# CVE-2026-95685: MISP access control flaw in EventReports replaceSuggestionInReport

Source: https://junglewise.ai/threats/cve-2026-95685-misp-contains-an-access-control-flaw-in-the-eventreports  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-95685 · Severity: info · Published 2026-09-22

MISP is a threat intelligence platform that analysts use to share and collaborate on security events. A flaw in the EventReports functionality allows any authenticated user to modify report content, regardless of their assigned permissions. This could allow users to alter or corrupt shared intelligence data that other analysts and automated systems rely upon for threat detection.

Technologies: [MISP Project MISP](https://junglewise.ai/threats/technologies/misp-project-misp). Vendors: [MISP Project](https://junglewise.ai/threats/vendors/misp-project).

## Quick answers

**Is CVE-2026-95685 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-95685 being exploited in the wild.

**How severe is CVE-2026-95685?** Informational severity, published 22 September 2026.

**Which products and versions are affected?** MISP Project MISP.

**Is there a fix for CVE-2026-95685?** A patch was published on 2026-09-22: Fixed in commit 66aebfb1a by changing replaceSuggestionInReport permission mapping from '*' to 'perm_add' Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-95685 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-95685?** Check whether you run MISP Project MISP. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The replaceSuggestionInReport action in the EventReports component was incorrectly mapped to the wildcard permission ('*') in ACLComponent, granting access to all authenticated users instead of requiring the perm_add permission like analogous modification actions. An authenticated attacker can invoke the replaceSuggestionInReport endpoint to alter suggestion content within event reports, bypassing the intended authorization model.

## Affected products

- MISP Project MISP

## Timeline

- 2026-09-22: disclosed
- 2026-09-22: patched: Fixed in commit 66aebfb1a by changing replaceSuggestionInReport permission mapping from '*' to 'perm_add'

## References

- [https://github.com/MISP/MISP/commit/66aebfb1a](https://github.com/MISP/MISP/commit/66aebfb1a)

## Related threats

- [MISP module plugin settings flags not preserved](https://junglewise.ai/threats/cve-2026-112192-misp-contains-a-vulnerability-in-the-handling-of-module-plugin)
- [MISP server settings information disclosure](https://junglewise.ai/threats/cve-2026-112188-misp-contains-a-vulnerability-in-its-server-settings-lookup)
- [MISP reflected XSS in workflow module interface](https://junglewise.ai/threats/cve-2026-112184-misp-contains-a-reflected-cross-site-scripting-xss-vulnerability)
- [MISP data integrity flaw in event deletion logic](https://junglewise.ai/threats/cve-2026-112180-misp-contains-a-data-integrity-flaw-in-its-event-deletion-logic)
- [MISP event synchronization information disclosure via tag filtering](https://junglewise.ai/threats/cve-2026-112179-in-misp-the-event-synchronization-process-contained-a-logic)