CVE-2026-104914: MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View
MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints.
When a user queries for soft-deleted attributes (e.g., via the deleted-attributes search or the paginated attribute listing), the application returned soft-deleted attributes belonging to events owned by other organizations to any authenticated user who had visibility of the event. The event detail view correctly restricted soft-deleted attribute visibility to the owning organization and sync-permission users, but the attribute search and paginated view code paths lacked this restriction.
Preconditions:
- An authenticated MISP user with at least read access to an event owned by another organization.
- The user issues a query for deleted attributes (search or paginated view with the deleted filter).
Impact:
- Confidentiality: Soft-deleted threat intelligence attributes (e.g., IOCs, indicators, context) from other organizations are disclosed to unauthorized users. This may expose sensitive intelligence that the owning organization intended to remove from general visibility.
Affected versions: MISP versions prior to v2.5.48.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in v2.5.48
Event History
Frequently Asked Questions
Who can access the improperly exposed attributes?
An authenticated MISP user must have at least read access to an event owned by another organization. The issue affects users who can see the event but are not authorized to view that other organization's soft-deleted attributes.
What action is required to trigger the exposure?
The user must query for deleted attributes through attribute search or use the paginated attribute view with a deleted-attributes filter. Normal event detail viewing correctly applies the restriction described in the advisory.
Are default event views affected?
The event detail view is not affected by this specific access-control gap; it restricts soft-deleted attributes to the owning organization and users with sync permission. The affected code paths are attribute search and paginated attribute listing when querying deleted attributes.
Which deployments should be treated as affected?
MISP versions prior to v2.5.48 are affected. Exposure requires cross-organization event visibility and the ability for authenticated users to perform deleted-attribute searches or filtered paginated listings.