CVE-2026-94393

Executive Summary

CVE-2026-94393 is an improper access control vulnerability (CWE-284) in MISP (Malware Information Sharing Platform), an open-source threat intelligence sharing platform. In versions prior to 2.5.47, when a user creates or edits a report inside an event, MISP identifies an existing report by its UUID without verifying that the report belongs to the same event. This allows an authenticated user with editor rights on one event to move a report from a different event into their own event if they know or can guess the target report's UUID, granting them unauthorized view and modification access to reports they were not originally permitted to access. The primary impact is cross-boundary exposure and modification of private event reports, bypassing MISP's normal access restrictions.

Technical Analysis

The vulnerability resides in MISP's event report handling logic. MISP organizes intelligence data into "events," each of which can contain one or more "reports" (analyst-authored documents). Reports are uniquely identified by a UUID. When a user creates or edits a report within an event, the application accepts a report UUID and associates that report with the event being edited.

The flaw is that this association step trusts the supplied UUID without performing an ownership or parent-event validation check. Specifically, the application does not confirm that the report identified by the UUID is already bound to the same event the user is currently editing. Because access control decisions in MISP are enforced at the event level (a user's edit rights apply to specific events), this missing validation creates a confused-deputy condition: the user's editing context (their own event) is used to authorize an operation that actually affects a report belonging to a different event.

The attack surface is the report create/edit function reachable by any authenticated user holding editor rights on at least one event. No elevated privileges are required beyond this baseline editor role. The attack prerequisite is knowledge of a valid report UUID, which may be obtained through information disclosure, shared intelligence metadata, UUID enumeration in collaborative environments, or other channels.

There is insufficient technical detail in the NVD description to specify the exact function, parameter, or database table involved. The class of defect is a missing authorization check — a horizontal access control failure (cross-event) rather than a vertical one. The correct remediation pattern is to bind report lookups to the parent event identifier and reject any UUID that does not resolve to a report already owned by the event being edited.

Notably, this CVE is marked UNPATCHED with a patch confidence of 0/4; no vendor advisory, patch commit, or versioned fix has been confirmed by any tracked source at the time of writing. The stated affected range is versions below 2.5.47, but no patch is documented as released.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-94393. The attack chain below is inferred strictly from the vulnerability class (improper access control / missing ownership validation) and the details provided in the NVD description. No specific function names, endpoints, or parameters are asserted because they are not present in the source data.

1. Reconnaissance / target identification: The attacker authenticates to MISP with a low-privilege account that holds editor rights on at least one event. The attacker identifies a target report of interest — likely a report in a private or restricted event belonging to another organization or team — and obtains or guesses its UUID. Because MISP's data model and shared collaborative workflows expose metadata in various contexts, a valid UUID may be discoverable through normal platform visibility, prior intelligence exchanges, synchronization feeds, or enumeration rather than exploitation of a separate bug.

2. Triggering the flaw: The attacker opens their own event (one they are authorized to edit) and initiates a create-or-edit action on a report, or within the report context. When supplying the report identifier, the attacker provides the UUID of the foreign report instead of their own. Because the application identifies the existing report by UUID without confirming it belongs to the event currently being edited, the ownership check is effectively skipped.

3. Payload / execution at the vulnerability-class level: The "payload" is the crafted request containing the victim report's UUID in the edit/create flow. The missing authorization check causes the server to accept the foreign UUID and rebind the report to the attacker's event. No code execution, injection, or memory corruption is involved; the entire exploit is an abuse of a broken access control decision.

4. Post-exploitation impact: Once the report has been moved into the attacker's event, the attacker gains view and modification rights over the report's contents, consistent with their editor role on the receiving event. The attacker can read the private report's intelligence content and alter it, corrupting shared threat intelligence and potentially exposing sensitive indicators or attribution data across event boundaries. The original owner loses control over a report they no longer own.

As no proof-of-concept exists, defenders should treat the above as the theoretical attack path for this vulnerability class rather than a validated exploit chain.

Impact Assessment

The vulnerability is a horizontal access control bypass affecting the confidentiality and integrity of MISP event reports. An attacker requires only baseline editor access to a single event (PR:L) and no user interaction from the victim (UI:N), attackable over the network (AV:N) with low complexity (AC:L). There is no availability impact (A:N).

Confidentiality impact is high: private event reports that should be restricted can be read after being pulled into the attacker's event. Integrity impact is high: the same mechanism allows the attacker to modify reports they were never authorized to change. Because reports often contain sensitive threat intelligence — attribution, IOCs, campaign details, victim information — exposure can have downstream operational and privacy consequences beyond MISP itself, including leaking intelligence shared under trust agreements between organizations.

The blast radius is bounded by the attacker's ability to know or guess valid report UUIDs and by the scope of the collaborative instance. On multi-tenant or national/ISAC deployments where many organizations share one MISP instance, cross-event report movement can undermine the platform's core trust model. Financial impact is indirect (loss of intelligence integrity, trust erosion, potential incident response disruption). No CVSS base score was provided by NVD; the vector shown here is an analyst-derived estimate for the described impact profile and should be treated as provisional.

Detection Guidance

Detection for this vulnerability is challenging because the exploit uses legitimate, authenticated functionality with valid credentials. Detection should focus on anomalous report reassignment behavior — reports changing parent events, especially across owners or organizations — and on UUID access patterns that cross event boundaries.

Sigma Rule

title: MISP Cross-Event Report Reassignment Attempt
id: 8f2c9b41-7d3a-4e21-9c55-a1b2c3d4e5f6
status: experimental
description: Detects requests that appear to reassign a MISP report to a different event, consistent with CVE-2026-94393 access control bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94393
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: misp
detection:
  selection_method:
    http.method:
      - 'POST'
      - 'PUT'
  selection_path:
    cs-uri-stem|contains:
      - '/events/edit/'
      - '/reports/'
      - '/eventReports/'
  selection_keyword:
    cs-uri-query|contains:
      - 'uuid='
      - 'report_uuid'
  condition: selection_method and selection_path and selection_keyword
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate report reassignment by administrators
  - Normal report editing within the same event
level: medium
tags:
  - attack.t1078
  - cve.2026.94393

YARA Rule

rule CVE_2026_94393_MISP_Report_UUID_Reassign
{
    meta:
        description = "Detects report reassignment patterns referencing report UUIDs in MISP request/response artifacts, indicative of CVE-2026-94393 access control bypass"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94393"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $misp = "MISP" ascii wide nocase
        $report1 = "eventReport" ascii wide nocase
        $report2 = "EventReport" ascii wide nocase
        $uuid = /\breport_uuid\b/ ascii wide nocase
        $uuid2 = /uuid=[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/ ascii wide

    condition:
        $misp and ($report1 or $report2) and ($uuid or $uuid2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94393 MISP Cross-Event Report Reassignment Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/reports/"; http.uri; content:"uuid="; http.header; content:"MISP"; reference:cve,2026-94393; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94393; classtype:attempted-user; sid:202694393; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ http.request where http.request.method in ("POST","PUT") and
    url.path like "*/events/edit/*" ]
  [ http.request where http.request.method in ("POST","PUT") and
    url.query contains "uuid=" and
    url.path like "*/reports/*" ]

Splunk SPL Query

index=web sourcetype=misp_access
| search (method=POST OR method=PUT)
| search (uri_path="*/events/edit/*" OR uri_path="*/reports/*" OR uri_path="*/eventReports/*")
| search uri_query="*uuid=*"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths values(uri_query) as queries by src_ip user
| where count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="misp,web,access_control,">
  <rule id="100393" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>/reports/|/events/edit/|/eventReports/</url>
    <match>uuid=</match>
    <description>CVE-2026-94393: Possible MISP cross-event report reassignment attempt (UUID reference on report edit).</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>cve_2026_94393,</group>
  </rule>

  <rule id="100394" level="12">
    <if_sid>100393</if_sid>
    <match>POST|PUT</match>
    <description>CVE-2026-94393: MISP report edit/create with report UUID - verify event ownership.</description>
    <group>cve_2026_94393,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or upgraded version has been confirmed as addressing CVE-2026-94393 at the time of writing.

1. Immediate mitigations:

• Restrict editor-level accounts to the minimum necessary set. Because the vulnerability requires only editor rights on a single event, reducing the number of low-privilege editor accounts directly reduces exploitable attack surface.
• Review and, where feasible, tighten event and report sharing/distribution settings so that report UUIDs in private events are not broadly discoverable.
• Monitor MISP logs for unexpected report reassignments and for report edits where the acting user or event owner differs from the report's original owner.
• Where deployments support it, apply outbound/inbound filtering or application-layer monitoring to flag report UUID references crossing event boundaries.

2. Patch/upgrade steps:

• Track the MISP project's official release channels and security advisories for a fix in version 2.5.47 or later. No advisory has been published per available data; do not assume a patch exists.
• When a fixed release is available, upgrade MISP promptly, verify the report-to-event ownership check is enforced, and re-test the create/edit report workflow to confirm the bypass is closed.
• Until a patch is confirmed, treat any MISP instance below 2.5.47 as affected.

3. Long-term hardening:

• Enforce event-scoped authorization on all report operations: bind report lookups to the parent event ID and reject any UUID that does not resolve to a report already owned by that event.
• Adopt consistent object-level authorization checks (OWASP API Security Top 10 — Broken Object Level Authorization and Broken Function Level Authorization) across MISP's API and UI.
• Implement audit logging for report reassignment and integrate with SIEM to detect cross-event movement.
• Apply the principle of least privilege to all MISP roles and periodically review user-to-event access mappings.

References

• NVD — CVE-2026-94393: https://nvd.nist.gov/vuln/detail/CVE-2026-94393
• MISP Project (official site and release notes): https://www.misp-project.org/
• MISP GitHub repository (security advisories and changelog): https://github.com/MISP/MISP
• CWE-284: Improper Access Control — https://cwe.mitre.org/data/definitions/284.html
• MITRE ATT&CK T1078: Valid Accounts — https://attack.mitre.org/techniques/T1078/

Note: CISA KEV status is NO — no known exploitation in the wild as of the available data. No threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE in the provided intelligence. No public proof-of-concept exists; EPSS has not yet been scored by FIRST.org for this CVE.