CVE-2026-95683— MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL
Quick assessment
Affected
MISP MISP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 MISP 中，Overmind 事件视图功能会通过获取与事件关联的最新报告，用于预览和增强事件信息。该增强逻辑仅使用事件 ID 作为查询条件来提取报告，而未对报告自身的分发（distribution）/访问控制列表（ACL）限制进行校验。 由于 MISP 报告拥有独立于父事件的独立分发设置，且其限制可能比父事件的设置更为严格，因此，即使某认证用户仅对该事件具有读取权限，仍可能获取并查看那些明确排除该用户访问权限的报告。此外，查询条件未排除已软删除（soft-deleted）的报告，导致用户可以检索到已被管理员移
Possible ATT&CK Techniques 1 AI
T1562.003
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-95683
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL
Source: CVE Program / CVE List V5
Vulnerability Description
In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event's distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed.
The result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report's own access-control policy.
The vulnerability requires an authenticated MISP user with at least read access to the affected event.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-95683
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-95683
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-95683 (1)
Same Patch Batch · MISP · 2026-09-22 · 19 CVEs total
| CVE-2026-95806 | 7.7 HIGH | MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influe |
| CVE-2026-95658 | 6.9 MEDIUM | MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution o |
| CVE-2026-95754 | 6.9 MEDIUM | MISP: Disabled-user check ineffective in pre-authentication TOTP login branch |
| CVE-2026-95667 | 6.9 MEDIUM | MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials |
| CVE-2026-95679 | 6.9 MEDIUM | MISP Unauthenticated Blind SSRF via XML Body Processing |
| CVE-2026-95693 | 5.3 MEDIUM | MISP Information Disclosure via Forged Upload Path |
| CVE-2026-95805 | 5.3 MEDIUM | MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restric |
| CVE-2026-95698 | 5.3 MEDIUM | MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name |
| CVE-2026-95671 | 5.3 MEDIUM | MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collecti |
| CVE-2026-95685 | 5.3 MEDIUM | MISP Missing Authorization on replaceSuggestionInReport Event Report Action |
| CVE-2026-95674 | 5.3 MEDIUM | MISP EventsController queryEnrichment allows querying unavailable or legacy modules withou |
| CVE-2026-95697 | 5.3 MEDIUM | MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Me |
| CVE-2026-95661 | 5.1 MEDIUM | MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type |
| CVE-2026-95665 | 5.1 MEDIUM | MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON |
| CVE-2026-95703 | 5.1 MEDIUM | MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_na |
| CVE-2026-95701 | 5.1 MEDIUM | MISP Path Traversal via Organization Name in Org-Statistics Logo Check |
| CVE-2026-95659 | 4.8 MEDIUM | MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread |
| CVE-2026-95682 | 4.8 MEDIUM | MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View |
IV. Related Vulnerabilities
Same product: MISP
-
CVE-2026-112192
MISP Module Settings Expose Redacted Values and Allow API Mo -
CVE-2026-112188
MISP Server Settings Lookup Exposes Sensitive Configuration -
CVE-2026-112184
MISP Workflow Module: Reflected XSS via Unescaped misp-modul -
CVE-2026-112183
MISP CSS Injection via Remote Tag Colour in Event Preview -
CVE-2026-112180
MISP Incomplete Event Deletion Leaves Orphaned Sensitive Rec
Same vendor: MISP
-
CVE-2026-125871
MISP sourcecache module SSRF allows fetching arbitrary inter -
CVE-2026-118173
MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxo -
CVE-2026-116469
MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized -
CVE-2026-116372
MISP mispguard: Feed responses with 2xx status codes other t -
CVE-2026-112991
MISP html_to_markdown Module SSRF via Incomplete IP Range Bl
Same weakness: CWE-862
-
CVE-2026-86336
Apache TomEE: EJB method authorization is silently skipped o -
CVE-2026-111239
Apache TomEE: Code execution by any authenticated user via t -
CVE-2026-125750
Firekylin through 2.18.1 Improper Authorization via Admin RE -
CVE-2026-125745
WCK before 2.4.1 Missing Authorization via wck_show_update_f -
CVE-2026-121191
Improper Access Control Vulnerability in TÜBİTAK BİLGEM's et