Authorization Flaw in MISP Affecting Attribute Searches
CVE-2026-104912

7.1HIGH

Key Information:

Vendor

Misp

Status
Misp
Vendor
CVE Published:
2 October 2026

What is CVE-2026-104912?

MISP contains a significant authorization flaw that compromises the integrity of attribute searches. When users perform attribute searches triggering correlation lookups, the system erroneously grants access to correlated attributes and events based on outdated distribution snapshots. This misalignment arises because the correlation row's distribution columns capture data at a specific point in time, lacking a mechanism to reflect changes in event access controls. Consequently, if access rights to an event are modified post-correlation—such as changing its sharing group or unpublished status—authenticated users could access sensitive data they are no longer permitted to see. This flaw necessitates immediate attention to safeguard against unauthorized data exposure.

Affected Version(s)

MISP 0 < 2.5.48

References

https://github.com/MISP/MISP/commit/100235bd9
patch

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

iglocska
Claude Opus 5.5 (1M context)
elhoim
.