Vulnerability Description
In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event's distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed. The result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report's own access-control policy. The vulnerability requires an authenticated MISP user with at least read access to the affected event.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-95683?
CVE-2026-95683 is a documented vulnerability. In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, w...
How severe is CVE-2026-95683?
CVSS scoring is not yet available for CVE-2026-95683. Check NVD for updates.
Is there a patch for CVE-2026-95683?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.