CVE-2026-104914

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.48

Description Improper access control exists in the attribute search and paginated attribute view endpoints. When an authenticated user with read access to an event owned by another organization queries for soft-deleted attributes, the application discloses those attributes. While the event detail view correctly restricts visibility of soft-deleted attributes to the owning organization and users with sync permissions, the search and paginated view code paths lack this restriction. This can lead to the unauthorized disclosure of sensitive threat intelligence attributes, such as indicators of compromise (IOCs) and context, which the owning organization intended to remove from general visibility.

Recommendations Update to version 2.5.48 or later.