Lucene search
+L

CVE-2026-94393 MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport

🗓️ 21 Sep 2026 13:14:00Reported by CIRCLType 
cvelist
 cvelist
🔗 www.cve.org👁 5 Views

When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on one event co...

Related
Affected
Refs
ReporterTitlePublishedViews
Family
cve
CVE
CVE-2026-94393
21 Sep 202613:14
cve
euvd
EUVD
EUVD-2026-83911
21 Sep 202613:14
euvd
nvd
NVD
CVE-2026-94393
21 Sep 202614:17
nvd
[
  {
    "modules": [
      "app/Model/EventReport.php"
    ],
    "product": "MISP",
    "programFiles": [
      "app/Model/EventReport.php"
    ],
    "repo": "https://github.com/MISP/MISP",
    "vendor": "MISP",
    "versions": [
      {
        "lessThan": "2.5.47",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

21 Sep 2026 13:14Current
CVSS 46.4
5