CVE-2026-94393: MISP event report access control bypass via UUID

CVE-2026-94393 · Severity: info · Published 2026-09-21

MISP, an open-source threat intelligence platform, contains a flaw that allows event editors to move reports between events without proper authorization checks. An attacker with editing rights on any event could potentially steal or modify confidential reports from other events by guessing or discovering their UUID, bypassing MISP's access controls. The vulnerability affects all versions prior to 2.5.47 and requires the attacker to have editor access to at least one event.

Technologies: Misp. Vendors: Misp.

Quick answers

Is CVE-2026-94393 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-94393 being exploited in the wild.
How severe is CVE-2026-94393?
Informational severity, published 21 September 2026.
Which products and versions are affected?
Misp prior to 2.5.47.
Is there a fix for CVE-2026-94393?
A patch was published on 2026-09-21: Fixed in commit 43665b9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-94393 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-94393?
Check whether you run Misp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

MISP's editReport function resolves event reports globally by UUID without verifying that the report belongs to the event being edited, allowing an event editor to reparent reports across event boundaries. The vulnerability is an authorization bypass in the EventReport model where nested event reports are adopted without checking event ownership. The fix adds validation to reject UUIDs that already belong to a different event.

Affected products

  • MISP MISP prior to 2.5.47

Timeline

  • 2026-09-21: disclosed
  • 2026-09-21: patched: Fixed in commit 43665b9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.