MISP CVE-2026-94393

Exploitation requires an authenticated MISP account holding editor (write) rights on at least one event (PR:L) and knowledge or a valid guess of the target report's UUID - a high-entropy identifier that limits blind or automated abuse. The flaw is reached through the normal report create/edit (and populate/pull) code path in EventReport::editReport() on MISP instances before 2.5.47 where reports from other events exist and are shared or restricted. Limiting factors: the attacker cannot enumerate UUIDs and must obtain them out-of-band; impact is confined to event report objects rather than the full MISP dataset; and instances with only a single event or a single trusted user have negligible exposure. There is no user-interaction requirement on the victim (UI:N).

This is a genuine but bounded authorization flaw (CWE-639 IDOR), not a high-CVSS-low-risk artifact nor a top-tier emergency. The vendor CVSS 4.0 score of 6.4 (AV:N/AC:L/AT:N/PR:L/UI:N with vulnerable-system impacts VC:N/VI:N/VA:N but subsequent-system SC:H/SI:H) reflects a deliberate modeling choice: the attacker's own event is the 'vulnerable system' (no impact) and the victim's event is a 'subsequent system' that suffers high confidentiality and integrity loss - i.e., MISP treats the cross-event boundary as a scope change. That is defensible but unusual; a more conventional CVSS 3.1 reading places the impact directly on confidentiality/integrity of report data. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation-likelihood signals are absent; there is no public exploit identified at time of analysis. The realistic risk is driven by two gating factors baked into the vector: PR:L (the attacker must already hold editor rights on at least one event) and knowledge/guessing of a valid report UUID. UUIDs are high-entropy and not enumerable, so blind cross-event theft is impractical - the plausible attacker is an existing authenticated MISP user who has learned a target report's UUID (e.g., via sharing, logs, or a prior compromise). Net: a medium-severity insider/collaborator authorization-boundary bypass, worth patching to 2.5.47 in multi-tenant or broadly-shared MISP instances, but not an unauthenticated internet-facing crisis.

An authenticated MISP user with editor rights on their own event learns or discovers the UUID of a private report belonging to another (restricted) event. They create or edit a report in their own event and supply that UUID; because editReport() locates the existing report by UUID without confirming it belongs to the current event, the foreign report is reparented into the attacker's event, where they can now view and overwrite its previously restricted contents. No public exploit code was provided in the intelligence, and exploitation requires prior editor access plus a valid target UUID.