{"schema":"threatline.record/2","record":{"id":"CVE-2026-104912","aliases":[],"summary":"MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data","details":"MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distribution snapshot stored on the correlation row rather than the live event access control list.\n\nBecause the correlation row's distribution columns are a point-in-time copy that lacks a published flag, the authorization check becomes incorrect when an event is subsequently restricted (for example, its sharing group is changed or it is unpublished). As a result, an authenticated user could retrieve attributes and event details belonging to events they no longer have permission to view.\n\nPreconditions:\n\n- An authenticated user with at least read access to some events in the instance.\n\n- The existence of correlations between events, at least one of which has been restricted after the correlation was created.\n\nImpact:\n\n- Confidentiality: exposure of attribute values and event metadata that the user is not authorized to access.\n\nAffected versions: MISP prior to v2.5.48.","categories":["Unclassified"],"product":"MISP","vendor":"MISP","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104912","source_modified_at":"2026-10-03T15:52:55.841Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"MISP","vendor":"MISP","versions":[{"lessThan":"2.5.48","status":"affected","version":"0","versionType":"semver"}],"defaultStatus":null}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104912","source_modified_at":"2026-10-03T15:52:55.841Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"MISP","ecosystem":null},"version":"2.5.48","basis":"first unaffected version stated in the CVE record"}],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00207,"percentile":0.10264,"score_date":"2026-10-23"},"published_at":"2026-10-02T16:04:50.580Z","modified_at":"2026-10-03T15:52:55.841Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-104912","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-03T15:52:55.841Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104912","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/MISP/MISP/commit/100235bd9","tags":["patch"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-03T15:48:11.201423Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-03T15:52:55.841Z","content_hash":"cc75f279b63c716c678d1c721efae13a132812eb06aa7dc1a88b413dc7edae45"}}