CWE-862

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104915",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-11T16:44:01.920159Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-11T16:55:20.686Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Academy LMS \u2013 AI Course Builder, Quizzes, Certificates \u0026 eLearning",
          "vendor": "kodezen",
          "versions": [
            {
              "lessThanOrEqual": "4.0.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Academy LMS \u2013 AI Course Builder, Quizzes, Certificates \u0026 eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to permanently delete arbitrary Academy lesson comments and their replies authored by any user, including administrators, across courses they do not instruct. This is exploitable by any user registered as an Academy instructor for at least one course, as they can supply their own course_id to pass the instructor check while targeting comments belonging to entirely different courses."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T02:26:30.717Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2640d1f8-958d-4556-919c-58df5bf15b40?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/ajax/miscellaneous.php#L496"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/ajax/miscellaneous.php#L477"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/ajax/miscellaneous.php#L480"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/ajax/miscellaneous.php#L469"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/classes/abstract-ajax-handler.php#L43"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/traits/courses.php#L380"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3734598%40academy\u0026new=3734598%40academy"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T16:24:48.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-09T14:14:57.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Academy LMS \u003c= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX \u2014 Attacker-Controlled course_id vs. Target comment_id"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104915",
    "datePublished": "2026-10-10T02:26:30.717Z",
    "dateReserved": "2026-10-02T16:09:59.143Z",
    "dateUpdated": "2026-10-11T16:55:20.686Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104914",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T16:22:46.775990Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T18:23:08.747Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "app/Model/Event.php",
            "app/Model/MispAttribute.php"
          ],
          "product": "MISP",
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "elhoim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints.\u003c/p\u003e\u003cp\u003eWhen a user queries for soft-deleted attributes (e.g., via the deleted-attributes search or the paginated attribute listing), the application returned soft-deleted attributes belonging to events owned by other organizations to any authenticated user who had visibility of the event. The event detail view correctly restricted soft-deleted attribute visibility to the owning organization and sync-permission users, but the attribute search and paginated view code paths lacked this restriction.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- An authenticated MISP user with at least read access to an event owned by another organization.\u003c/p\u003e\u003cp\u003e- The user issues a query for deleted attributes (search or paginated view with the deleted filter).\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Confidentiality: Soft-deleted threat intelligence attributes (e.g., IOCs, indicators, context) from other organizations are disclosed to unauthorized users. This may expose sensitive intelligence that the owning organization intended to remove from general visibility.\u003c/p\u003e\u003cp\u003eAffected versions: MISP versions prior to v2.5.48.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints.\n\nWhen a user queries for soft-deleted attributes (e.g., via the deleted-attributes search or the paginated attribute listing), the application returned soft-deleted attributes belonging to events owned by other organizations to any authenticated user who had visibility of the event. The event detail view correctly restricted soft-deleted attribute visibility to the owning organization and sync-permission users, but the attribute search and paginated view code paths lacked this restriction.\n\nPreconditions:\n\n- An authenticated MISP user with at least read access to an event owned by another organization.\n\n- The user issues a query for deleted attributes (search or paginated view with the deleted filter).\n\nImpact:\n\n- Confidentiality: Soft-deleted threat intelligence attributes (e.g., IOCs, indicators, context) from other organizations are disclosed to unauthorized users. This may expose sensitive intelligence that the owning organization intended to remove from general visibility.\n\nAffected versions: MISP versions prior to v2.5.48."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Leverage Executable Code to Alter Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-02T16:06:38Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T16:09:40.333Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/bd81c23cf"
        },
        {
          "url": "https://github.com/elhoim"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix enforces organizational ownership checks on soft-deleted attribute queries. When a user without sync permission requests deleted attributes, the query is now constrained to only return soft-deleted attributes whose parent event belongs to the requesting user\u0027s organization. This aligns the attribute search and paginated view behavior with the existing event view authorization logic.\u003c/p\u003e"
            }
          ],
          "value": "The fix enforces organizational ownership checks on soft-deleted attribute queries. When a user without sync permission requests deleted attributes, the query is now constrained to only return soft-deleted attributes whose parent event belongs to the requesting user\u0027s organization. This aligns the attribute search and paginated view behavior with the existing event view authorization logic."
