CVE-2026-95685: MISP Missing Authorization on replaceSuggestionInReport Event Report Action
MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of suggestion content within an event report, was incorrectly mapped to the wildcard permission ('') in the ACLComponent, making it accessible to any authenticated user regardless of their assigned permissions. All analogous report-modification actions correctly required the permadd permission, while read-only actions such as downloadAsPDF appropriately used the wildcard.
An authenticated user without the permadd permission could invoke the replaceSuggestionInReport endpoint to alter report suggestion data, violating the intended authorization model.
This constitutes an improper authorization weakness that could lead to unauthorized modification of event report content, potentially corrupting shared threat intelligence data or injecting misleading information into reports relied upon by other analysts and automated consumers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the ACL mapping for the replaceSuggestionInReport EventReports action from the wildcard permission (*) to perm_add so only users granted the add permission can invoke it.
MISP ACLComponent replaceSuggestionInReport permission mapping = perm_add
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated MISP user can exploit it, including users who have not been granted the perm_add permission. The flaw exposes the replaceSuggestionInReport action because it was accessible through the wildcard ACL permission.
What access does an attacker need?
The attacker needs a valid authenticated MISP account and the ability to invoke the replaceSuggestionInReport endpoint. No perm_add permission is required to modify suggestion content through the affected action.
What is the potential impact on affected deployments?
An unauthorized user may alter suggestion data in event reports. This can corrupt shared threat-intelligence content or introduce misleading information that other analysts and automated consumers rely on.