---
id: CVE-2026-94393
title: >-
  When a user creates or edits a report inside an event, MISP can identify an
  existing report using its UUID without properly checking whether that report
  actually belongs to the same event.


  As a result, a user who has editing rights on o…
summary: >-
  When a user creates or edits a report inside an event, MISP can identify an
  existing report using its UUID without properly checking whether that report
  actually belongs to the same event.


  As a result, a user who has editing rights on o…
severity: medium
cvss: 6.4
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N'
cwe:
  - CWE-284
  - CWE-639
vendor: MISP
product: MISP
affected:
  - MISP < 2.5.47
published: '2026-09-21'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T16:17:30.677'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94393'
references:
  - url: 'https://github.com/MISP/MISP/commit/43665b9bb'
    label: 5a6e4751-2f3f-4070-9419-94fb35b644e8
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T15:18:01.147790Z'
cvssSource: cna
ingestedAt: '2026-09-21T13:37:22.840Z'
epss: 0.00372
epssPercentile: 0.28439
---

## Overview

When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event.

As a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report’s UUID. Once moved, they could view and change information that they were not originally allowed to access.

The vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID.

The main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP’s normal access restrictions.

Version affected: <2.5.47

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.