        }
      ],
      "title": "MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact fixed version is not specified in the patch metadata; the fix commit is 37 commits after the v2.5.48 tag, so the fixed release is post-2.5.48 but the exact version number is unknown.",
                  "PR:L assumes the attacker needs at least read access to an event owned by another organization; if MISP deployments restrict cross-org event visibility more tightly, the effective privilege requirement may be higher.",
                  "CAPEC-126 is the closest available mapping but is not a perfect fit; the vulnerability is an information disclosure via missing authorization rather than data alteration.",
                  "VC:L assumes the exposure is limited to soft-deleted attributes (a subset of event data) and does not include active attributes or full event metadata.",
                  "The patch does not specify whether this affects all MISP deployments or only multi-organization configurations; the CVSS assumes a multi-org deployment where cross-org visibility is possible."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "This CAPEC describes leveraging legitimate application code paths to access or manipulate data beyond intended permissions. The attacker uses the legitimate attribute search and paginated view endpoints (executable code paths) to retrieve soft-deleted attributes from other organizations. The mapping is imperfect because CAPEC-126 emphasizes data alteration, whereas this vulnerability is purely an information disclosure. However, among available CAPEC patterns, this is the closest match for exploiting a legitimate code path to bypass intended access restrictions. No CAPEC specifically covers \u0027information disclosure via missing authorization in a query endpoint\u0027 with greater precision."
                  }
                ],
                "commit": "bd81c23cf2aced3c72766369dc813612edd52509",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  },
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "elhoim"
                  }
                ],
                "cvssRationale": "AV:N: The vulnerability is exploitable over the network via the MISP web API. AC:L: Exploitation requires only a standard query with the deleted-attribute filter; no race conditions or complex setup. AT:N: No special attack requirements. PR:L: An authenticated user with at least read access to an event owned by another organization is required. UI:N: No victim interaction needed; the data is returned in the API response. VC:L: Confidentiality impact is limited to soft-deleted attributes (a subset of event data) from other organizations; not all data is exposed. VI:N, VA:N: No integrity or availability impact on the vulnerable component. SC:N, SI:N, SA:N: No impact on subsequent components.",
                "fixSummary": "The fix enforces organizational ownership checks on soft-deleted attribute queries. When a user without sync permission requests deleted attributes, the query is now constrained to only return soft-deleted attributes whose parent event belongs to the requesting user\u0027s organization. This aligns the attribute search and paginated view behavior with the existing event view authorization logic.",
                "generatedAt": "2026-10-02T16:06:38.209479Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "9673ee1d4db26b032b6e3a2632315d5353cd2718c9b809a5296d28a0002a3722",
                "patchSummary": "Two code paths were modified:1. Event.php (fetchPaginatedAttributes): When the deleted filter is active and the user lacks perm_sync, an additional subquery condition is appended requiring the event owner\u0027s org_id to match the user\u0027s org_id. The original blanket deleted=0 or deleted=1 condition is replaced with an OR/AND structure that permits non-deleted attributes for all users but restricts deleted attributes to the owning org.2. MispAttribute.php (fetchAttributes): In the deleted=\u0027only\u0027 branch, when the user lacks perm_sync, an additional AND condition Event.org_id = user.org_id is added to the query conditions, scoping results to the user\u0027s own organization.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "bd81c23cf2aced3c72766369dc813612edd52509",
                    "date": "Thu, 24 Sep 2026 13:57:21 +0200",
                    "patchSha256": "9673ee1d4db26b032b6e3a2632315d5353cd2718c9b809a5296d28a0002a3722",
                    "source": "https://github.com/MISP/MISP/commit/bd81c23cf.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/bd81c23cf.patch",
                    "subject": "fix: [security] Show soft-deleted attributes only to the"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/bd81c23cf.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-02T16:06:38Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [security] Show soft-deleted attributes only to the",
                "tagVersionBoundary": {
                  "commits_after_fix": 37,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The attribute search and paginated view code paths were missing the authorization check that restricts soft-deleted attribute visibility to the owning organization. The event view had this check, but the attribute-level query paths did not, allowing any user with event visibility to retrieve soft-deleted attributes from other organizations."
