GCVE-1-2026-20285 (CVE-2026-95683)

Vulnerability from gna-1 – Published: 2026-09-22 14:06 – Updated: 2026-09-22 14:06
VLAI
Title
MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL
Summary
In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event's distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed. The result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report's own access-control policy. The vulnerability requires an authenticated MISP user with at least read access to the affected event.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-862 - Missing Authorization
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
Impacted products
Vendor Product Version CPE status
MISP MISP Affected: 0 , < 2.5.47 (semver)
guessed Create a notification for this product.
Credits
Jeroen Pinoy iglocska Claude Fable 5.1
GCVE extensions
AI involvement GCVE-BCP-05-X-01
Whole record AI-generated Not human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
Patch provenance GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-09-22 13:58
Model
qwen3.8:27b
Input
https://github.com/MISP/MISP/commit/6932aace8.patch d3472acf034e…
Confidence
medium
Commit Subject Patch SHA-256
6932aace8445 fix: [security] Apply the caller's ACL to the event view's d3472acf034e…
Fix summary

The report fetch in the Overmind event enrichment now applies the caller's ACL via EventReport::buildACLConditions($user), enforcing the report's own distribution policy in addition to the event-level access. A condition on EventReport.deleted = 0 is also added to exclude soft-deleted reports. The query is further hardened with recursive = -1 and an explicit contain clause to limit the data retrieved.

Patch summary

In app/Controller/EventsController.php, the __enrichEvent() method's report lookup is changed from a simple event_id condition to a composite condition built from EventReport::buildACLConditions($user) combined with EventReport.event_id and EventReport.deleted = 0. The find() call is updated to use the new $reportConditions array, adds 'contain' => EventReport::DEFAULT_CONTAIN, and sets 'recursive' => -1 to prevent unnecessary eager-loading of associated models.

CVSS rationale

AV:N: MISP is a network-accessible web application. AC:L: An authenticated user with read access to any event simply views it in the Overmind interface; no race conditions, special timing, or complex manipulation are required. AT:N: No attack-target manipulation is needed. PR:L: The attacker must be an authenticated MISP user with at least read permission on the event; no administrative privileges are required. UI:N: No victim interaction beyond the attacker's own viewing action. VC:H: Sensitive threat-intelligence report content (IOCs, analysis, context) is disclosed to a user the report's distribution explicitly excludes. VI:N, VA:N: No integrity or availability impact. SC:N, SI:N, SA:N: The impact is confined to the MISP instance's own data; no cross-system impact is evidenced.

