Executive brief
MISP is a threat intelligence sharing platform used by organizations to distribute and collaborate on security information. The Overmind event view feature enriches threat reports with summaries, but failed to enforce the report's own access-control policy when displaying preview data. An authenticated user with read access to an event could view attached reports that were explicitly marked as not accessible to that user, resulting in unauthorized disclosure of threat intelligence content.
Technical details
The vulnerability is an authorization bypass in the Overmind event view report enrichment logic (EventsController.php). The report fetch query used only the event ID as a lookup condition, omitting the report's distribution/ACL constraints and failing to filter soft-deleted reports. An authenticated attacker with read access to an event can bypass the report's independent distribution settings to retrieve and view restricted threat intelligence content.
Affected products
- MISP Project MISP
Timeline
- 2026-09-22: disclosed: CVE-2026-95683 published
- 2026-09-22: patched: Fix applied in commit 6932aace8 to apply caller's ACL to report preview and filter deleted reports