                  },
                  {
                    "cweId": "CWE-284",
                    "rationale": "More broadly, the application failed to enforce proper access control boundaries between organizations when serving soft-deleted attribute data through specific query endpoints, resulting in cross-organizational information disclosure."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (bd81c23cf2aced3c72766369dc813612edd52509): fix: [security] Show soft-deleted attributes only to the",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/bd81c23cf.patch"
                    ],
                    "timestamp": "2026-09-24T11:57:21Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20248"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-104914",
    "datePublished": "2026-10-02T16:09:40.333Z",
    "dateReserved": "2026-10-02T16:09:36.435Z",
    "dateUpdated": "2026-10-06T18:23:08.747Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104912",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:48:11.201423Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:52:55.841Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "app/Model/Behavior/DefaultCorrelationBehavior.php"
          ],
          "product": "MISP",
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "elhoim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distribution snapshot stored on the correlation row rather than the live event access control list.\u003c/p\u003e\u003cp\u003eBecause the correlation row\u0027s distribution columns are a point-in-time copy that lacks a published flag, the authorization check becomes incorrect when an event is subsequently restricted (for example, its sharing group is changed or it is unpublished). As a result, an authenticated user could retrieve attributes and event details belonging to events they no longer have permission to view.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- An authenticated user with at least read access to some events in the instance.\u003c/p\u003e\u003cp\u003e- The existence of correlations between events, at least one of which has been restricted after the correlation was created.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Confidentiality: exposure of attribute values and event metadata that the user is not authorized to access.\u003c/p\u003e\u003cp\u003eAffected versions: MISP prior to v2.5.48.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distribution snapshot stored on the correlation row rather than the live event access control list.\n\nBecause the correlation row\u0027s distribution columns are a point-in-time copy that lacks a published flag, the authorization check becomes incorrect when an event is subsequently restricted (for example, its sharing group is changed or it is unpublished). As a result, an authenticated user could retrieve attributes and event details belonging to events they no longer have permission to view.\n\nPreconditions:\n\n- An authenticated user with at least read access to some events in the instance.\n\n- The existence of correlations between events, at least one of which has been restricted after the correlation was created.\n\nImpact:\n\n- Confidentiality: exposure of attribute values and event metadata that the user is not authorized to access.\n\nAffected versions: MISP prior to v2.5.48."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-114 Exploiting Incorrectly Adjusted Privileges"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-02T16:02:40Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T16:04:50.580Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/100235bd9"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix ensures that correlation-based lookups are authorized against the live event and attribute access control lists rather than the stale distribution snapshot on the correlation row. A new filtering step validates related event IDs against the current event ACL before returning them, and attribute queries for non-admin users now include the live ACL conditions. Additionally, Event and Object fields are stripped from returned attribute results to prevent incidental metadata leakage.\u003c/p\u003e"
            }
          ],
          "value": "The fix ensures that correlation-based lookups are authorized against the live event and attribute access control lists rather than the stale distribution snapshot on the correlation row. A new filtering step validates related event IDs against the current event ACL before returning them, and attribute queries for non-admin users now include the live ACL conditions. Additionally, Event and Object fields are stripped from returned attribute results to prevent incidental metadata leakage."
        }
      ],
      "title": "MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary (\u003c 2.5.48) is inferred from the tag_version_boundary metadata (v2.5.48, 38 commits after fix); the exact first affected version is not stated in the patch.",
                  "CVSS PR:L assumes the attacker needs a standard authenticated MISP account with read access to at least one event; no evidence supports a lower or higher privilege requirement.",
                  "CAPEC-114 is the closest available pattern; the actual mechanism is a stale authorization snapshot rather than a classic privilege-escalation vector, so the mapping is approximate.",
                  "The patch does not specify whether the vulnerability requires the event to have been restricted after correlation creation, or whether other state changes (e.g., sharing group modification) also trigger the issue; the commit message mentions \u0027restricted\u0027 as the primary scenario.",
                  "No public exploit or PoC is referenced; exploitation status is assumed to be \u0027none\u0027."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-114",
                    "rationale": "The authorization state used for correlation lookups was incorrectly adjusted (stale) relative to the actual event ACL. An attacker with a legitimate account could exploit this misalignment to access data beyond their intended privilege scope. This is the closest CAPEC pattern; the exact mechanism is a stale authorization snapshot rather than a classic privilege-escalation primitive, so the mapping is approximate."
                  }
                ],
                "commit": "100235bd99b9f57a5a09976412d54e2001d2e0c4",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  },
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "elhoim"
                  }
                ],
                "cvssRationale": "Network vector: MISP is a web application accessible over the network. Low complexity: the attacker simply performs a normal attribute search that triggers correlations; no race condition or special setup is needed. No attack requirements: the stale correlation row exists naturally after any event restriction. Low privileges: the attacker needs an authenticated account with read access to at least one event. No user interaction: the attacker initiates the search themselves. High vulnerability-component confidentiality impact: full attribute values and event metadata of restricted events are exposed. No integrity or availability impact on the vulnerable or subsequent components.",
                "fixSummary": "The fix ensures that correlation-based lookups are authorized against the live event and attribute access control lists rather than the stale distribution snapshot on the correlation row. A new filtering step validates related event IDs against the current event ACL before returning them, and attribute queries for non-admin users now include the live ACL conditions. Additionally, Event and Object fields are stripped from returned attribute results to prevent incidental metadata leakage.",
                "generatedAt": "2026-10-02T16:02:40.166976Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "a38b683420d93ff26d461badf81e0524bbd9618dd3dd6f187a994f5c5b47f23d",
                "patchSummary": "In DefaultCorrelationBehavior.php: (1) runGetRelatedAttributes now builds query conditions that include the live attribute ACL (buildConditions) for non-site-admin users, and ensures Event and Object are contained in the query for proper filtering; (2) after fetching related attributes, Event and Object sub-objects are unset from each result; (3) fetchRelatedEventIds now passes its results through a new __filterVisibleEventIds method that queries the Event model with createEventConditions to verify each event ID is still visible to the user; (4) the new __filterVisibleEventIds method returns the event IDs unchanged for site admins or empty lists, otherwise filters against the live event ACL.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "100235bd99b9f57a5a09976412d54e2001d2e0c4",
                    "date": "Thu, 24 Sep 2026 12:12:56 +0200",
                    "patchSha256": "a38b683420d93ff26d461badf81e0524bbd9618dd3dd6f187a994f5c5b47f23d",
                    "source": "https://github.com/MISP/MISP/commit/100235bd9.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/100235bd9.patch",
                    "subject": "fix: [security] Check correlations against the live event ACL"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/100235bd9.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-02T16:02:40Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [security] Check correlations against the live event ACL",
                "tagVersionBoundary": {
                  "commits_after_fix": 38,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The correlation lookup path failed to enforce the current (live) authorization state of the target events and attributes. Access was granted based on a stale snapshot rather than the actual ACL, effectively missing the authorization check for restricted events."
