Data Integrity Flaw in MISP Event Deletion Logic by MISP Team

CVE-2026-112180

What is CVE-2026-112180?

MISP has a data integrity flaw in its event deletion logic, where certain associated records remain in the database after an event has been deleted. This issue can result in orphaned entries, which may include sensitive threat intelligence data related to event reports, graphs, correlations, and scan results. Consequently, the persistence of these records beyond their intended lifecycle poses a risk of unintended data retention and potential information exposure. If accessible through application queries or administrative interfaces, these records could expose sensitive details to unauthorized users, especially if sufficient privileges are not properly enforced. Over time, the accumulation of these orphaned records can also lead to storage inefficiencies.

References