CVE-2026-104914 in MISP
Summary
by MITRE • 10/02/2026
MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints.
When a user queries for soft-deleted attributes (e.g., via the deleted-attributes search or the paginated attribute listing), the application returned soft-deleted attributes belonging to events owned by other organizations to any authenticated user who had visibility of the event. The event detail view correctly restricted soft-deleted attribute visibility to the owning organization and sync-permission users, but the attribute search and paginated view code paths lacked this restriction.
Preconditions:
- An authenticated MISP user with at least read access to an event owned by another organization.
- The user issues a query for deleted attributes (search or paginated view with the deleted filter).
Impact:
- Confidentiality: Soft-deleted threat intelligence attributes (e.g., IOCs, indicators, context) from other organizations are disclosed to unauthorized users. This may expose sensitive intelligence that the owning organization intended to remove from general visibility.
Affected versions: MISP versions prior to v2.5.48.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in Malware Information Sharing Platform (MISP), specifically within attribute search and paginated attribute view endpoints, represents a critical failure in access control logic that allows for the unauthorized disclosure of sensitive threat intelligence data. This flaw stems from an inconsistency in how soft-deleted attributes are handled across different application interfaces. While the event detail view correctly enforces strict visibility rules by restricting access to soft-deleted attributes solely to the owning organization and users with synchronization permissions, the underlying code paths responsible for searching attributes and paginating attribute lists fail to apply these same restrictions. Consequently, any authenticated user who possesses at least read access to an event owned by another organization can bypass intended privacy controls by querying for deleted attributes or navigating through paginated views that include a filter for soft-deleted items. This discrepancy creates a significant security gap where the application's state management and permission checks are not uniformly applied across all entry points, leading to information leakage.
From a technical perspective, this vulnerability is classified as an Improper Access Control issue, aligning with CWE-284 in the Common Weakness Enumeration taxonomy. The root cause lies in the lack of consistent authorization checks when retrieving attribute data that has been marked for deletion but not yet permanently purged from the database. In many security architectures, soft-deleted records are retained for audit trails or recovery purposes and should remain invisible to standard users until they are either restored by an administrator with appropriate privileges or permanently removed. The MISP implementation incorrectly treats these records as accessible if the parent event is visible, ignoring the specific attribute-level permissions that dictate who can view metadata associated with deleted items. This oversight allows attackers or malicious insiders to enumerate and extract indicators of compromise (IOCs), threat contexts, and other intelligence artifacts that organizations have explicitly chosen to hide from general visibility.
The operational impact of this vulnerability is primarily centered on confidentiality breaches within the cybersecurity community. MISP serves as a central hub for sharing actionable threat intelligence among trusted partners, government agencies, and private enterprises. The exposure of soft-deleted attributes can reveal sensitive information such as specific IP addresses, domain names, file hashes, or attack vectors that an organization may have removed due to operational security concerns, legal restrictions, or because the data is no longer relevant but still contains proprietary details about internal defenses or past incidents. Unauthorized access to this intelligence could allow adversaries to refine their evasion techniques, identify gaps in defensive postures, or gather contextual information useful for further targeting campaigns. Furthermore, it undermines trust in the platform by allowing users to see data that was intended to be removed from shared views, potentially violating data sharing agreements and compliance requirements regarding sensitive information handling.
This vulnerability maps directly to MITRE ATT&CK technique T1078, specifically Valid Accounts, as exploitation requires an authenticated user with legitimate access rights to at least one event in the system. It also relates to T1530, Data from Information Repositories, where adversaries harvest data stored in centralized locations for intelligence gathering purposes. The ability to query soft-deleted attributes effectively allows an attacker to perform reconnaissance on historical threat activity that was meant to be obscured. This is particularly dangerous because it exploits the trust model of MISP, where users assume that visibility into an event implies only access to currently active and shared data within their permission scope.
To mitigate this vulnerability, organizations running affected versions of MISP must upgrade immediately to version 2.5.48 or later, which includes patches for these specific endpoint authorization checks. Until the upgrade is performed, administrators should consider restricting user permissions to minimize exposure, ensuring that only essential personnel have read access to events containing sensitive intelligence. Additionally, implementing strict logging and monitoring on attribute search endpoints can help detect anomalous querying patterns indicative of exploitation attempts. It is also advisable to review organizational data sharing policies to ensure that the classification of soft-deleted items aligns with broader security guidelines for handling potentially sensitive threat indicators. Regular audits of access control configurations across all API endpoints are recommended to prevent similar inconsistencies in other parts of the application from emerging as new attack vectors.