CVE-2026-104914: MISP Authentication Bypass Vulnerability

CVE-2026-104914 Overview

CVE-2026-104914 is an improper access control vulnerability [CWE-284] in MISP, the open-source threat intelligence sharing platform. The flaw affects the attribute search and paginated attribute view endpoints. When any authenticated user queries for soft-deleted attributes, the application returns soft-deleted records belonging to events owned by other organizations. The event detail view enforces proper restrictions, but the search and paginated code paths do not. This exposes threat intelligence that an owning organization explicitly removed from general visibility.

Critical Impact
Authenticated MISP users with read access to shared events can retrieve soft-deleted attributes, including indicators of compromise (IOCs) and contextual intelligence, from other organizations.

Affected Products

MISP versions prior to v2.5.48
MISP attribute search endpoint (deleted-attributes filter)
MISP paginated attribute view endpoint

Discovery Timeline

2026-10-02 - CVE-2026-104914 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-104914

Vulnerability Analysis

MISP implements soft-deletion for attributes, allowing an organization to remove an indicator from active visibility while retaining the record. The fetchEvent() function correctly limited soft-deleted attribute visibility to the owning organization and users with sync permissions. However, two parallel code paths bypassed this control: the attribute search endpoint and the paginated attribute listing.

An authenticated user with at least read access to an event owned by another organization could issue a query with the deleted filter. The application returned soft-deleted attributes without checking whether the requesting user belonged to the owning organization. The resulting disclosure undermines the organizational boundary that MISP enforces for sensitive intelligence lifecycle management.

Root Cause

The root cause is missing authorization logic in two code paths that mirror fetchEvent() behavior. The query builder appended an Attribute.deleted filter condition without conjoining an organization ownership check. Any user permitted to see the parent event received every soft-deleted attribute attached to it, regardless of ownership.

Attack Vector

Exploitation requires authenticated access with read permission on an event owned by another organization. The attacker issues a standard API or UI query with the deleted filter enabled. No elevated privileges, user interaction, or crafted payload is required. The vulnerability impacts confidentiality only; integrity and availability are not affected.

php

// Patch excerpt from app/Model/Event.php - adds ownership check for soft-deleted attributes
        } else {
            $conditions['Attribute.deleted'] = 0;
        }
+       if ($deleted !== 0 && !$user['Role']['perm_sync']) {
+           // soft-deleted data is only shown to the event owner, as in fetchEvent()
+           $ownDeleted = [
+               'Attribute.deleted' => 1,
+               $this->eventOwnerSubquery('Attribute') . ' = ' . (int)$user['org_id'],
+           ];
+           unset($conditions['Attribute.deleted']);
+           $conditions[] = $deleted === 1
+               ? ['OR' => ['Attribute.deleted' => 0, 'AND' => $ownDeleted]]
+               : $ownDeleted;
+       }

        // Optional filters
        if (!empty($options['category'])) {

Source: MISP commit bd81c23cf

php

// Patch excerpt from app/Model/MispAttribute.php - restricts deleted='only' queries
            if (isset($options['deleted']) && $options['deleted'] === 'only') {
                $conditions['AND'][] = ['Attribute.deleted' => 1];
+               if (!$user['Role']['perm_sync']) {
+                   // soft-deleted data is only shown to the event owner, as in fetchEvent()
+                   $conditions['AND'][] = ['Event.org_id' => $user['org_id']];
+               }
            } elseif (!$user['Role']['perm_sync'] || empty($options['deleted'])) {
                $conditions['AND'][] = ['Attribute.deleted' => 0];
            }

Source: MISP commit bd81c23cf

Detection Methods for CVE-2026-104914

Indicators of Compromise

API or web requests to attribute search endpoints containing deleted=1 or deleted=only parameters from accounts outside the event-owning organization.
Unusual spikes in paginated attribute listing requests with the deleted filter enabled.
Access log entries showing authenticated users retrieving large volumes of attribute data across multiple organizations.

Detection Strategies

Review MISP application logs for queries using the deleted filter and correlate the requesting org_id against the event owner org_id.
Enable audit logging on MISP attribute search and pagination endpoints to capture all read operations against soft-deleted records.
Baseline normal query patterns per user role and alert on deviations involving deletion filters.

Monitoring Recommendations

Forward MISP audit logs to a centralized SIEM for cross-organization query correlation and retention.
Monitor the MISP REST API for unauthenticated or low-privilege accounts issuing /attributes/restSearch requests with the deleted parameter.
Track user session activity to identify accounts querying soft-deleted attributes across multiple foreign organizations within short time windows.

How to Mitigate CVE-2026-104914

Immediate Actions Required

Upgrade MISP to version 2.5.48 or later, which contains the authorization fix in both Event.php and MispAttribute.php.
Audit historical API logs to identify any user accounts that previously queried soft-deleted attributes belonging to other organizations.
Review user roles and remove unnecessary read access to shared events where organizational isolation of deleted content is required.

Patch Information

The fix is implemented in MISP commit bd81c23cf. The patch adds the condition Event.org_id = $user['org_id'] when a non-sync user requests deleted attributes, aligning the search and pagination paths with the existing fetchEvent() restriction. Users without the perm_sync role can now only retrieve soft-deleted attributes belonging to their own organization.

Workarounds

Restrict the perm_sync role to trusted organizational administrators only, since sync-permission users retain cross-organization visibility by design.
Limit event sharing scope using MISP distribution levels and sharing groups to reduce the pool of events exposed to third-party users.
Temporarily hard-delete sensitive attributes rather than soft-deleting them when operating on vulnerable MISP versions.

bash

# Verify installed MISP version
cat /var/www/MISP/VERSION.json

# Upgrade MISP to patched release (v2.5.48 or later)
cd /var/www/MISP
sudo -u www-data git fetch origin
sudo -u www-data git checkout v2.5.48
sudo -u www-data git submodule update --init --recursive
sudo systemctl restart apache2