CVE-2026-112179

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.48

Description A logic error exists in the event synchronization process during the preparation of event reports for remote push. The system applies the filtering of non-exportable tags only once after iterating through all reports instead of applying it to each individual report. This leads to the disclosure of restricted tag information to the receiving instance for all reports except the last one. Additionally, if the last report is withheld, a null report is pushed, which prevents the remote instance from saving the event.

Recommendations Update MISP to version 2.5.48 or later.