CVE-2026-10863: MISP User-controlled order parameter in correlations over-correlation endpoint
A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value was processed by the underlying data access layer, this could allow manipulation of database query ordering and potentially expose the application to unsafe query construction.
The patch removes order from the set of request-controlled parameters and instead sets the ordering server-side to occurrence desc after processing allowed user parameters.
Affected component: app/Controller/CorrelationsController.php, overCorrelations()
Security impact: An authenticated attacker could influence the ordering clause used by the over-correlations query. The direct impact appears limited to query manipulation unless further evidence confirms SQL injection or unauthorized data exposure through the manipulated ordering expression.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update overCorrelations() so that the 'order' query parameter is not accepted from user-controlled named request parameters. After processing only allowed user parameters, set the ordering server-side to 'occurrence desc'.
MISP (app/Controller/CorrelationsController.php - CorrelationsController->overCorrelations()) order request parameter handling for correlations over-correlation endpoint = Ignore/remove 'order' from user-controlled/named request parameters; set ordering server-side to 'occurrence desc' after processing allowed user parameters
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10863?
The severity of CVE-2026-10863 is classified as medium with a score of 6.4 on the CVSS scale.
How do I fix CVE-2026-10863?
To fix CVE-2026-10863, ensure that your version of MISP is updated to the latest release that addresses this vulnerability.
What impact does CVE-2026-10863 have on user data?
CVE-2026-10863 allows authenticated users to manipulate the order of over-correlating values, potentially compromising data integrity.
Is CVE-2026-10863 related to SQL Injection vulnerabilities?
Yes, CVE-2026-10863 is related to input validation issues that can lead to SQL Injection vulnerabilities.
What is the risk associated with CVE-2026-10863?
The risk associated with CVE-2026-10863 is considered medium, which suggests that it could be exploited under certain conditions but requires specific access.