CVE-2026-103235: MISP Event Delegation Auth Bypass Flaw

CVE-2026-103235 Overview

CVE-2026-103235 is a mass assignment vulnerability in the Malware Information Sharing Platform (MISP) event delegation feature. The application authorizes a delegation request against the event identified in the URL but then persists the entire submitted record, including caller-controlled fields such as the primary key and event_id. An authenticated user with the perm_delegate permission can inject these fields into the delegation payload to retarget an existing delegation record to any event on the instance. Because a delegation row grants the requesting organisation read access to the referenced event, exploitation yields read access to arbitrary events across other organisations. If the target organisation accepts the delegation, event ownership is transferred and the original record is deleted. The flaw is classified under [CWE-639] and affects MISP versions prior to 2.5.48.

Critical Impact
An authenticated attacker with delegation permission can read any event on the MISP instance and transfer ownership of arbitrary events between organisations.

Affected Products

MISP versions prior to 2.5.48
Instances with the MISP.delegation server setting enabled
Deployments granting users the perm_delegate permission

Discovery Timeline

2026-09-30 - CVE-2026-103235 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-103235

Vulnerability Analysis

The vulnerability resides in app/Controller/EventDelegationsController.php. When a user submits a delegation request, the controller performs authorization checks against the event identified in the URL. After authorization succeeds, the controller passes the entire request payload to the model save routine. This pattern is a classic mass assignment flaw: fields the client should not control, such as the record primary key and event_id, are trusted as-is by the ORM.

CakePHP's save() method interprets a supplied id field as an update to an existing record rather than the creation of a new one. An attacker who injects an id value overwrites another organisation's delegation row. Injecting an event_id field retargets the delegation to an arbitrary event. Because delegation rows grant the requesting organisation read access to the referenced event via Event::fetchEvent, the attacker can read events belonging to any organisation on the instance.

Root Cause

The controller failed to enforce an allow-list of writable fields before persisting the delegation record. Authorization was scoped to the URL-identified event, but persistence was scoped to the entire submitted payload. This mismatch between the authorization boundary and the data boundary is the core defect described in [CWE-639] (Authorization Bypass Through User-Controlled Key).

Attack Vector

An authenticated user with perm_delegate submits a crafted delegation request against an event they legitimately access. The request body includes additional keys such as EventDelegation[id] or EventDelegation[event_id] pointing at a target record or event owned by another organisation. On save, MISP updates the referenced delegation row or creates a delegation pointing at the target event, granting the attacker's organisation read access. If the victim organisation accepts the delegation, ownership of the event transfers to the attacker's organisation.

php

            if (empty($this->request->data['EventDelegation'])) {
                $this->request->data = array('EventDelegation' => $this->request->data);
            }
-            if (empty($this->request->data['EventDelegation']['distribution'])) {
-                $this->request->data['EventDelegation']['distribution'] = 0;
-            }
-            if ($this->request->data['EventDelegation']['distribution'] != 4) {
-                $this->request->data['EventDelegation']['sharing_group_id'] = '0';
-            }
-            $this->request->data['EventDelegation']['event_id'] = $event['Event']['id'];
-            $this->request->data['EventDelegation']['requester_org_id'] = $this->Auth->user('org_id');
-            $org_id = $this->Toolbox->findIdByUuid($this->EventDelegation->Event->Org, $this->request->data['EventDelegation']['org_id']);
-            $this->request->data['EventDelegation']['org_id'] = $org_id;
-            // Never allow an id to be supplied here: a primary key in the save data turns
-            // create() + save() into an update of an arbitrary existing delegation. The auth
-            // checks above only cover the event in the URL, so an injected id would let a user
-            // overwrite a delegation request belonging to another event/org.
-            unset($this->request->data['EventDelegation']['id']);
+            $submitted = $this->request->data['EventDelegation'];
+            $distribution = empty($submitted['distribution']) ? 0 : $submitted['distribution'];
+            $org_id = $this->Toolbox->findIdByUuid(
+                $this->EventDelegation->Event->Org,
+                isset($submitted['org_id']) ? $submitted['org_id'] : null
+            );
+            // Build the row from an allow-list instead of saving what was submitted.
+            $delegation = array(

Source: MISP commit d1f5684f9. The patch replaces the unsafe pattern with an explicit allow-list that constructs the delegation row from vetted fields only.

Detection Methods for CVE-2026-103235

Indicators of Compromise

Delegation POST requests to /eventDelegations/delegateEvent/* whose body includes an EventDelegation[id] or EventDelegation[event_id] field.
Delegation rows in the event_delegations table where event_id does not match any event historically accessible to the requesting organisation.
Event ownership transfers between organisations that were not initiated through the normal delegation UI workflow.

Detection Strategies

Inspect web server and application logs for delegation submissions containing unexpected primary key or foreign key fields.
Compare requester_org_id in delegation records against the audit history of who accessed the referenced event prior to delegation.
Alert on delegation record updates where the event_id column changes after initial creation.

Monitoring Recommendations

Enable MISP audit logging and forward events to a centralized log platform for retention and correlation.
Track counts of delegation acceptances per organisation over time and investigate anomalous spikes.
Review accounts that hold perm_delegate on a recurring basis and remove the permission where it is not required.

How to Mitigate CVE-2026-103235

Immediate Actions Required

Upgrade MISP to version 2.5.48 or later, which contains the allow-list fix from commit d1f5684f9.
Audit the event_delegations table for suspicious rows created before patching and revert any unauthorized ownership transfers.
Review which users hold the perm_delegate permission and revoke it from accounts that do not require delegation capabilities.

Patch Information

The upstream fix is available in the MISP commit d1f5684f9, included in MISP 2.5.48. The patch rebuilds the delegation record from an explicit allow-list of fields rather than persisting the caller-submitted payload, closing the mass assignment path.

Workarounds

Disable the MISP.delegation server setting until the upgrade to 2.5.48 can be completed.
Temporarily revoke the perm_delegate permission from all user roles on the instance.
Restrict network access to the MISP web interface to trusted operators while patching is scheduled.

bash

# Disable the delegation feature via the MISP CLI until upgrade completes
sudo -u www-data /var/www/MISP/app/Console/cake Admin setSetting "MISP.delegation" false

# Verify the setting after the change
sudo -u www-data /var/www/MISP/app/Console/cake Admin getSetting "MISP.delegation"