CVE-2026-94374: MISP Auth Bypass Vulnerability

CVE-2026-94374 Overview

CVE-2026-94374 is an insecure direct object reference (IDOR) vulnerability in Malware Information Sharing Platform (MISP) versions prior to 2.5.47. The flaw resides in the processModuleResultsData method of the Event model. When MISP processes module results, the EventReport loop fails to strip the client-supplied id field before invoking save(). An authenticated user with permission to submit module results can supply an id referencing an EventReport belonging to another event. The Object-Relational Mapper (ORM) then updates the referenced row instead of creating a new one, enabling cross-event report disclosure, modification, and reparenting.

Critical Impact
An authenticated attacker can read, overwrite, or reassign event reports across tenant boundaries, breaking authorization and compromising the integrity of shared threat intelligence data.

Affected Products

MISP versions prior to 2.5.47
Deployments exposing module result processing to authenticated users
Any MISP instance where multiple users or organizations share the platform

Discovery Timeline

2026-09-21 - CVE-2026-94374 published to the National Vulnerability Database (NVD)
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94374

Vulnerability Analysis

The vulnerability is classified under [CWE-472] (External Control of Assumed-Immutable Web Parameter). MISP's processModuleResultsData iterates over EventReport entries in the resolved data structure and persists each entry through the CakePHP ORM. Unlike the adjacent loops that handle attributes and objects, the report loop does not remove the id field from user-controlled input before calling save().

Because EventReport::create() does not strip the id field either, the ORM interprets a supplied id as an update to an existing record. An authenticated user invoking module result processing can therefore target any existing report row in the database. The attacker can read another event's report contents by reparenting it, overwrite report fields with attacker-controlled data, or change the report's event_id to redirect ownership.

Root Cause

The root cause is missing input sanitization on a trust-sensitive primary key field. The MISP maintainers addressed this by explicitly unsetting $report['id'] before assigning event_id and calling save(), matching the defensive pattern already used in the attribute and object processing loops.

Attack Vector

Exploitation requires an authenticated session with permission to submit module results on an event. The attacker crafts a resolved-data payload containing an EventReport object whose id matches a target report in a different event. On save, the ORM performs an UPDATE instead of an INSERT, granting the attacker control over that record.

php

            $total_reports = count($resolved_data['EventReport']);
            foreach ($resolved_data['EventReport'] as $i => $report) {
                $this->EventReport->create();
+               // Module-result import only creates reports; strip any client id so a
+               // supplied existing report id cannot redirect save() onto another event's
+               // report row and reparent/overwrite it (no fieldList here, create() does
+               // not strip it) - matching the attribute and object loops above.
+               unset($report['id']);
                $report['event_id'] = $id;
                if ($this->EventReport->save($report)) {
                    $saved_reports++;

Source: MISP Commit 4c1a03b20 — the patch strips the client-supplied id before assigning the correct event_id and invoking save().

Detection Methods for CVE-2026-94374

Indicators of Compromise

Unexpected changes to EventReport rows including modified event_id, name, or content fields with no corresponding legitimate user activity.
Reports appearing under events owned by an organization that did not author them.
Module result submissions containing an EventReport payload with a populated id field.
Audit log entries showing report saves originating from accounts that never previously created reports on the target event.

Detection Strategies

Inspect application audit logs for EventReport update events attributable to processModuleResultsData calls.
Correlate module result submissions with subsequent EventReport row modifications where the acting user is not the event owner.
Add server-side logging that records the raw id field submitted in module result payloads for retrospective analysis.

Monitoring Recommendations

Enable MISP audit logging and forward events to a centralized SIEM for continuous review.
Alert on any EventReport record whose event_id changes after creation.
Monitor for authenticated users invoking module result endpoints against events they do not own.

How to Mitigate CVE-2026-94374

Immediate Actions Required

Upgrade MISP to version 2.5.47 or later, which contains the fix from commit 4c1a03b20.
Audit existing EventReport records for unexpected event_id reassignments or content changes since deployment.
Review and restrict the set of users authorized to submit module results, applying least privilege.

Patch Information

The fix is available in MISP 2.5.47. See the MISP Commit 4c1a03b20 for the exact code change, which adds unset($report['id']) inside the EventReport processing loop of app/Model/Event.php.

Workarounds

Temporarily disable modules that produce EventReport output until the patch is applied.
Limit module result processing permissions to a small set of trusted accounts.
Deploy a Web Application Firewall (WAF) rule to strip or reject requests containing an EventReport.id field in module result payloads.

bash

# Upgrade to the patched MISP release
cd /var/www/MISP
sudo -u www-data git fetch --tags
sudo -u www-data git checkout v2.5.47
sudo -u www-data /var/www/MISP/app/Console/cake Admin runUpdates