CVE-2026-95683: MISP Overmind event view unauthorized report disclosure via insufficient ACL checks

CVE-2026-95683 · Severity: info · Published 2026-09-22

MISP is a threat intelligence sharing platform used by organizations to distribute and collaborate on security information. The Overmind event view feature enriches threat reports with summaries, but failed to enforce the report's own access-control policy when displaying preview data. An authenticated user with read access to an event could view attached reports that were explicitly marked as not accessible to that user, resulting in unauthorized disclosure of threat intelligence content.

Technologies: MISP Project MISP. Vendors: MISP Project.

Quick answers

Is CVE-2026-95683 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-95683 being exploited in the wild.
How severe is CVE-2026-95683?
Informational severity, published 22 September 2026.
Which products and versions are affected?
MISP Project MISP.
Is there a fix for CVE-2026-95683?
A patch was published on 2026-09-22: Fix applied in commit 6932aace8 to apply caller's ACL to report preview and filter deleted reports Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-95683 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-95683?
Check whether you run MISP Project MISP. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in the Overmind event view report enrichment logic (EventsController.php). The report fetch query used only the event ID as a lookup condition, omitting the report's distribution/ACL constraints and failing to filter soft-deleted reports. An authenticated attacker with read access to an event can bypass the report's independent distribution settings to retrieve and view restricted threat intelligence content.

Affected products

  • MISP Project MISP

Timeline

  • 2026-09-22: disclosed: CVE-2026-95683 published
  • 2026-09-22: patched: Fix applied in commit 6932aace8 to apply caller's ACL to report preview and filter deleted reports

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.