                  },
                  {
                    "cweId": "CWE-284",
                    "rationale": "The access control decision relied on outdated data (the distribution columns copied onto the correlation row) that did not reflect the current published/sharing-group state of the event, leading to improper access control."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (100235bd99b9f57a5a09976412d54e2001d2e0c4): fix: [security] Check correlations against the live event ACL",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/100235bd9.patch"
                    ],
                    "timestamp": "2026-09-24T10:12:56Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20312"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-104912",
    "datePublished": "2026-10-02T16:04:50.580Z",
    "dateReserved": "2026-10-02T16:04:47.753Z",
    "dateUpdated": "2026-10-03T15:52:55.841Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104910",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:48:33.673589Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:52:56.095Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "EventsController (viewRelatedEvents)",
            "Event model (getRelatedEvents)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/EventsController.php",
            "app/Model/Event.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Wenhao Wu"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved related event metadata directly from the correlation table without re-validating the caller\u0027s access rights against each related event.\u003c/p\u003e\u003cp\u003eThe correlation table stores a snapshot of the event\u0027s distribution level and sharing group at the time the correlation was created, and does not carry the published flag. As a result, events that the caller is not permitted to open\u2014because they are unpublished, or because their distribution or sharing group has changed since the correlation was recorded\u2014were still returned with their metadata (title, date, correlating value counts).\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- An authenticated user with access to at least one event in MISP.\u003c/p\u003e\u003cp\u003e- The existence of correlation entries linking that event to other events the user should not be able to view.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Unauthorized disclosure of event metadata (titles, dates, correlation counts) for events the user has no right to access.\u003c/p\u003e\u003cp\u003e- Potential reconnaissance of threat-intelligence event names and timelines across sharing groups.\u003c/p\u003e\u003cp\u003eAffected: MISP versions prior to the fix commit (2ffa97f05).\u003c/p\u003e"
            }
          ],
          "value": "MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved related event metadata directly from the correlation table without re-validating the caller\u0027s access rights against each related event.\n\nThe correlation table stores a snapshot of the event\u0027s distribution level and sharing group at the time the correlation was created, and does not carry the published flag. As a result, events that the caller is not permitted to open\u2014because they are unpublished, or because their distribution or sharing group has changed since the correlation was recorded\u2014were still returned with their metadata (title, date, correlating value counts).\n\nPreconditions:\n\n- An authenticated user with access to at least one event in MISP.\n\n- The existence of correlation entries linking that event to other events the user should not be able to view.\n\nImpact:\n\n- Unauthorized disclosure of event metadata (titles, dates, correlation counts) for events the user has no right to access.\n\n- Potential reconnaissance of threat-intelligence event names and timelines across sharing groups.\n\nAffected: MISP versions prior to the fix commit (2ffa97f05)."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Leverage Trusted Relationship"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-02T15:59:27Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T16:01:32.781Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/2ffa97f05"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix enforces proper per-event authorization on the related events query by applying the user\u0027s full access-control conditions (including published status, distribution level, and sharing group membership) to the event lookup, rather than relying solely on the stale distribution snapshot stored in the correlation table. This ensures that only events the caller is currently permitted to read are returned in the related events list.\u003c/p\u003e"
            }
          ],
          "value": "The fix enforces proper per-event authorization on the related events query by applying the user\u0027s full access-control conditions (including published status, distribution level, and sharing group membership) to the event lookup, rather than relying solely on the stale distribution snapshot stored in the correlation table. This ensures that only events the caller is currently permitted to read are returned in the related events list."
