CVE-2026-107175: MISP Information Disclosure Vulnerability

CVE-2026-107175 Overview

CVE-2026-107175 affects Malware Information Sharing Platform (MISP) versions prior to 2.5.48. The flaw resides in the event save workflow, where the correlation engine fails to recalculate correlations when a user modifies an event's distribution level or sharing_group_id. The internal before-save hook stores the incoming data instead of the previously persisted values, so the after-save comparison never detects the change. Stale correlations persist, leaving event data visible to users in a broader sharing group even after an event is moved to a more restrictive one. This improper access control weakness is tracked under [CWE-284].

Critical Impact
Threat intelligence events moved to restricted sharing groups may remain visible to unauthorized users through stale correlation records, resulting in unintended information disclosure.

Affected Products

MISP versions prior to 2.5.48
MISP correlation engine component
MISP app/Model/Event.php event save workflow

Discovery Timeline

2026-10-07 - CVE-2026-107175 published to the National Vulnerability Database
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-107175

Vulnerability Analysis

MISP maintains correlations between events to help analysts pivot across related threat intelligence. Access to a correlation is bounded by the owning event's distribution level and sharing group. When those fields change, the engine must re-evaluate every correlation tied to the event. In versions prior to 2.5.48, this re-evaluation never fires on edits.

The defect produces two opposing failures. Narrowing an event's distribution leaves correlations exposed to users who should no longer see them. Widening an event's distribution fails to generate new correlations that should become visible, degrading the completeness of shared intelligence.

An authenticated user with write access to any event can trigger the condition simply by editing the event's distribution or sharing group. No special privilege escalation or network-side exploitation is required beyond standard MISP authoring rights.

Root Cause

In app/Model/Event.php, the beforeSave hook assigned $this->__beforeSaveData = $this->data['Event']. Because CakePHP populates $this->data with the incoming (new) values during a save, the hook captured the post-change state. The subsequent afterSave comparison then compared the new values against themselves, always evaluating as unchanged. As a result, the correlation refresh path was never invoked.

Attack Vector

An authenticated MISP user with edit rights modifies an event's distribution or sharing_group_id through the web UI or REST API. The save completes successfully, but correlation records retain the prior access control scope. Users who previously had visibility through the old sharing group continue to retrieve correlated attribute data.

php

        if (empty($this->data['Event']['uuid'])) {
            $this->data['Event']['uuid'] = CakeText::uuid();
        }
-        $this->__beforeSaveData = $this->data['Event'];
+        // remember the stored distribution/SG so afterSave can tell whether
+        // this save actually changed them and refresh the correlations if so
+        $this->__beforeSaveData = null;
+        if (!empty($this->data['Event']['id'])) {
+            $stored = $this->find('first', [
+                'recursive' => -1,
+                'conditions' => ['Event.id' => $this->data['Event']['id']],
+                'fields' => ['Event.distribution', 'Event.sharing_group_id'],
+            ]);
+            if (!empty($stored)) {
+                $this->__beforeSaveData = $stored['Event'];
+            }
+        }

        $trigger_id = 'event-before-save';
        if ($this->isTriggerCallable($trigger_id)) {

Source: MISP commit 19a389d19. The patch reads the previously persisted distribution and sharing_group_id from the database before the save, ensuring the afterSave comparison can detect genuine changes and trigger a correlation refresh.

Detection Methods for CVE-2026-107175

Indicators of Compromise

Audit log entries showing edits to the distribution or sharing_group_id fields of existing events on MISP instances running versions earlier than 2.5.48.
Correlation records whose effective access scope does not match the current event distribution or sharing group assignment.
User access reports showing attribute retrievals by accounts outside an event's current sharing group.

Detection Strategies

Query the MISP database to compare each event's current distribution and sharing_group_id against the sharing scope of its related Correlation entries, flagging mismatches.
Review the MISP audit log for Event edit actions that changed distribution fields without a corresponding correlation refresh job.
Correlate API access logs with event sharing changes to identify retrievals that occurred after a restriction change.

Monitoring Recommendations

Enable and centralize MISP audit logs covering event edits, sharing group changes, and administrative actions.
Monitor the installed MISP version across all nodes and alert when any instance remains below 2.5.48.
Track correlation refresh jobs and alert when distribution changes occur without a subsequent refresh.

How to Mitigate CVE-2026-107175

Immediate Actions Required

Upgrade all MISP instances to version 2.5.48 or later.
After upgrading, trigger a full correlation rebuild for events whose distribution or sharing group was modified on vulnerable versions.
Review recent event edits and manually validate the sharing scope of correlated data for sensitive events.

Patch Information

The fix is published in the upstream MISP repository as commit 19a389d19, which modifies app/Model/Event.php so the before-save hook captures the stored distribution and sharing group values from the database. Apply the fix by upgrading to MISP 2.5.48 or newer. See the MISP commit 19a389d19 for the exact code change.

Workarounds

Restrict event edit permissions to a limited set of trusted users until the patch is applied.
Manually invoke the MISP correlation rebuild command after any event distribution or sharing group change.
Temporarily disable the ability for standard users to change distribution or sharing_group_id on existing events through role configuration.

bash

# After upgrading to MISP 2.5.48, rebuild correlations for affected events
cd /var/www/MISP
sudo -u www-data /var/www/MISP/app/Console/cake Admin recorrelate