CVE-2026-104914

MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted attributes (e.g., via the deleted-attributes search or the paginated attribute listing), the application returned soft-deleted attributes belonging to events owned by other organizations to any authenticated user who had visibility of the event. The event detail view correctly restricted soft-deleted attribute visibility to the owning organization and sync-permission users, but the attribute search and paginated view code paths lacked this restriction. Preconditions: - An authenticated MISP user with at least read access to an event owned by another organization. - The user issues a query for deleted attributes (search or paginated view with the deleted filter). Impact: - Confidentiality: Soft-deleted threat intelligence attributes (e.g., IOCs, indicators, context) from other organizations are disclosed to unauthorized users. This may expose sensitive intelligence that the owning organization intended to remove from general visibility. Affected versions: MISP versions prior to v2.5.48.

CVSS

No CVSS.

References

Link	Resource
https://github.com/MISP/MISP/commit/bd81c23cf
https://github.com/elhoim

Configurations

No configuration.

History

02 Oct 2026, 16:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-02 16:16

Updated : 2026-10-06 19:17

NVD link : CVE-2026-104914

Mitre link : CVE-2026-104914

CVE.ORG link : CVE-2026-104914

JSON object : View

Products Affected

No product.

CWE

CWE-284

Improper Access Control

CWE-862

Missing Authorization

{"id": "CVE-2026-104914", "cveTags": [], "metrics": {"ssvcV203": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "ssvcData": {"role": "Supplier", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-02T16:06:38Z"}}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-104914", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-02T16:22:46.775990Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "affectedData": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "modules": ["app/Model/Event.php", "app/Model/MispAttribute.php"], "product": "MISP", "versions": [{"status": "affected", "version": "0", "lessThan": "2.5.48", "versionType": "semver"}]}]}], "published": "2026-10-02T16:16:49.280", "references": [{"url": "https://github.com/MISP/MISP/commit/bd81c23cf", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}, {"url": "https://github.com/elhoim", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints.\n\nWhen a user queries for soft-deleted attributes (e.g., via the deleted-attributes search or the paginated attribute listing), the application returned soft-deleted attributes belonging to events owned by other organizations to any authenticated user who had visibility of the event. The event detail view correctly restricted soft-deleted attribute visibility to the owning organization and sync-permission users, but the attribute search and paginated view code paths lacked this restriction.\n\nPreconditions:\n\n- An authenticated MISP user with at least read access to an event owned by another organization.\n\n- The user issues a query for deleted attributes (search or paginated view with the deleted filter).\n\nImpact:\n\n- Confidentiality: Soft-deleted threat intelligence attributes (e.g., IOCs, indicators, context) from other organizations are disclosed to unauthorized users. This may expose sensitive intelligence that the owning organization intended to remove from general visibility.\n\nAffected versions: MISP versions prior to v2.5.48."}], "lastModified": "2026-10-06T19:17:40.303", "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}