        }
      ],
      "title": "MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The tag_version_boundary (v2.5.48, 50 commits after fix) is used as an approximate upper bound for affected versions; exact version boundaries are not explicitly stated in the patch metadata.",
                  "PR:L assumes the attacker needs only a basic authenticated MISP account with access to at least one event; higher-privilege roles may be required depending on deployment configuration, but the patch does not specify this.",
                  "VC:L assumes the disclosed metadata (event titles, dates, correlation counts) constitutes a low confidentiality impact; in highly sensitive threat-intelligence environments the impact could be rated higher.",
                  "CAPEC-126 is the closest available mapping; no CAPEC precisely describes authorization bypass via a stale snapshot in a correlation/join table.",
                  "The \u0027published\u0027 flag and distribution/sharing group checks are assumed to be the primary authorization mechanisms in MISP\u0027s event model, based on the commit message and patch context.",
                  "No public exploit or active exploitation is assumed; the patch does not reference any CVE, advisory, or exploitation evidence."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The attacker leverages the trusted correlation relationship stored in the correlation table. The system treated the correlation entry as a sufficient authorization basis, but the snapshot data was stale and incomplete (missing published flag), allowing access to event metadata the caller should not see. This is the closest CAPEC to the pattern of relying on a trusted data source that does not reflect current authorization state. Uncertainty: no CAPEC perfectly describes \u0027stale authorization snapshot in a join table\u0027; CAPEC-126 is the best available match."
                  }
                ],
                "commit": "2ffa97f0526cd6579b91a4dea560f6246ecbe108",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Wenhao Wu"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: An authenticated user simply requests the related events endpoint; no race condition or complex manipulation is needed. AT:N: No attack-target manipulation required. PR:L: Requires a low-privilege authenticated user with access to at least one event. UI:N: No user interaction needed. VC:L: Disclosure is limited to event metadata (title, date, correlation counts), not full event content or attributes. VI:N, VA:N: No integrity or availability impact. SC:N, SI:N, SA:N: No secondary impacts on other systems. The overall score reflects a low-severity information disclosure requiring authentication.",
                "fixSummary": "The fix enforces proper per-event authorization on the related events query by applying the user\u0027s full access-control conditions (including published status, distribution level, and sharing group membership) to the event lookup, rather than relying solely on the stale distribution snapshot stored in the correlation table. This ensures that only events the caller is currently permitted to read are returned in the related events list.",
                "generatedAt": "2026-10-02T15:59:27.212571Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 6,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "c315cbcd2cad3e0a5886680a4c6a903d9ed5f3fe3893670f74786cea77a56eb3",
                "patchSummary": "In EventsController.php (viewRelatedEvents) and Event.php (getRelatedEvents), the query that fetches related event metadata previously used only Event.id IN (relatedEventIds) as the condition. The patch replaces this with a call to createEventConditions($user), which builds the full set of authorization conditions (published flag, distribution, sharing group), and then adds the Event.id filter on top. The stale comment claiming ACL was enforced via the correlation table was removed. Two files changed, 8 insertions, 9 deletions.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "2ffa97f0526cd6579b91a4dea560f6246ecbe108",
                    "date": "Tue, 22 Sep 2026 15:14:32 +0200",
                    "patchSha256": "c315cbcd2cad3e0a5886680a4c6a903d9ed5f3fe3893670f74786cea77a56eb3",
                    "source": "https://github.com/MISP/MISP/commit/2ffa97f05.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/2ffa97f05.patch",
                    "subject": "fix: [security] Scope the related event list to what the"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/2ffa97f05.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-02T15:59:27Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [security] Scope the related event list to what the",
                "tagVersionBoundary": {
                  "commits_after_fix": 50,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The related events query did not apply the caller\u0027s per-event authorization checks (published status, distribution, sharing group). The system relied on a stale snapshot in the correlation table instead of re-validating access, effectively omitting the authorization step for the returned events."
                  },
                  {
                    "cweId": "CWE-285",
                    "rationale": "Even though some authorization existed (via the correlation table snapshot), it was based on outdated data and lacked the published flag check, making the authorization decision incorrect for events whose access parameters had changed or that were unpublished."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (2ffa97f0526cd6579b91a4dea560f6246ecbe108): fix: [security] Scope the related event list to what the",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/2ffa97f05.patch"
                    ],
                    "timestamp": "2026-09-22T13:14:32Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20165"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-104910",
    "datePublished": "2026-10-02T16:01:32.781Z",
    "dateReserved": "2026-10-02T16:01:26.599Z",
    "dateUpdated": "2026-10-03T15:52:56.095Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104742",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-11T16:41:16.167246Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-11T16:55:18.071Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AI Puffer \u2013 AI Chatbot, AI Writer \u0026 Automation",
          "vendor": "senols",
          "versions": [
            {
              "lessThanOrEqual": "2.4.89",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The AI Puffer \u2013 Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify global site-wide semantic search settings, including vector provider, embedding provider, embedding model, target ID, number of results, and no-results text stored in aipkit_options, that are otherwise restricted to administrators. Exploitation requires that an administrator has previously granted the Knowledge Base (\u0027sources\u0027) module to the attacker\u0027s role via the Role Manager, as this access is not available to lower-privileged users by default."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T05:30:57.680Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/58967ac0-d6f7-4cc7-a2e3-4594aa4b2be2?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/dashboard/ajax/class-aipkit-settings-ajax-handler.php#L137"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/dashboard/ajax/class-aipkit-settings-ajax-handler.php#L790"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/dashboard/ajax/class-aipkit-base-dashboard-ajax-handler.php#L53"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/dashboard/class-aipkit_role_manager.php#L275"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3725365%40gpt3-ai-content-generator\u0026new=3725365%40gpt3-ai-content-generator"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T18:07:36.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-09T17:12:20.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "AI Puffer \u003c= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104742",
    "datePublished": "2026-10-10T05:30:57.680Z",
    "dateReserved": "2026-10-02T11:55:04.789Z",
    "dateUpdated": "2026-10-11T16:55:18.071Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104741",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-11T16:41:03.547230Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-11T16:55:18.339Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AI Puffer \u2013 AI Chatbot, AI Writer \u0026 Automation",
          "vendor": "senols",
          "versions": [
            {
              "lessThanOrEqual": "2.4.89",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The AI Puffer \u2013 Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify global plugin indexing and vector-search configuration options (aipkit_training_general_settings and aipkit_indexing_field_settings), including chunking parameters, file upload visibility, and per-CPT field indexing settings, affecting all users of the plugin. This is only exploitable in configurations where an administrator has granted \u0027sources\u0027 module access to a lower-privileged role via the plugin\u0027s Role Manager."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T05:30:56.935Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/25ae6c7d-a03c-43f6-9c46-8797a9765d04?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/core/ajax/class-aipkit-core-ajax-handler.php#L883"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/core/ajax/class-aipkit-core-ajax-handler.php#L737"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/dashboard/ajax/class-aipkit-base-dashboard-ajax-handler.php#L53"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/core/ajax/class-aipkit-core-ajax-handler.php#L950"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3725365%40gpt3-ai-content-generator\u0026new=3725365%40gpt3-ai-content-generator"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T18:07:35.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-09T17:11:47.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "AI Puffer \u003c= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104741",
    "datePublished": "2026-10-10T05:30:56.935Z",
    "dateReserved": "2026-10-02T11:54:29.123Z",
    "dateUpdated": "2026-10-11T16:55:18.339Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104728",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-11T16:40:10.050228Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-11T16:55:15.624Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AutomatorWP \u2013 No-Code Workflow Automation, Integration \u0026 Webhooks Plugin, now with AI",
          "vendor": "rubengc",
          "versions": [
            {
              "lessThanOrEqual": "5.8.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The AutomatorWP \u2013 No-Code Workflow Automation, Integration \u0026 Webhooks Plugin, now with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate all Fluent Forms records, including form IDs and titles, from the fluentform_forms database table."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T07:41:46.607Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a5d421d0-4658-4203-8c74-2eb744ea34be?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/integrations/fluentform/includes/ajax-functions.php#L16"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/integrations/fluentform/includes/ajax-functions.php#L48"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/includes/scripts.php#L161"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3656285"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-09T19:31:43.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "AutomatorWP \u003c= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104728",
    "datePublished": "2026-10-10T07:41:46.607Z",
    "dateReserved": "2026-10-02T11:47:04.862Z",
    "dateUpdated": "2026-10-11T16:55:15.624Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104675",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-05T12:51:09.283877Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-05T12:51:51.503Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "event-tickets",
          "product": "Event Tickets",
          "vendor": "Liquid Web / StellarWP",
          "versions": [
            {
              "changes": [
                {
                  "at": "5.30.0.1",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "5.30.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Intrudify | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-05T08:50:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Event Tickets: from n/a through 5.30.0.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-05T08:50:46.064Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/event-tickets/vulnerability/wordpress-event-tickets-plugin-5-30-0-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Event Tickets plugin to the latest available version (at least 5.30.0.1)."
