Logic Error in MISP CRUD Component Allows Unauthorized Record Deletion

CVE-2026-10860

What is CVE-2026-10860?

A logic error in the delete handler of the MISP CRUD component permits bypassing of validation failures when utilizing the HTTP DELETE method. This flaw arises due to the incorrect evaluation of expressions, which allows an authenticated attacker with access to vulnerable endpoints to perform deletions that should typically be prevented by application-level validations. The issue stems from a misconfiguration of the delete condition, enabling unauthorized access to delete records that are ordinarily protected.

References