MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL

published 2026-09-22 47 d ago modified 2026-09-22 47 d ago also EUVD-2026-84407

cvss: 5.3; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 33%
public exploits: 0; none known

In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event's distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed.

The result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report's own access-control policy.

The vulnerability requires an authenticated MISP user with at least read access to the affected event.

Patch / fix

fixed in 1 links 1

MISP MISP 2.5.47

github.com/MISP/MISP@6932aac commit

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 47 d ago (2026-09-22)

Exploit prediction

0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

MISP MISP

Classification

Weakness

CWE-862 Missing Authorization
CWE-639 Authorization Bypass Through User-Controlled Key

References

github.com /MISP/MISP/commit/6932aace8
patch

Sources

CVE List CVE-2026-95683
NVD CVE-2026-95683

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary