CVE-2026-104912 MISP CVE debrief

Who should care

Defenders and administrators of MISP instances should assess their exposure and prioritize verification and restriction of access to sensitive events and attributes. This includes reviewing and updating permissions for authenticated users, monitoring for unauthorized access attempts, and implementing additional security measures to protect sensitive information.

Why it matters

The authorization flaw in MISP's correlation handling during attribute searches allows authenticated users to retrieve attributes and event details they no longer have permission to view, potentially exposing sensitive information.

• Exposure of attribute values and event metadata that the user is not authorized to access
• Potential unauthorized access to sensitive events and attributes
• Need for verification and restriction of access to sensitive events and attributes
• Priority for updating MISP to version 2.5.48 or later

Technical summary

The authorization flaw in MISP's correlation handling during attribute searches allows authenticated users to retrieve attributes and event details belonging to events they no longer have permission to view. This issue is caused by the system using a stale distribution snapshot stored on the correlation row rather than the live event access control list. The flaw can lead to exposure of attribute values and event metadata that the user is not authorized to access. Affected versions are MISP prior to v2.5.48. The issue can be mitigated by updating to version 2.5.48 or later.

Defensive priority

Defenders should prioritize verifying and restricting access to sensitive events and attributes, reviewing and updating permissions, and monitoring for unauthorized access attempts.

Recommended defensive actions

• Verify and restrict access to sensitive events and attributes
• Review and update permissions for authenticated users
• Monitor for unauthorized access attempts
• Update MISP to version 2.5.48 or later
• Perform regular security audits
• Implement additional logging and monitoring
• Review and update incident response plans

Evidence notes

The CVE record and NVD entry provide details on the authorization flaw in MISP's correlation handling. The issue is caused by the system using a stale distribution snapshot stored on the correlation row rather than the live event access control list.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.