CVE-2026-104912 in MISP
Summary
by MITRE • 10/02/2026
MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distribution snapshot stored on the correlation row rather than the live event access control list.
Because the correlation row's distribution columns are a point-in-time copy that lacks a published flag, the authorization check becomes incorrect when an event is subsequently restricted (for example, its sharing group is changed or it is unpublished). As a result, an authenticated user could retrieve attributes and event details belonging to events they no longer have permission to view.
Preconditions:
- An authenticated user with at least read access to some events in the instance.
- The existence of correlations between events, at least one of which has been restricted after the correlation was created.
Impact:
- Confidentiality: exposure of attribute values and event metadata that the user is not authorized to access.
Affected versions: MISP prior to v2.5.48.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in the Management Information Sharing Platform, commonly known as MISP, represents a critical authorization flaw within its correlation handling mechanism during attribute searches. This security issue stems from an inconsistency between how access control is enforced for live events and how it is applied to correlated data retrieved through search operations. When a user initiates an attribute search that triggers internal correlation lookups, the system relies on distribution metadata stored directly on the correlation row rather than querying the current state of the associated event's access controls. This architectural decision creates a divergence between the static snapshot of permissions captured at the time the correlation was established and the dynamic reality of those permissions as they evolve over time within the platform.
The core technical flaw lies in the fact that the distribution columns on the correlation row serve only as a point-in-time copy of the event's sharing status when the link was first created. Crucially, this stored metadata lacks a published flag or any mechanism to reflect subsequent changes made by administrators or event owners. Consequently, if an event is later restricted—for instance, by changing its sharing group to limit visibility or by unpublishing it entirely—the correlation row retains the original, more permissive distribution settings. The authorization check performed during search operations fails to validate these updates against the live Event Access Control List, thereby allowing the system to return data based on outdated permission states rather than current access rights.
This discrepancy results in a significant impact on confidentiality for organizations relying on MISP for sensitive threat intelligence sharing. An authenticated user who possesses at least read access to some events within the instance can exploit this flaw to retrieve attributes and event details belonging to other events they no longer have authorization to view. This exposure includes potentially sensitive attribute values, metadata, and contextual information that were intended to be restricted or hidden from specific user groups. The vulnerability effectively bypasses the granular sharing controls designed to protect high-sensitivity intelligence, leading to unauthorized data disclosure across different trust levels within the MISP instance.
From a classification perspective, this issue aligns with CWE-269, which denotes Improper Privilege Management, specifically regarding the failure to enforce proper authorization checks against current system state rather than cached or stale permissions. It also relates to CWE-862, Missing Authorization, as the application fails to ensure that users are authorized for specific actions based on their assigned privileges at the time of execution. In terms of adversary behavior and detection, this vulnerability facilitates unauthorized data access consistent with techniques found in the MITRE ATT&CK framework under Data from Information Repositories or potentially T1078 Valid Accounts if leveraged by an insider threat actor to escalate information exposure beyond intended boundaries.
To mitigate this risk, organizations running affected versions of MISP prior to v2.5.48 must upgrade immediately to version 2.5.48 or later where the authorization logic has been corrected to reference live access control lists during correlation lookups. Until an upgrade is feasible, administrators should review existing correlations and manually verify that no sensitive events have been restricted after their initial publication while maintaining active links with other datasets. Additionally, implementing strict monitoring of user search queries for patterns indicative of bulk data extraction can help detect potential exploitation attempts in real-time. Regular audits of sharing group configurations and correlation integrity are recommended to ensure ongoing alignment between stored metadata and actual access policies across the platform.