CVE-2026-95683 MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL
Authenticated users can view restricted threat intelligence reports via the Overmind event view, bypassing report-level access controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-95683?
CVE-2026-95683 is a medium-severity missing authorization vulnerability in MISP, published on 22 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event's distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed.
The result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report's own access-control policy.
The vulnerability requires an authenticated MISP user with at least read access to the affected event.
Which versions are affected by CVE-2026-95683?
How do I fix CVE-2026-95683?
No fix has been published for CVE-2026-95683 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-95683 being exploited?
There is no known exploitation of CVE-2026-95683 in the wild and no public exploit code.
Sources
Also known as GHSA-83cf-9w8x-h48q.