CVE-2026-104910: MISP Authorization Bypass Vulnerability

CVE-2026-104910 Overview

CVE-2026-104910 is an authorization bypass vulnerability in MISP (Malware Information Sharing Platform), an open-source threat intelligence platform. The flaw resides in the related events listing functionality. When a user requests events correlated to a given event, MISP retrieves related event metadata directly from the correlation table without re-validating the caller's access rights against each related event. This allows authenticated users to view metadata for events they should not be able to access, including unpublished events and events whose distribution scope has changed since correlation.

Critical Impact

Authenticated MISP users can enumerate titles, dates, and correlation counts of threat-intelligence events across sharing groups they do not belong to, enabling reconnaissance of restricted intelligence.

Affected Products

• MISP versions prior to fix commit 2ffa97f05
• MISP correlation subsystem (app/Model/Event.php)
• MISP events controller (app/Controller/EventsController.php)

Discovery Timeline

• 2026-10-02 - CVE-2026-104910 published to NVD
• 2026-10-03 - Last updated in NVD database

Technical Details for CVE-2026-104910

Vulnerability Analysis

The vulnerability is classified as Authorization Bypass [CWE-285] and affects the viewRelatedEvents action in MISP. The code assumed that access control was fully enforced by the correlation table itself, because distribution level and sharing group values are stored alongside each correlation entry. That assumption fails in two cases.

First, the correlation row stores a snapshot taken when the correlation was created. If an event's distribution level or sharing group membership changes later, the snapshot becomes stale and no longer reflects the current access policy. Second, the correlation table does not store the published flag. Unpublished events, which should remain invisible to other users, are still enumerable through the related events listing.

An authenticated user with access to any single event can request its related events and receive metadata (event titles, dates, correlating value counts) for events outside their authorization scope.

Root Cause

The viewRelatedEvents controller called Event->find() using only Event.id IN (relatedEventIds) as the query condition. The standard MISP access-control helper createEventConditions($user), which filters by publication state, organization, distribution, and sharing group membership, was not applied to this query path.

Attack Vector

Exploitation requires an authenticated session with access to at least one event. The attacker invokes the related events listing endpoint for an event they can read and receives metadata on correlated events regardless of their current distribution scope or publication status.

// Patch in app/Model/Event.php — scope the related events to what the caller may read
            return [];
        }
        // now look up the event data for these attributes
        // the correlation row's distribution columns are a snapshot and carry no
        // published flag, so scope the events themselves
        $conditions = $this->createEventConditions($user);
        $conditions['Event.id'] = $relatedEventIds;
        $relatedEvents =  $this->find(
            'all',
            [
                'conditions' => $conditions,
                'recursive' => -1,
                'order' => 'date DESC',
                'fields' => [

Source: MISP commit 2ffa97f05

Detection Methods for CVE-2026-104910

Indicators of Compromise

• Repeated requests to the viewRelatedEvents endpoint from a single authenticated session targeting many distinct event IDs or UUIDs.
• Access to related-event metadata for events whose distribution level or sharing group should exclude the requesting user.
• Enumeration patterns against sequential event IDs in MISP access logs.

Detection Strategies

• Review MISP web server logs for high-volume /events/viewRelatedEvents/ requests correlated with user accounts outside the owning sharing group.
• Compare the set of event IDs returned to a user via related-events responses against that user's permitted events to flag disclosures of unpublished or out-of-scope events.
• Alert on anomalous API usage patterns from service accounts or low-privilege MISP users.

Monitoring Recommendations

• Enable MISP audit logging and forward access logs to a centralized log platform for retention and correlation.
• Baseline normal viewRelatedEvents call volume per user role, and alert on deviations.
• Monitor for sharing group or distribution changes followed by continued access to the affected events.

How to Mitigate CVE-2026-104910

Immediate Actions Required

• Upgrade MISP to a build that includes commit 2ffa97f05 or later.
• Audit MISP access logs for suspicious use of the related events listing endpoint prior to patching.
• Rotate sensitive event titles or identifiers that may have been exposed through metadata enumeration if exposure is suspected.

Patch Information

The fix applies createEventConditions($user) to the related-event query so that the publication state, distribution level, and sharing group of each candidate event are re-validated at request time. See the upstream fix in the MISP commit 2ffa97f05 touching app/Controller/EventsController.php and app/Model/Event.php.

Workarounds

• Restrict MISP API and web access to trusted analyst accounts until the patched version is deployed.
• Temporarily disable or front-end-block the related events listing endpoint for low-trust users via a reverse proxy rule.
• Review and tighten sharing group membership so that historical correlation snapshots do not expose currently restricted events.

# Example nginx rule to block the related events endpoint pending patch
location ~* ^/events/viewRelatedEvents/ {
    return 403;
}