CVE-2026-107175: MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes
MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified.
When a user edits an existing event and changes its distribution or sharinggroupid, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted.
Security impact:
- Stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure.
- Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing.
Preconditions:
- An authenticated user with write access to at least one MISP event.
- The user modifies the event's distribution or sharinggroupid field.
Affected versions: <2.5.48
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.48
Event History
Frequently Asked Questions
Which deployments are exposed to unintended disclosure?
MISP deployments running versions earlier than 2.5.48 are affected. Exposure can occur when an authorized user changes an existing event to a more restrictive distribution level or sharing group, because stale correlations may remain visible to users in the previously broader group.
What access does an attacker need to trigger the issue?
The attacker must be authenticated and have write access to at least one MISP event. They must modify that event's distribution or sharing_group_id field; no user interaction is required.
How can administrators determine whether stale correlations may exist?
Review events whose distribution level or sharing_group_id was changed while the instance was running a version earlier than 2.5.48. Those changes may not have triggered correlation recalculation, leaving correlations based on the prior sharing settings.
What is the immediate mitigation if upgrading is not possible?
Avoid changing distribution levels or sharing_group_id values on existing events until the affected MISP version is remediated. If such changes are necessary, treat the associated correlations as potentially stale and review their visibility and completeness.