CVE-2026-104912: MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data
MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distribution snapshot stored on the correlation row rather than the live event access control list.
Because the correlation row's distribution columns are a point-in-time copy that lacks a published flag, the authorization check becomes incorrect when an event is subsequently restricted (for example, its sharing group is changed or it is unpublished). As a result, an authenticated user could retrieve attributes and event details belonging to events they no longer have permission to view.
Preconditions:
- An authenticated user with at least read access to some events in the instance.
- The existence of correlations between events, at least one of which has been restricted after the correlation was created.
Impact:
- Confidentiality: exposure of attribute values and event metadata that the user is not authorized to access.
Affected versions: MISP prior to v2.5.48.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.48
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated MISP user with at least read access to some events can exploit it. The instance must also contain correlations involving an event that was restricted after the correlation was created.
Does this affect a default MISP deployment?
The issue requires a specific change in access state after correlation creation, such as changing an event's sharing group or unpublishing it. Deployments without such stale correlation records would not meet the stated preconditions.
What information could be exposed?
A user may retrieve attribute values and event metadata from events they are no longer authorized to view. The stated impact is confidentiality-only.
How can administrators identify potentially affected data?
Review events that were restricted, had their sharing group changed, or were unpublished after correlations were created. Attribute searches that trigger correlation lookups may expose data from those events to users who previously had access.
What versions should be remediated?
MISP versions prior to v2.5.48 are affected. Upgrade to v2.5.48 or later.