CVE-2026-94393

When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on one event could potentially move a report from another event...

CVE-2026-94393 MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport

When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on one event could potentially move a report from another event...

CVE-2026-94393

MISP versions below 2.5.47 are affected by a cross-event authorization flaw in the editReport function. When creating or editing a report, MISP resolves an existing report by UUID without verifying that the report belongs to the same event. A user with editor access to at least one event can ther...

CVE-2026-94374

MISP is affected by an Insecure Direct Object Reference (IDOR) in the processModuleResultsData method of the Event model. The report processing loop failed to unset the client-supplied id field before calling save() — unlike the adjacent attribute and object loops. Because the EventReport model's...

Parser-Free Querying of Security Logs

Security analysts routinely query system logs to detect threats and investigate incidents, but each log source uses its own semi-structured format: logs are cheap to produce, but expensive to use. The standard approach, building per-source parsers to normalize logs into structured schemas, is...