CVE-2026-95685: MISP Auth Bypass Vulnerability

CVE-2026-95685 Overview

CVE-2026-95685 is an improper authorization weakness [CWE-862] in the MISP threat intelligence platform. The flaw resides in the EventReports functionality, specifically the replaceSuggestionInReport action. This action was incorrectly mapped to the wildcard permission (*) in the ACLComponent, exposing it to any authenticated user. Analogous report-modification actions correctly required the perm_add permission. Any authenticated user without perm_add could invoke the endpoint to alter report suggestion content. This violates the intended authorization model and could corrupt shared threat intelligence data relied upon by analysts and automated consumers.

Critical Impact
Authenticated users lacking the perm_add permission can modify event report suggestions, enabling injection of misleading intelligence into shared MISP reports.

Affected Products

MISP (Malware Information Sharing Platform) EventReports component
Versions prior to the commit 66aebfb1a fix
Deployments using the ACLComponent authorization mapping

Discovery Timeline

2026-09-22 - CVE-2026-95685 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95685

Vulnerability Analysis

MISP uses the ACLComponent (located in app/Controller/Component/ACLComponent.php) to map controller actions to required permissions. Report-modifying actions such as extractAllFromReport, extractFromReport, importReportFromUrl, and configureTemplateVariable all correctly require the perm_add permission. Read-only actions such as downloadAsPDF and getProxyMISPElements use the wildcard (*) permission.

The replaceSuggestionInReport action was erroneously mapped to the wildcard. This bypassed the intended write-permission gate. As a result, an authenticated MISP user with only read-level roles could invoke the endpoint and overwrite suggestion content inside event reports. Because MISP reports are frequently ingested by downstream analysts and automated consumers, tampered suggestions can propagate misleading indicators throughout a sharing community.

Root Cause

The root cause is a missing authorization check produced by an incorrect ACL entry. The action label was mapped to array('*') instead of array('perm_add'), which trusted authentication as sufficient rather than enforcing the report-modification permission.

Attack Vector

Exploitation requires network access to a MISP instance and any authenticated account. The attacker sends a request to the replaceSuggestionInReport controller endpoint with crafted suggestion content. No elevated privileges, user interaction, or additional prerequisites are required.

php

            'getProxyMISPElements' => array('*'),
            'extractAllFromReport' => array('perm_add'),
            'extractFromReport' => array('perm_add'),
-           'replaceSuggestionInReport' => array('*'),
+           'replaceSuggestionInReport' => array('perm_add'),
            'importReportFromUrl' => array('perm_add'),
            'configureTemplateVariable' => ['perm_add'],
            'downloadAsPDF' => ['*'],

Source: MISP commit 66aebfb1a. The patch tightens the ACL entry for replaceSuggestionInReport from the wildcard to perm_add, aligning it with other report-modifying actions.

Detection Methods for CVE-2026-95685

Indicators of Compromise

Unexpected modifications to event report suggestion content authored by users without the perm_add permission.
HTTP requests to EventReports controller paths invoking replaceSuggestionInReport from low-privilege accounts.
Audit log entries showing report suggestion updates by accounts whose role lacks report-write permissions.

Detection Strategies

Review MISP application audit logs for EventReports/replaceSuggestionInReport invocations and correlate the acting user's role with perm_add assignment.
Compare report suggestion revision history against expected editor identities within each MISP sharing community.
Enable web server access logging and alert on non-analyst accounts issuing POST requests to the EventReports suggestion endpoint.

Monitoring Recommendations

Ingest MISP audit and web server logs into a centralized log platform and build alerts for report-modification actions by unauthorized roles.
Baseline the normal set of users who modify event reports and flag deviations for review.
Monitor for outbound propagation of tampered reports through MISP synchronization to downstream instances.

How to Mitigate CVE-2026-95685

Immediate Actions Required

Update MISP to a release containing commit 66aebfb1a or later, which enforces perm_add on replaceSuggestionInReport.
Audit user roles and revoke perm_add from accounts that do not require report authorship.
Review recent event reports for unauthorized suggestion changes and restore known-good content where necessary.

Patch Information

The fix is published as MISP commit 66aebfb1a, titled "fix: [ACL] tightening of eventreports replaceSuggestionIntReport." The patch changes the ACL mapping for replaceSuggestionInReport from array('*') to array('perm_add') in app/Controller/Component/ACLComponent.php. Apply the upstream release or backport this single-line ACL change.

Workarounds

Restrict network access to the MISP web interface using authenticated reverse proxy rules that block the replaceSuggestionInReport route for non-authorized roles.
Temporarily disable the EventReports suggestion workflow for untrusted user groups until the patch is applied.
Increase audit log retention and review cadence for report modifications during the interim window.

bash

# Apply the upstream patch on a MISP deployment
cd /var/www/MISP
sudo -u www-data git fetch origin
sudo -u www-data git cherry-pick 66aebfb1a
sudo systemctl restart apache2