CVE-2026-94393: MISP Authorization Bypass Vulnerability

CVE-2026-94393 Overview

CVE-2026-94393 is a broken access control vulnerability in MISP (Malware Information Sharing Platform) affecting versions prior to 2.5.47. When a user creates or edits an event report, MISP identifies existing reports by UUID without verifying that the report belongs to the event being edited. An authenticated user with editor access to any event can reparent a report from another event by supplying its UUID. The attacker then gains read and write access to report content across event boundaries, bypassing MISP's access restrictions.

Critical Impact
Authenticated users with editor access on a single event can read and modify private event reports from other events by guessing or discovering their UUIDs [CWE-284].

Affected Products

MISP versions prior to 2.5.47
MISP app/Model/EventReport.php component
Deployments allowing multiple users with event editor privileges

Discovery Timeline

2026-09-21 - CVE-2026-94393 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94393

Vulnerability Analysis

The vulnerability resides in the EventReport model within MISP's event report save workflow. When a report is saved, MISP looks up any existing record by its UUID. Because report UUIDs are globally unique, MISP assumed that a matching record must belong to the current event. The code path then assigned the existing record's database id to the incoming report and updated it, effectively reparenting the report to the attacker's event.

An attacker with editor rights on one event and knowledge of another report's UUID can move that report into their own event context. Once reparented, the report is fully readable and modifiable by the attacker, exposing intelligence data intended for restricted sharing groups.

Root Cause

The root cause is missing tenant boundary validation during a lookup-by-identifier operation. The EventReport::captureReport logic located an existing report by UUID and adopted it without confirming that existingReport['EventReport']['event_id'] matched the eventId under which the caller was operating.

Attack Vector

Exploitation requires network access to a MISP instance, an authenticated account with editor rights on at least one event, and a valid target report UUID. The attacker submits a report create or edit request that reuses the target UUID, triggering the reparenting logic. The fix in commit 43665b9bb rejects any UUID collision that crosses event boundaries.

php

                 return $errors;
             }
         } else {
+            // A report UUID is globally unique to one event, so an existing row
+            // found by UUID must already belong to the event being edited. If it
+            // does not, refuse rather than adopt it: otherwise a nested event
+            // edit (or populate) could reparent - and thereby read and overwrite -
+            // any report by UUID under an event the caller controls. Genuine sync
+            // re-captures a report under the same event, so this only rejects a
+            // true cross-event collision.
+            if ((string)$existingReport['EventReport']['event_id'] !== (string)$eventId) {
+                $errors[] = __('Event Report %s already belongs to a different event.', $report['EventReport']['uuid']);
+                return $errors;
+            }
             $report['EventReport']['id'] = $existingReport['EventReport']['id'];
         }

Source: MISP commit 43665b9bb — the patch refuses to adopt an event report that belongs to another event.

Detection Methods for CVE-2026-94393

Indicators of Compromise

Event reports whose event_id foreign key changed unexpectedly between audit log entries.
Report edit or create requests submitted with UUIDs that were previously associated with a different event.
Access log entries showing report modifications by users who lack membership in the report's original sharing group.

Detection Strategies

Review MISP audit logs for EventReport save operations that reference a UUID not previously seen under the target event.
Correlate report UUID history against event_id values to identify reparenting events prior to patching.
Alert on report edits performed by user accounts that do not belong to the sharing community of the report's originating event.

Monitoring Recommendations

Enable verbose logging on the EventReport model and ship logs to a central store for retention and correlation.
Monitor MISP application logs for the new error string Event Report %s already belongs to a different event, which indicates post-patch exploitation attempts.
Track editor-role account activity for volume anomalies in report create and edit operations.

How to Mitigate CVE-2026-94393

Immediate Actions Required

Upgrade MISP to version 2.5.47 or later, which contains the fix from commit 43665b9bb.
Audit historical EventReport records for entries whose event_id was modified since deployment.
Review editor role assignments and revoke event editing rights from accounts that do not require them.

Patch Information

The upstream fix is available in the MISP repository as commit 43665b9bb and is included in MISP versions 2.5.47 and later. The patch adds an event boundary check in app/Model/EventReport.php that rejects any UUID lookup returning a report whose event_id does not match the event being edited. Reference: MISP commit 43665b9bb.

Workarounds

Restrict event editor privileges to trusted analysts until the upgrade is applied.
Limit report UUID exposure by tightening access on API endpoints that enumerate reports.
Increase monitoring on the EventReport save code path to catch reparenting attempts.

bash

# Verify installed MISP version and upgrade
cat /var/www/MISP/VERSION.json
cd /var/www/MISP && sudo -u www-data git fetch --tags
sudo -u www-data git checkout v2.5.47
sudo -u www-data /var/www/MISP/app/Console/cake Admin runUpdates