PT-2026-107578
CVE-2026-107278
·
Published
2026-10-07
·
Updated
2026-10-07
Description by
CVSS 4.0
5.3
MediumMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
MISP versions prior to 2.5.48
Description
A validation flaw exists in the object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance, but the receiving instance's validation rule rejects it during replication because the description field is empty. This causes the receiving instance to silently drop the object and its associated attributes, resulting in the loss of threat-intelligence data and data-integrity loss across the sync topology. This can be triggered by any authorized user with object-creation privileges.
Recommendations
Update to version 2.5.48 or later.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