CVE-2026-10860

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description A logic error in the CRUD component delete handler allows validation failures to be bypassed when using the HTTP DELETE method. This occurs because missing parentheses in the delete condition cause the expression to be evaluated as ($validationError === null && POST) || DELETE, allowing a DELETE request to proceed even if the delete validation callback rejected the operation. An authenticated attacker with access to an affected delete endpoint can exploit this to delete records that should be protected by application-level validation or authorization checks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.