MISP EUVD-2026-84407

Requires an authenticated MISP user account that already holds at least read access to a target event (PR:L); no user interaction or special client is needed beyond viewing the event in the Overmind event view, which automatically enriches the event with its most recent attached report. Exploitation is meaningful only when a report attached to that event has a distribution/ACL more restrictive than the parent event (so the user is not otherwise entitled to it), or when a report has been soft-deleted (administratively removed) - the flawed query filters on event_id only and omits both the report ACL and the deleted=0 condition. Limiting factors: attacker must be a legitimate authenticated, event-authorized user, and there must exist reports whose distribution is stricter than the event's; affects MISP versions before 2.5.47.

This is a genuine but low-severity information-disclosure issue, not a high-priority emergency. All signals align on limited impact: the vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 with confidentiality-only, low-magnitude impact and no integrity or availability effect. Exploitation requires an authenticated user (PR:L) who already has read access to the affected event, so this is an authorization/access-control failure (CWE-862) - an insider or over-scoped account can see reports that the report-level distribution policy should have hidden, plus soft-deleted reports. There is no EPSS score, no CISA KEV listing, and no public POC provided; per input signals this is 'no public exploit identified at time of analysis.' The tag 'Authentication Bypass' is misleading: nothing authenticates as another user - this is a missing report-level ACL check for already-authenticated users, so treat it as broken access control/IDOR. The fix is confirmed available (vendor commit 6932aace8, EUVD affected range MISP 0 <2.5.47). Bottom line: real bug worth patching in trust-sensitive threat-sharing deployments, but low real-world urgency absent exploitation signals.

An authenticated MISP user with only read access to an event opens the Overmind event view, which auto-enriches the event with its most recent attached report for preview. Because the enrichment query looks up the report by event ID alone and ignores the report's own (stricter) distribution setting and its soft-deleted flag, the user is shown threat-intelligence report content that the report's distribution policy explicitly excluded them from - or that an administrator had already removed. No public exploit code is referenced.