CVE-2026-95683: MISP Information Disclosure Vulnerability

CVE-2026-95683 Overview

CVE-2026-95683 is an authorization flaw in MISP, the open-source Malware Information Sharing Platform. The Overmind event view enriches an event with its most recent attached report for preview purposes. The report lookup used only the event ID as a condition, ignoring the report's own distribution and access-control list (ACL) settings. An authenticated user with read access to a parent event could retrieve a child report whose distribution explicitly excluded that user. The query also failed to filter soft-deleted reports, exposing administratively removed content. The issue is tracked as [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact
Authenticated MISP users can view threat-intelligence report content that the report's distribution policy explicitly forbids, including soft-deleted reports.

Affected Products

MISP (Malware Information Sharing Platform)
Overmind event view component
EventReport model accessed via EventsController

Discovery Timeline

2026-09-22 - CVE-2026-95683 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95683

Vulnerability Analysis

MISP objects carry independent distribution scopes. An event has one distribution setting, and each attached EventReport carries its own — potentially more restrictive — distribution setting. The Overmind preview logic conflated these two scopes. When a user opened an event view, the controller fetched the most recent attached report using the event ID as the sole filter. The report's distribution rules were never evaluated against the requesting user.

The same query lacked a deleted = 0 clause. Reports that administrators had soft-deleted remained visible through the preview path even though they were removed from normal listings. Exploitation requires only authenticated read access to the event, which makes the exposure available to any collaborator who can view the event itself.

Root Cause

The root cause is a missing ACL enforcement step in app/Controller/EventsController.php. The EventReport->find() call omitted the ACL conditions produced by buildACLConditions($user). Distribution filtering and the soft-delete flag were both skipped, breaking the principle that each object must be authorized on its own merits.

Attack Vector

An authenticated user with at least read access to a target event navigates to the Overmind event view. The controller silently serves the most recent attached report — regardless of the report's distribution or deletion state — as part of the event enrichment payload. No special crafting, elevated role, or additional network access is required.

php

            }
        }

-        // Favorite event report (for the moment, only the most recent one)
+        // Favorite event report (for the moment, only the most recent one).
+        // A report carries its own distribution, so seeing the event does not
+        // mean seeing every report on it: apply the report ACL, as the
+        // reports tab does, and skip soft-deleted ones.
+        $reportConditions =
+            $this->Event->EventReport->buildACLConditions($user);
+        $reportConditions['AND'][] = [
+            'EventReport.event_id' => $event['Event']['id'],
+            'EventReport.deleted' => 0,
+        ];
        $result = $this->Event->EventReport->find(
            'first',
            [
-                'conditions' => [
-                    'EventReport.event_id' =>
-                        $event['Event']['id'],
-                ]
+                'conditions' => $reportConditions,
+                'contain' => EventReport::DEFAULT_CONTAIN,
+                'recursive' => -1,
            ]
        );
        $event['EventReport'] = $result['EventReport'] ?? null;

Source: MISP commit 6932aace8. The patch injects buildACLConditions($user) and an explicit EventReport.deleted = 0 predicate so the report ACL is enforced consistently with the reports tab.

Detection Methods for CVE-2026-95683

Indicators of Compromise

Application log entries showing event views that returned EventReport payloads to users whose group or organization is excluded from the report's distribution list.
Audit records showing reads of EventReport rows where deleted = 1 after the report was administratively removed.
Unexpected GET requests to Overmind event view endpoints from user accounts that lack direct access to the report in the reports tab.

Detection Strategies

Compare event view responses against EventReport distribution metadata to identify users receiving reports outside their ACL scope.
Query the MISP database for accesses where the requesting user's organization does not appear in the report's allowed distribution set.
Correlate soft-delete timestamps on EventReport records with subsequent event view accesses to detect post-deletion disclosure.

Monitoring Recommendations

Enable verbose MISP audit logging for EventsController::view and EventReport reads.
Forward MISP application and web server logs to a centralized analytics platform for baseline and anomaly review.
Alert on any read activity against EventReport rows flagged as deleted, which should never occur through the standard UI.

How to Mitigate CVE-2026-95683

Immediate Actions Required

Upgrade MISP to a build that includes commit 6932aace8 or later.
Review recent event view access logs for users whose distribution scope does not match the reports they received.
Rotate or reclassify any threat-intelligence reports whose confidentiality may have been compromised through unauthorized preview access.

Patch Information

The fix is delivered in MISP commit 6932aace8 to app/Controller/EventsController.php. It applies EventReport->buildACLConditions($user) to the Overmind preview query and adds a deleted = 0 filter, matching the ACL semantics already used by the reports tab.

Workarounds

Restrict use of the Overmind event view until the patched commit is deployed.
Reduce read access on events that contain reports with tighter distribution scopes than the parent event.
Purge (hard-delete) sensitive EventReport rows previously soft-deleted so they cannot be surfaced by the vulnerable query path.

bash

# Apply the upstream fix from the MISP repository
cd /var/www/MISP
sudo -u www-data git fetch origin
sudo -u www-data git cherry-pick 6932aace8
sudo -u www-data /var/www/MISP/app/Console/cake Admin runUpdates
sudo systemctl reload apache2