CVE-2026-104910 in MISP
Summary
by MITRE • 10/02/2026
MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved related event metadata directly from the correlation table without re-validating the caller's access rights against each related event.
The correlation table stores a snapshot of the event's distribution level and sharing group at the time the correlation was created, and does not carry the published flag. As a result, events that the caller is not permitted to open—because they are unpublished, or because their distribution or sharing group has changed since the correlation was recorded—were still returned with their metadata (title, date, correlating value counts).
Preconditions:
- An authenticated user with access to at least one event in MISP.
- The existence of correlation entries linking that event to other events the user should not be able to view.
Impact:
- Unauthorized disclosure of event metadata (titles, dates, correlation counts) for events the user has no right to access.
- Potential reconnaissance of threat-intelligence event names and timelines across sharing groups.
Affected: MISP versions prior to the fix commit (2ffa97f05).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in the Management Information Sharing Platform, commonly known as MISP, represents a critical authorization bypass within its core correlation engine. This flaw specifically affects the functionality responsible for listing events that are related or correlated to a primary event viewed by an authenticated user. In secure information sharing environments like MISP, access control is paramount because threat intelligence data often contains sensitive indicators of compromise and contextual details about ongoing cyber campaigns. The system relies on complex distribution levels and sharing groups to ensure that only authorized stakeholders can view specific pieces of intelligence. However, the implementation of the related events listing feature failed to enforce these granular permissions during the retrieval process, creating a significant gap in access control logic that allows users to see metadata for events they are explicitly denied permission to open.
The technical root cause lies in how MISP handles correlation data storage and retrieval. When correlations between events are established, the system creates entries in a dedicated correlation table. This table stores a snapshot of certain event attributes, such as distribution levels and sharing group identifiers, at the precise moment the correlation was created. Crucially, this stored metadata does not include the published flag nor is it dynamically updated when an event's access controls change after the initial correlation. When a user requests the list of related events for a specific target event, the application queries this static correlation table to populate the results. The system retrieves titles, dates, and correlating value counts directly from these stored records without performing a secondary validation step against the current state of each linked event's access permissions. This design decision prioritizes performance over security, assuming that the initial snapshot remains valid for authorization purposes throughout the lifecycle of the correlation.
This architectural oversight leads to unauthorized disclosure of sensitive threat intelligence metadata. An authenticated user who has legitimate access to one event can exploit this flaw by requesting its related events list. The system will return details about other events linked via correlations, even if those target events are unpublished or have been moved to a more restrictive sharing group since the correlation was first recorded. For instance, an analyst working on a public threat report might inadvertently see titles and dates of highly classified internal incidents that were previously correlated with their visible data. This constitutes an information disclosure vulnerability where sensitive operational details leak into unauthorized contexts. The impact extends beyond simple metadata exposure; it facilitates reconnaissance activities for malicious actors or insider threats who can map out the structure, timeline, and naming conventions of threat intelligence campaigns across different security domains without proper authorization.
From a classification perspective, this issue aligns with CWE-284 Improper Access Control, specifically reflecting failures in enforcing user privileges during resource access. The vulnerability also maps to MITRE ATT&CK technique T1078 Valid Accounts, as it allows an authenticated user to leverage their existing credentials to access resources outside their designated scope through a logic flaw rather than credential compromise. Furthermore, the disclosure of event titles and dates contributes to reconnaissance capabilities described in techniques such as T1592 Gather Victim Host Information or general intelligence gathering within threat hunting frameworks. The lack of re-validation against current distribution levels means that the principle of least privilege is violated, allowing lateral movement across security boundaries defined by sharing groups.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. For affected versions prior to commit 2ffa97f05, administrators should apply the official patch provided by the MISP project which corrects this authorization logic. The fix involves modifying the query execution path for related events to ensure that every retrieved event is checked against the caller's current permissions in real-time. This includes verifying not only the distribution level and sharing group but also ensuring the event is published before returning its metadata. Beyond patching, organizations should review their correlation policies to minimize unnecessary cross-domain correlations where high-sensitivity data might be linked with lower-security contexts. Regular audits of access control logs can help detect any exploitation attempts or unusual patterns in related events queries that may indicate active reconnaissance by malicious insiders or compromised accounts.