CVE-2026-107175

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.48

Description A defect in the event save workflow prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified. This occurs because the internal before-save hook stores new data instead of previously persisted values, causing the after-save comparison to fail in detecting changes. Consequently, stale correlations persist, which may lead to unintended information disclosure if an event is moved to a more restrictive group, or a lack of relevant correlations if distribution is widened. This issue requires an authenticated user with write access to modify the distribution or sharing group id fields.

Recommendations Update to version 2.5.48 or later.