EUVD-2026-83904
GHSA-qg5m-5m7w-mf5x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated user with module-processing rights (PR:L), network API, low complexity; strong integrity impact from overwrite/reparent (I:H), limited disclosure (C:L), no availability effect.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
Lifecycle Timeline
3DescriptionCVE.org
MISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module results, the code iterates over EventReport entries supplied in the resolved data and saves each one. Unlike the adjacent attribute and object processing loops, the report loop did not unset the client-supplied 'id' field before calling save(). Because the MISP EventReport model's create() method does not strip the id field, an authenticated user with permission to submit module results could include an 'id' value referencing an existing report belonging to a different event. Upon save(), the ORM would update that existing row rather than insert a new one, allowing the attacker to
- read the content of another event's report by reparenting it into their own event
- overwrite the report's fields with attacker-controlled data
- change the report's event_id to redirect ownership.
This constitutes an authorization bypass through a user-controlled key, enabling cross-event data disclosure and integrity compromise. The vulnerability requires an authenticated session with the ability to invoke module result processing on an event.
Version affected: <2.5.47
Articles & Coverage 1
AnalysisAI
Cross-event EventReport disclosure and tampering in MISP versions before 2.5.47 lets an authenticated user who can submit module (enrichment) results reparent, read, or overwrite another event's report by supplying a forged 'id' field in the resolved module data. The root cause is an authorization bypass through a user-controlled key (CWE-639): the report loop in Event::processModuleResultsData did not unset the client-supplied 'id' before calling save(), so the CakePHP ORM updated an existing report row belonging to a different event instead of inserting a new one. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated MISP session whose user holds permission to invoke module (enrichment) result processing on an event - i.e., the module-import code path in processModuleResultsData must be reachable to the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, well-substantiated authorization flaw (CWE-639 IDOR) rather than an inflated high-CVSS artifact, though its severity is moderate and gated by authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix by upgrading MISP to 2.5.47 or later, or by cherry-picking upstream commit 4c1a03b20 (https://github.com/MISP/MISP/commit/4c1a03b20), which simply unsets the client-supplied 'id' in the EventReport loop of Event::processModuleResultsData so that save() always inserts a new report row; note that the supplied patch reference is a commit, so the released patched version is inferred from the stated affected range (<2.5.47) and should be confirmed against the vendor's release notes before relying on a package version alone. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which MISP instances are running a version below 2.5.47 and treat this as a priority upgrade, since the fix version is known (MISP 2.5.47, upstream commit 4c1a03b20); inventory and, if operationally feasible, temporarily restrict or monitor the module-result submission (enrichment) privilege to trusted accounts, and review EventReport modification history for unexpected reparenting or overwrites. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today