CVE-2026-94374

MISP is affected by an Insecure Direct Object Reference (IDOR) in the processModuleResultsData method of the Event model. The report processing loop failed to unset the client-supplied id field before calling save() — unlike the adjacent attribute and object loops. Because the EventReport model's...

PT-2026-96093

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description An insecure direct object reference exists in the processModuleResultsData function of the Event model. When processing module results, the system fails to unset the client-supplied id field for...