Authorization Bypass in MISP Event Metadata Retrieval

CVE-2026-104910

What is CVE-2026-104910?

MISP is susceptible to an authorization bypass vulnerability that affects its event listing functionality. When an authenticated user queries related events, MISP improperly retrieves event metadata directly from a correlation table without validating the user's access rights for each event. This oversight permits the unauthorized retrieval of metadata for events that the user should not access, including unpublished events or events whose sharing group has changed. Consequently, users may gain insight into sensitive event details, potentially facilitating reconnaissance of important threat intelligence. Users are advised to update to the fixed version to mitigate this risk.

References