            }
          ],
          "value": "Update the WordPress Event Tickets plugin to the latest available version (at least 5.30.0.1)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress Event Tickets plugin \u003c= 5.30.0 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-104675",
    "datePublished": "2026-10-05T08:50:46.064Z",
    "dateReserved": "2026-10-02T08:00:40.759Z",
    "dateUpdated": "2026-10-05T12:51:51.503Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104660",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T14:25:10.301436Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T14:25:20.499Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "hMailServer",
          "repo": "https://gitlab.com/hmailserver/hmailserver",
          "vendor": "Progressive Robot Ltd",
          "versions": [
            {
              "lessThan": "6.3.6",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Found in the hMailServer project\u0027s own security review (Progressive Robot Ltd)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCOM access or launch permission and calls CoInitializeSecurity with no security descriptor, so any user logged on at the console or over Remote Desktop can activate the classes in the running service; a hMailServer.Message, its Attachments and Attachment, and a hMailServer.FetchAccount created this way carry a credential that never authenticated. Attachments.Add(path) and Attachment.SaveAs(path) performed no authorization check, and Message.Save/Copy and FetchAccount.AccountID/Save performed none either up to 6.3.3 and from 6.3.4 treated a holder with no credential as the server\u0027s own event-script host. Because the service does not impersonate the COM caller, Attachments.Add reads any file the service account can read and returns it, Attachment.SaveAs writes attacker-chosen bytes to any path it can write (on a LocalSystem installation, code execution as SYSTEM), Message.Save queues outbound mail from any address past the SMTP checks, and FetchAccount attaches a mail-fetch job to any mailbox. The objects an Application handed out behave the same once a later Authenticate on that Application fails."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T10:52:50.630Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/59"
        },
        {
          "url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to hMailServer 6.3.6, whose COM API refuses a message or fetch account that carries no credential outside the server\u0027s own event scripts, serves and writes a file on the server\u0027s disk through a message to the server administrator alone, and adds Application.CreateMessage() so a signed-in program composes mail that carries its credential. Until then: Do not allow untrusted users to log on interactively (console or Remote Desktop) to the server host. There is no configuration switch that closes this before 6.3.6; restricting the DCOM AppID\u0027s launch/access permission to exclude INTERACTIVE would also close it."
        }
      ],
      "title": "Missing Authorization in hMailServer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2026-104660",
    "datePublished": "2026-10-08T10:52:50.630Z",
    "dateReserved": "2026-10-02T07:39:04.118Z",
    "dateUpdated": "2026-10-08T14:25:20.499Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104472",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T14:08:58.660765Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T14:09:06.224Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-7cj2-9pgf-vcw2"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "yeswiki",
          "vendor": "YesWiki",
          "versions": [
            {
              "lessThan": "4.6.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.6.7",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "sondt99"
        }
      ],
      "datePublic": "2026-09-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from read-restricted pages."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T11:38:36.710Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-7cj2-9pgf-vcw2)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-7cj2-9pgf-vcw2"
        },
        {
          "name": "VulnCheck Advisory: YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-missing-authorization-via-attachment-download-handler"
        }
      ],
      "title": "YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-104472",
    "datePublished": "2026-10-02T11:38:36.710Z",
    "dateReserved": "2026-10-02T00:55:58.387Z",
    "dateUpdated": "2026-10-02T14:09:06.224Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}