Weakness rationale
  • CWE-862 The report's own ACL/distribution check was entirely absent from the Overmind event-view enrichment path. The code fetched the report by event ID without invoking buildACLConditions(), so the report-level authorization policy was never enforced for this code path.
  • CWE-639 The event ID, which is a user-controllable identifier in the request, was used as the sole key to retrieve a report resource whose access should be independently governed by the report's distribution. This allowed bypass of the report's authorization by leveraging the event-level access.
Attack pattern rationale
  • CAPEC-126 The access control for the EventReport resource was incorrectly configured (or absent) in the Overmind event-view code path: the report's distribution ACL was not applied, effectively leaving the resource accessible to any user who could see the parent event. This is the closest CAPEC to a missing/incomplete authorization check on a specific resource. The mapping is slightly uncertain because the flaw is a missing check rather than a misconfiguration of an existing check, but CAPEC-126 is the best available match for an access-control enforcement gap on a specific object.
Assumptions to verify
  • The tag_version_boundary (v2.5.47, 57 commits after fix) is used as the nearest known version boundary; the exact first fixed release is not explicitly stated in the patch metadata, so the affected range is marked as less_than 2.5.47 with 'unspecified' version.
  • CVSS PR:L assumes the attacker needs only a standard authenticated MISP account with read access to the event; the specific role/permission level required is not detailed in the patch.
  • CVSS VC:H assumes the report content constitutes sensitive threat-intelligence data; the actual sensitivity depends on the report's content and the organization's data classification.
  • CAPEC-126 is selected as the closest match; the flaw is more precisely a missing authorization check (CWE-862) rather than a misconfiguration of an existing control, but no CAPEC entry specifically covers 'missing authorization on a sub-resource' more precisely.
  • The patch does not include test cases or reproduction steps; exploitability assessment is based solely on the code diff and commit message.
  • The 'Overmind' feature is assumed to be a MISP UI component for event viewing; its exact configuration and deployment context are not specified in the patch.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 4 9 medium 6
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "modules": [
            "EventsController (Overmind event view / __enrichEvent)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/EventsController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Fable 5.1"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report\u0027s own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event\u0027s distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed.\u003c/p\u003e\u003cp\u003eThe result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report\u0027s own access-control policy.\u003c/p\u003e\u003cp\u003eThe vulnerability requires an authenticated MISP user with at least read access to the affected event.\u003c/p\u003e"
            }
          ],
          "value": "In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report\u0027s own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event\u0027s distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed.\n\nThe result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report\u0027s own access-control policy.\n\nThe vulnerability requires an authenticated MISP user with at least read access to the affected event."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Exploiting Incorrectly Configured Access Controls"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/6932aace8"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe report fetch in the Overmind event enrichment now applies the caller\u0027s ACL via EventReport::buildACLConditions($user), enforcing the report\u0027s own distribution policy in addition to the event-level access. A condition on EventReport.deleted = 0 is also added to exclude soft-deleted reports. The query is further hardened with recursive = -1 and an explicit contain clause to limit the data retrieved.\u003c/p\u003e"
            }
          ],
          "value": "The report fetch in the Overmind event enrichment now applies the caller\u0027s ACL via EventReport::buildACLConditions($user), enforcing the report\u0027s own distribution policy in addition to the event-level access. A condition on EventReport.deleted = 0 is also added to exclude soft-deleted reports. The query is further hardened with recursive = -1 and an explicit contain clause to limit the data retrieved."
        }
      ],
      "title": "MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "none",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The tag_version_boundary (v2.5.47, 57 commits after fix) is used as the nearest known version boundary; the exact first fixed release is not explicitly stated in the patch metadata, so the affected range is marked as less_than 2.5.47 with \u0027unspecified\u0027 version.",
                  "CVSS PR:L assumes the attacker needs only a standard authenticated MISP account with read access to the event; the specific role/permission level required is not detailed in the patch.",
                  "CVSS VC:H assumes the report content constitutes sensitive threat-intelligence data; the actual sensitivity depends on the report\u0027s content and the organization\u0027s data classification.",
                  "CAPEC-126 is selected as the closest match; the flaw is more precisely a missing authorization check (CWE-862) rather than a misconfiguration of an existing control, but no CAPEC entry specifically covers \u0027missing authorization on a sub-resource\u0027 more precisely.",
                  "The patch does not include test cases or reproduction steps; exploitability assessment is based solely on the code diff and commit message.",
                  "The \u0027Overmind\u0027 feature is assumed to be a MISP UI component for event viewing; its exact configuration and deployment context are not specified in the patch."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The access control for the EventReport resource was incorrectly configured (or absent) in the Overmind event-view code path: the report\u0027s distribution ACL was not applied, effectively leaving the resource accessible to any user who could see the parent event. This is the closest CAPEC to a missing/incomplete authorization check on a specific resource. The mapping is slightly uncertain because the flaw is a missing check rather than a misconfiguration of an existing check, but CAPEC-126 is the best available match for an access-control enforcement gap on a specific object."
                  }
                ],
                "commit": "6932aace844520526819253ea285def97e48189e",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Fable 5.1"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: An authenticated user with read access to any event simply views it in the Overmind interface; no race conditions, special timing, or complex manipulation are required. AT:N: No attack-target manipulation is needed. PR:L: The attacker must be an authenticated MISP user with at least read permission on the event; no administrative privileges are required. UI:N: No victim interaction beyond the attacker\u0027s own viewing action. VC:H: Sensitive threat-intelligence report content (IOCs, analysis, context) is disclosed to a user the report\u0027s distribution explicitly excludes. VI:N, VA:N: No integrity or availability impact. SC:N, SI:N, SA:N: The impact is confined to the MISP instance\u0027s own data; no cross-system impact is evidenced.",
                "fixSummary": "The report fetch in the Overmind event enrichment now applies the caller\u0027s ACL via EventReport::buildACLConditions($user), enforcing the report\u0027s own distribution policy in addition to the event-level access. A condition on EventReport.deleted = 0 is also added to exclude soft-deleted reports. The query is further hardened with recursive = -1 and an explicit contain clause to limit the data retrieved.",
                "generatedAt": "2026-09-22T13:58:09.551694Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 6,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 4
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "d3472acf034e415d9322bc1f5f399efb811afbb547bc230fe69d2e83c2975dd2",
                "patchSummary": "In app/Controller/EventsController.php, the __enrichEvent() method\u0027s report lookup is changed from a simple event_id condition to a composite condition built from EventReport::buildACLConditions($user) combined with EventReport.event_id and EventReport.deleted = 0. The find() call is updated to use the new $reportConditions array, adds \u0027contain\u0027 =\u003e EventReport::DEFAULT_CONTAIN, and sets \u0027recursive\u0027 =\u003e -1 to prevent unnecessary eager-loading of associated models.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "6932aace844520526819253ea285def97e48189e",
                    "patchSha256": "d3472acf034e415d9322bc1f5f399efb811afbb547bc230fe69d2e83c2975dd2",
                    "source": "https://github.com/MISP/MISP/commit/6932aace8.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/6932aace8.patch",
                    "subject": "fix: [security] Apply the caller\u0027s ACL to the event view\u0027s"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/6932aace8.patch",
                "subject": "fix: [security] Apply the caller\u0027s ACL to the event view\u0027s",
                "tagVersionBoundary": {
                  "commits_after_fix": 57,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The report\u0027s own ACL/distribution check was entirely absent from the Overmind event-view enrichment path. The code fetched the report by event ID without invoking buildACLConditions(), so the report-level authorization policy was never enforced for this code path."
                  },
                  {
                    "cweId": "CWE-639",
                    "rationale": "The event ID, which is a user-controllable identifier in the request, was used as the sole key to retrieve a report resource whose access should be independently governed by the report\u0027s distribution. This allowed bypass of the report\u0027s authorization by leveraging the event-level access."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20285"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-95683",
    "datePublished": "2026-09-22T14:06:46.948190Z",
    "dateReserved": "2026-09-22T14:06:57.011Z",
    "dateUpdated": "2026-09-22T14:06:57.790167Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20285"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.