ownership check (event_id match before adopting report by UUID) = enabled
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs editor access to at least one MISP event. They must also know or discover the UUID of a report in another event.
What information or actions become possible after exploitation?
The attacker could reparent the targeted report into an event they can edit. This may allow them to view and modify private report information that they were not originally authorized to access.
Which versions are affected?
MISP versions earlier than 2.5.47 are affected.
How can I assess whether a suspected incident is plausible?
A suspected attacker would need both editor permissions on an event and access to a valid report UUID from another event. The relevant outcome to investigate is a report being moved between event boundaries and then viewed or changed by users who lacked access to its original event.