CVE-2026-104912: MISP Auth Bypass Vulnerability

CVE-2026-104912 Overview

CVE-2026-104912 is an authorization flaw in Malware Information Sharing Platform (MISP) affecting versions prior to v2.5.48. The vulnerability resides in correlation handling during attribute searches. When a user runs an attribute search that triggers correlation lookups, MISP authorizes access to correlated attributes and events using a stale distribution snapshot stored on the correlation row rather than the live event access control list (ACL). An authenticated user can retrieve attributes and event details belonging to events they no longer have permission to view. The flaw is categorized under [CWE-284: Improper Access Control].

Critical Impact
Authenticated MISP users can disclose attribute values and event metadata from restricted or unpublished events through correlation-based attribute searches.

Affected Products

MISP versions prior to v2.5.48
MISP instances with correlations between events where at least one event has been restricted after the correlation was created
Deployments relying on sharing group changes or event unpublishing to enforce confidentiality

Discovery Timeline

2026-10-02 - CVE-2026-104912 published to the National Vulnerability Database (NVD)
2026-10-03 - Last updated in NVD database

Technical Details for CVE-2026-104912

Vulnerability Analysis

MISP stores correlation metadata in dedicated rows that duplicate distribution attributes from the source event at the time the correlation is created. These rows include distribution columns but omit the published flag that MISP uses when evaluating live access decisions. When a user performs an attribute search that fans out into correlation lookups, the authorization check reads from the correlation row rather than the authoritative event record. Subsequent restriction of an event, such as changing its sharing group, unpublishing it, or narrowing distribution, does not propagate to existing correlation rows. The result is a confidentiality breach limited to data the user previously could have seen through correlated events, now exposed through the search path.

Root Cause

The root cause is reliance on a point-in-time snapshot for authorization decisions. The correlation row's distribution columns are copied at correlation creation time and are not re-validated against the live event ACL at query time. Because the snapshot lacks a published flag, restrictions applied after correlation creation are silently bypassed during correlation lookups.

Attack Vector

Exploitation requires an authenticated account with read access to at least some events on the instance. The attacker performs an attribute search that triggers correlation lookups and retrieves attribute values and event metadata from correlated events they no longer have authorization to view. No user interaction from a privileged user is required.

php

// Patch applied to app/Model/Behavior/DefaultCorrelationBehavior.php
// Checks correlations against the live event ACL instead of the snapshot
$conditions = ['Attribute.id' => $correlatedAttributeIds];
if (empty($user['Role']['perm_site_admin'])) {
    // the correlation row's distribution columns are a snapshot and carry
    // no published flag, so check the attributes against the live rows
    $conditions = [
        'AND' => [$conditions, $Model->Attribute->buildConditions($user)],
    ];
    if (!isset($contain['Event'])) {
        $contain['Event'] = ['fields' => ['Event.id']];
    }
    $contain['Object'] = ['fields' => ['Object.id']];
}
$relatedAttributes = $Model->Attribute->find('all', [
    'recursive' => -1,
    'conditions' => $conditions,
    'fields' => $fields,
    'contain' => $contain
]);
// Source: https://github.com/MISP/MISP/commit/100235bd9

Detection Methods for CVE-2026-104912

Indicators of Compromise

Attribute search API or UI requests from non-admin users returning attribute identifiers belonging to events whose current distribution should exclude the requester.
Access log entries for /attributes/search or correlation-driven endpoints followed by retrieval of event metadata from events marked as unpublished or restricted.
Audit log entries showing event sharing group changes or unpublish actions, followed by continued read access to those events' attributes via correlation.

Detection Strategies

Compare attribute search response contents against the live event ACL and flag mismatches where returned event_id values are not authorized for the requesting user.
Review MISP application logs for correlation lookup patterns that cross sharing group boundaries after a recent distribution change.
Correlate change-management events (sharing group updates, unpublishing) with subsequent attribute search activity by lower-privileged users.

Monitoring Recommendations

Forward MISP application and web server logs into a centralized analytics platform for retention and query against user, event, and attribute identifiers.
Alert on anomalous attribute search volumes from accounts that recently lost access to specific events or sharing groups.
Track database-level reads against the correlations table and compare them with authorization decisions recorded in application logs.

How to Mitigate CVE-2026-104912

Immediate Actions Required

Upgrade MISP to v2.5.48 or later, where correlation lookups are validated against the live event ACL.
Review audit logs for attribute search activity by non-admin users against events whose distribution was tightened or that were unpublished.
Rotate or revoke API keys for accounts that may have abused correlation-based disclosure.

Patch Information

The fix is implemented in app/Model/Behavior/DefaultCorrelationBehavior.php and augments correlation queries with Attribute->buildConditions($user) so that results are filtered by the current user's live permissions. Site admins retain unchanged behavior. See the upstream patch at MISP commit 100235bd9.

Workarounds

Restrict attribute search privileges to trusted roles until the upgrade can be applied.
Rebuild correlations after making sharing group or publication changes, reducing (but not eliminating) exposure from stale snapshots.
Avoid relying on post-hoc event restriction as a confidentiality control on unpatched instances; remove sensitive attributes from events that must be withheld.

bash

# Upgrade MISP to the patched release
cd /var/www/MISP
sudo -u www-data git fetch origin
sudo -u www-data git checkout v2.5.48
sudo -u www-data git submodule update --init --recursive
sudo -u www-data /var/www/MISP/app/Console/cake Admin runUpdates