PT-2026-104399

CVE-2026-104912

Published

2026-10-02

Updated

2026-10-02

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.48

Description An authorization flaw exists in the correlation handling during attribute searches. The system grants access to correlated attributes and events using a stale distribution snapshot stored on the correlation row instead of the live event access control list. Since the distribution columns in the correlation row are point-in-time copies lacking a published flag, authorization checks fail when an event is restricted, such as when it is unpublished or its sharing group is modified. This allows an authenticated user with read access to some events to retrieve attributes and event metadata from events they are no longer authorized to view.

Recommendations Update to version 2.5.48 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Elhoim

Iglocska

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization