Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-95685— MISP Missing Authorization on replaceSuggestionInReport Event Report Action

Quick assessment

Affected
MISP MISP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MISP 的事件报告（EventReports）功能中存在一个访问控制缺陷。其中，“replaceSuggestionInReport”操作允许修改事件报告中的建议内容，但该操作在 ACLComponent 中被错误地映射到了通配符权限（'*'），导致任何经过身份验证的用户，无论其分配的具体权限如何，均可访问该功能。相比之下，所有其他类似报告修改操作均正确要求具备 权限，而仅读操作（如下载为 PDF）则恰当使用了通配符权限。 未持有 权限的经过身份验证的用户仍可调用 端点，从而修改报告中的建议数据，这违反了预期的授

CVSS 5.3 · Medium EPSS 0.35% · P29

Possible ATT&CK Techniques 1 AI

T1098 · Account Manipulation

Affected Version Matrix 1

VendorProduct Version RangeStatus
MISP MISP < 2.5.47 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-95685

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MISP Missing Authorization on replaceSuggestionInReport Event Report Action
Source: CVE Program / CVE List V5
Vulnerability Description
MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of suggestion content within an event report, was incorrectly mapped to the wildcard permission ('*') in the ACLComponent, making it accessible to any authenticated user regardless of their assigned permissions. All analogous report-modification actions correctly required the perm_add permission, while read-only actions such as downloadAsPDF appropriately used the wildcard.  An authenticated user without the perm_add permission could invoke the replaceSuggestionInReport endpoint to alter report suggestion data, violating the intended authorization model.  This constitutes an improper authorization weakness that could lead to unauthorized modification of event report content, potentially corrupting shared threat intelligence data or injecting misleading information into reports relied upon by other analysts and automated consumers.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MISP MISP 0 ~ 2.5.47 -

II. Public POCs for CVE-2026-95685

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-95685

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-95685 (1)

Same Patch Batch · MISP · 2026-09-22 · 19 CVEs total

CVE-2026-95806 7.7 HIGH MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influe
CVE-2026-95754 6.9 MEDIUM MISP: Disabled-user check ineffective in pre-authentication TOTP login branch
CVE-2026-95658 6.9 MEDIUM MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution o
CVE-2026-95667 6.9 MEDIUM MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials
CVE-2026-95679 6.9 MEDIUM MISP Unauthenticated Blind SSRF via XML Body Processing
CVE-2026-95693 5.3 MEDIUM MISP Information Disclosure via Forged Upload Path
CVE-2026-95805 5.3 MEDIUM MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restric
CVE-2026-95698 5.3 MEDIUM MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name
CVE-2026-95671 5.3 MEDIUM MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collecti
CVE-2026-95697 5.3 MEDIUM MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Me
CVE-2026-95674 5.3 MEDIUM MISP EventsController queryEnrichment allows querying unavailable or legacy modules withou
CVE-2026-95683 5.3 MEDIUM MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL
CVE-2026-95661 5.1 MEDIUM MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type
CVE-2026-95665 5.1 MEDIUM MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON
CVE-2026-95703 5.1 MEDIUM MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_na
CVE-2026-95701 5.1 MEDIUM MISP Path Traversal via Organization Name in Org-Statistics Logo Check
CVE-2026-95659 4.8 MEDIUM MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread
CVE-2026-95682 4.8 MEDIUM MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View

IV. Related Vulnerabilities

Same product: MISP
Same vendor: MISP
Same weakness: CWE-862