CVE-2026-104908: MISP Auth Bypass Vulnerability

CVE-2026-104908 Overview

CVE-2026-104908 is an improper input validation vulnerability in Malware Information Sharing Platform (MISP) affecting the decaying model import functionality. The import endpoint was designed to create a new decaying model owned by the importing user's organisation, with the default flag forced off. The application stripped only the top-level id and uuid fields and pinned org_id and default on the outer array before saving data flat. An authenticated user with perm_decaying permission could supply a nested DecayingModel key carrying its own primary key, organisation identifier, and default flag, bypassing those guards. This authorization flaw is tracked under CWE-285.

Critical Impact
An authenticated user with decaying-model permissions can overwrite decaying models owned by other organisations, reassign model ownership, and modify the organisation default flag affecting scoring behaviour for other users.

Affected Products

MISP versions prior to 2.5.48
MISP DecayingModelController import endpoint
Any MISP instance exposing decaying-model permissions to multiple organisations

Discovery Timeline

2026-10-02 - CVE-2026-104908 published to NVD
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-104908

Vulnerability Analysis

The vulnerability resides in the MISP decaying model import handler. The endpoint accepted a JSON payload and attempted to sanitize it by unsetting the top-level id and uuid keys, then force-setting org_id to the caller's organisation and default to 0. The data was then persisted flat through the CakePHP save() call.

Because the save path accepts nested model arrays, an attacker could submit a payload containing a nested DecayingModel object. That inner object retained its own id, org_id, and default values, which the controller never scrubbed. CakePHP's ORM honored the nested keys during the save, overriding the outer guards.

The practical consequence is an authorization bypass. A user with the perm_decaying role can overwrite arbitrary decaying models in place, altering their name, formula, parameters, or ownership. The attacker can also flip the default flag, changing scoring behaviour for every user in the targeted organisation.

Root Cause

The root cause is incomplete input filtering. The controller enforced a denylist on the outer array only, rather than an allow-list applied to the structure actually consumed by the ORM. Nested model keys bypassed the guard entirely.

Attack Vector

Exploitation requires network access to the MISP instance and an authenticated session with the perm_decaying permission. The attacker submits a crafted JSON import containing a nested DecayingModel key with an id targeting an existing model and arbitrary org_id and default values.

php

                 throw new MethodNotAllowedException(__('Error while decoding JSON'));
             }
 
-            unset($json['id']);
-            unset($json['uuid']);
-            $json['default'] = 0;
-            $json['org_id'] = $this->Auth->user()['org_id'];
-
             $attribute_types = array();
             if (!empty($json['attribute_types'])) {
                 $attribute_types = $json['attribute_types'];
                 unset($json['attribute_types']);
             }
 
-            if ($this->DecayingModel->save($json)) {
+            // Import only ever creates a model for the caller's own organisation, so build the
+            // row from an allow-list: stripping the id on the submitted array left it able to
+            // carry its own primary key, org_id and default flag one level deeper.
+            $importable = array(
+                'name', 'parameters', 'description', 'ref', 'formula', 'version',
+                'enabled', 'all_orgs'
+            );
+            $model = array_intersect_key($json, array_flip($importable));
+            $model['org_id'] = $this->Auth->user()['org_id'];
+            $model['default'] = 0;
+
+            $this->DecayingModel->create();
+            if ($this->DecayingModel->save(array('DecayingModel' => $model))) {
                 $saved_model = array(
                     'model_id' => $this->DecayingModel->id,

Source: MISP GitHub Commit 70e319e4b

Detection Methods for CVE-2026-104908

Indicators of Compromise

Decaying model records whose org_id changed without an administrative action in the audit log.
Models flagged as default = 1 that were created or modified by a non-administrative user.
Unexpected changes to the name, formula, or parameters fields of existing decaying models.
POST requests to the decaying model import endpoint containing a nested DecayingModel key in the JSON body.

Detection Strategies

Review MISP audit logs for DecayingModel save or edit events performed by users holding perm_decaying but not administrative privileges.
Compare current decaying model ownership and default flags against a known-good baseline from before the suspected exposure window.
Inspect web server access logs for POST requests to /decayingModel/import and correlate with user roles.

Monitoring Recommendations

Alert on any modification of decaying model org_id fields.
Monitor creation of models with default = 1 outside of administrative accounts.
Capture full request bodies for the decaying model import endpoint to allow retrospective analysis of nested payloads.

How to Mitigate CVE-2026-104908

Immediate Actions Required

Upgrade MISP to version 2.5.48 or later, which applies allow-list filtering in DecayingModelController.
Audit all existing decaying models for unexpected org_id, default, or formula values and restore from backup where tampering is confirmed.
Review and tighten the assignment of the perm_decaying role to limit exposure to trusted users only.

Patch Information

The fix is applied in MISP commit 70e319e4b. The patched controller replaces the denylist with an allow-list via array_intersect_key, restricts importable fields to name, parameters, description, ref, formula, version, enabled, and all_orgs, and wraps the save in an explicit DecayingModel key to prevent nested-key injection.

Workarounds

Revoke the perm_decaying permission from non-administrative users until the upgrade is applied.
Restrict network access to the MISP instance to trusted analyst networks via firewall or reverse proxy ACLs.
Place the decaying model import endpoint behind a web application firewall rule that rejects JSON payloads containing a nested DecayingModel object.

bash

# Verify the installed MISP version meets the fix threshold
cd /var/www/MISP
git fetch --tags
git describe --tags
# Upgrade to a release >= 2.5.48
git checkout v2.5.48
sudo -u www-data app/Console/cake Admin runUpdates