Is CVE-2026-95685 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-95685 being exploited in the wild.

How severe is CVE-2026-95685?

Informational severity, published 22 September 2026.

Is there a fix for CVE-2026-95685?

A patch was published on 2026-09-22: Fixed in commit 66aebfb1a by changing replaceSuggestionInReport permission mapping from '*' to 'perm_add' Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-95685 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-95685?

Check whether you run MISP Project MISP. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-95685: MISP access control flaw in EventReports replaceSuggestionInReport

CVE-2026-95685 · Severity: info · Published 2026-09-22

MISP is a threat intelligence platform that analysts use to share and collaborate on security events. A flaw in the EventReports functionality allows any authenticated user to modify report content, regardless of their assigned permissions. This could allow users to alter or corrupt shared intelligence data that other analysts and automated systems rely upon for threat detection.

Technologies: MISP Project MISP. Vendors: MISP Project.

Quick answers

Is CVE-2026-95685 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-95685 being exploited in the wild.
How severe is CVE-2026-95685?: Informational severity, published 22 September 2026.
Which products and versions are affected?: MISP Project MISP.
Is there a fix for CVE-2026-95685?: A patch was published on 2026-09-22: Fixed in commit 66aebfb1a by changing replaceSuggestionInReport permission mapping from '*' to 'perm_add' Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-95685 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-95685?: Check whether you run MISP Project MISP. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The replaceSuggestionInReport action in the EventReports component was incorrectly mapped to the wildcard permission ('*') in ACLComponent, granting access to all authenticated users instead of requiring the perm_add permission like analogous modification actions. An authenticated attacker can invoke the replaceSuggestionInReport endpoint to alter suggestion content within event reports, bypassing the intended authorization model.

Affected products

MISP Project MISP

Timeline

2026-09-22: disclosed
2026-09-22: patched: Fixed in commit 66aebfb1a by changing replaceSuggestionInReport permission mapping from '*' to 'perm_add'

References

https://github.com/MISP/MISP/commit/66aebfb1a

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.