CVE-2026-95683: MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL
In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event's distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed.
The result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report's own access-control policy.
The vulnerability requires an authenticated MISP user with at least read access to the affected event.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated MISP user with read access to an affected event can exploit it. The user does not need access to the attached report if the report's distribution/ACL would normally exclude them.
What report content may be exposed?
The Overmind event view can expose the most recent report attached to an event, including a report with distribution restrictions more restrictive than the event. Soft-deleted reports may also be returned and disclosed.
Are all event viewers exposed to all reports?
Exposure depends on an event having a most recent attached report whose independent distribution policy excludes a user that can still read the parent event. Reports with the same or less restrictive access than the event would not represent an ACL bypass for that user.
How can administrators identify potentially affected content?
Review events accessible to users outside a report's distribution scope, particularly where attached reports have more restrictive distribution settings than their parent events. Also review soft-deleted reports attached to events, because the affected lookup did not exclude them.