PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10863 misp CVE debrief

A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value was processed by the underlying data access layer, this could allow manipulation of database query ordering and potentially expose the application to unsafe query construction. The patch removes order from the set of request-controlled parameters and instead sets the ordering server-side to occurrence desc after processing allowed user parameters. Affected component: app/Controller/CorrelationsController.php, overCorrelations(). Security impact: An authenticated attacker could influence the ordering clause used by the over-correlations query.

Vendor
misp
Product
Unknown
CVSS
MEDIUM 6.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-04
Original CVE updated
2026-07-22
Advisory published
2026-06-04
Advisory updated
2026-07-22

Who should care

Users of MISP

Technical summary

The correlations over-correlation endpoint accepted an order query parameter from user-controlled named request parameters. This allowed an authenticated user to override server-defined ordering of over-correlating values, potentially allowing manipulation of database query ordering.

Defensive priority

MEDIUM

Recommended defensive actions

  • Apply the patch: see resourceLinkAnnotations with linkId ref-4

Evidence notes

The CVE record and NVD detail can be found at resourceLinkAnnotations with linkIds cve-org and nvd respectively.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10863 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10863

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10863 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10863

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://github.com/MISP/MISP/commit/aa094a335ba2855f8a42a1dc44398f43560fe247

    5a6e4751-2f3f-4070-9419-94fb35b644e8 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.