CVE-2026-103659 in MISP
Summary
by MITRE • 10/01/2026
MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distribution and sharing-group access control check was not re-applied to those attributes.
As a result, a user who can view a community-distributed event could retrieve attributes belonging to organisation-only objects (distribution level 0) or objects restricted to a specific sharing group, even though the user's organisation does not have access to those objects. This constitutes an unauthorized disclosure of sensitive threat intelligence data.
A secondary issue was introduced by the initial remediation: the fix reused the full Object contain conditions (including soft-delete state) as the gate for flattened attributes, causing an event owner requesting deleted attributes to lose all attributes whose parent object was still live. The final fix isolates the distribution ACL condition as the sole gate.
Preconditions:
- An authenticated user with access to a community-distributed event
- The event contains at least one object with a distribution level or sharing group that restricts access beyond the event's own distribution
Impact:
- Unauthorized disclosure of attributes belonging to restricted objects
- Potential exposure of organisation-specific threat intelligence to other organisations
Affected versions: <2.5.48
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in MISP represents a critical authorization bypass within the event flattening functionality, which fundamentally undermines the platform's access control mechanisms for distributed threat intelligence data. In normal operation, MISP utilizes objects to group related attributes and applies granular distribution policies at both the event level and the individual object level. This architecture allows organizations to share broad indicators publicly while keeping specific, sensitive details restricted to their own internal networks or trusted sharing groups. The flaw occurs when a user requests an event with the flatten option enabled, a feature designed to simplify data presentation by removing hierarchical containment structures. During this process, the application incorrectly strips away object-level distribution and sharing group access control checks, treating all attributes as if they belonged directly to the top-level event rather than their respective restricted objects. This architectural oversight means that the security boundary defined at the object level is effectively dissolved during flattening operations.
The operational impact of this vulnerability is severe, leading to an unauthorized disclosure of sensitive threat intelligence data. Specifically, any authenticated user with read access to a community-distributed event can retrieve attributes belonging to organization-only objects or those restricted to specific sharing groups. Since these objects typically have a distribution level of zero or are limited to particular trust domains, their contents should remain invisible to external parties. However, due to the bypassed authorization checks, users from other organizations can access this confidential information. This constitutes a significant breach of data confidentiality and violates the principle of least privilege, potentially exposing proprietary threat indicators, internal network details, or sensitive operational security measures that were intentionally kept private by their originating organizations.
The remediation history for this issue highlights additional complexities in maintaining robust access control logic during feature updates. An initial fix attempt introduced a secondary vulnerability where the system incorrectly reused full object containment conditions, including soft-delete states, as the gatekeeper for flattened attributes. This flawed implementation caused event owners to lose visibility of valid attributes if their parent objects were marked for deletion but not yet purged from the database. The final resolution isolates the distribution access control list condition as the sole gating mechanism, ensuring that only legitimate authorization checks determine attribute visibility while preserving data integrity for active records. This correction ensures that flattening operations respect both current access permissions and proper data lifecycle management without introducing new logical errors or denial of service conditions for administrators.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Management, as the application fails to enforce required security levels for specific actions involving sensitive resources. It also relates closely to CWE-862, Missing Authorization, because the system allows users to access data they are not explicitly permitted to view based on their organizational affiliation and assigned roles. In terms of offensive cyber operations mapping under MITRE ATT&CK, this flaw facilitates Data from Information Repositories (T1530) by allowing adversaries or unauthorized insiders to exfiltrate structured threat intelligence that was intended for restricted consumption. The ability to bypass object-level restrictions effectively turns a collaborative sharing platform into an unsecured data dump for those with basic event access rights.
Mitigation strategies must prioritize immediate patching of the MISP instance to version 2.5.48 or later, where the final fix correctly isolates distribution ACL conditions from other containment logic. Organizations should also audit their existing events for objects that contain highly sensitive information and consider whether flattening features are necessary in their specific workflows. If flattening is required, administrators must ensure that all users with access to community-distributed events understand the risks associated with this feature until patches are applied. Regular security audits of sharing group configurations and distribution levels can help identify potential exposure points before they are exploited. Additionally, implementing strict monitoring for unusual data retrieval patterns involving flattened event exports may provide early detection indicators if similar vulnerabilities exist in other parts of the platform or future versions.