MISP CVE-2026-95685

Requires a valid authenticated MISP account that does NOT hold the perm_add permission; the attacker invokes the replaceSuggestionInReport action in the EventReports functionality, which was erroneously mapped to the wildcard permission in ACLComponent. This affects default configurations of MISP versions prior to 2.5.47 (no special feature toggle needed), but exploitation is LIMITED to authenticated users of the instance - there is no unauthenticated path, and impact is bounded to modifying event-report suggestion content (integrity only, no read of restricted data and no availability impact).

This is a genuine but low-severity authorization flaw, not a high-priority emergency. The CVSS 4.0 vector (5.3, AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation but requires an already-authenticated MISP user (PR:L), and impact is confined to integrity (VC:N/VI:L/VA:N) - no confidentiality or availability loss. The source-code diff corroborates the description exactly: ACLComponent mapped 'replaceSuggestionInReport' to the wildcard '*' rather than 'perm_add', so any authenticated account regardless of privilege could invoke it. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so this is 'no public exploit identified at time of analysis'; the realistic threat is an insider or a compromised low-privilege analyst account tampering with shared report content rather than mass automated exploitation. The 'Authentication Bypass' tag overstates the issue - this is post-authentication improper authorization (CWE-862), not an auth bypass. No signals conflict: vendor CVSS, description, and patch diff are mutually consistent.

A low-privilege but authenticated MISP user (or an attacker who has phished/obtained such an account) who lacks the perm_add permission sends a request to the replaceSuggestionInReport endpoint and alters suggestion content inside an event report. The tampered report then propagates misleading or corrupted threat intelligence to other analysts and automated downstream consumers. No public exploit code is identified, but the trigger is a single authenticated HTTP request against a mis-mapped ACL entry.