CVE-2026-94393
Deferred Deferred - Pending Action

MISP Report UUID Misuse Leads to Unauthorized Event Access

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: CIRCL

Description
When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report’s UUID. Once moved, they could view and change information that they were not originally allowed to access. The vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID. The main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP’s normal access restrictions. Version affected: <2.5.47

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94393
EUVD
EUVD-2026-83911

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp to 2.5.47 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an editor in one event to move a report from another event into their own event by using the report's UUID. The system fails to verify if the report belongs to the same event before allowing the change, which bypasses normal access restrictions and could expose or modify private reports.

Detection Guidance

This vulnerability requires manual inspection of MISP event reports and UUID handling. Check if reports can be moved between events without proper authorization by verifying event ownership for each report UUID. Review logs for unauthorized report modifications or access attempts.

Impact Analysis

If you have editor access to an event, an attacker with knowledge of a report UUID could move that report into your event. This could allow them to view or alter sensitive information in reports they should not have access to, potentially leading to data leaks or unauthorized modifications.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure or modification of private reports may result in non-compliance with data protection regulations, potentially leading to legal and financial penalties.

Mitigation Strategies

Upgrade MISP to version 2.5.47 or later to address the vulnerability. Ensure that only authorized users have editor access to events and restrict knowledge of report UUIDs to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94393. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart