Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-94393

MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport

CVSS 4.0 6.4 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-94393

Published

When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report’s UUID. Once moved, they could view and change information that they were not originally allowed to access. The vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID. The main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP’s normal access restrictions. Version affected: <2.5.47

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-94393

Published

MISP

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "modules": [
                        "app/Model/EventReport.php"
                    ],
                    "product": "MISP",
                    "programFiles": [
                        "app/Model/EventReport.php"
                    ],
                    "repo": "https://github.com/MISP/MISP",
                    "vendor": "MISP",
                    "versions": [
                        {
                            "lessThan": "2.5.47",
                            "status": "affected",
                            "version": "0",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON