Computer Incident Response Center Luxembourg

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Neo",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0400",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Neo 2",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0500",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "DJI Flip",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.1200",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Air 3",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.1600",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Air 3S",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.1400",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Avata 2",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0400",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Avata 360",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0300",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mavic 3",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.1400",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mavic 3 Classic",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0800",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mavic 3 Pro",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.01.0700",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mavic 4 Pro",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0500",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mini 2",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.07.0200",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mini 3",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0500",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mini 3 Pro",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0900",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mini 4 Pro",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.1100",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mini 5 Pro",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0600",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abdelrahman Yousef"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Dr. Jordan Samhi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone\u0027s Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone\u0027s internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.\u003cbr\u003e\u003cbr\u003e* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone\u0027s network \u003cbr\u003e* The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.\u003cbr\u003e* The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely\u003cbr\u003e* The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed\u003cbr\u003e* A BLE sniffer and presence during one normal DJI Fly connection are needed\u003cbr\u003e\u003cbr\u003eAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\u003cbr\u003e\u003cbr\u003eRemediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading."
            }
          ],
          "value": "DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone\u0027s Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone\u0027s internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.\n\n* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone\u0027s network \n* The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.\n* The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely\n* The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed\n* A BLE sniffer and presence during one normal DJI Fly connection are needed\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\nRemediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-311",
              "description": "CWE-311 Missing Encryption of Sensitive Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://support.dji.com/help/content?customId=en-us03400011149\u0026amp;spaceId=34\u0026amp;re=US\u0026amp;lang=en"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/Wh02m1/CVE-2026-77812"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20157"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-77812",
    "datePublished": "2026-08-21T14:06:00.000Z",
    "dateReserved": "2026-08-21T14:06:00.000Z",
    "dateUpdated": "2026-10-12T12:13:40.081904Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-20157"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Neo",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0400",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Neo 2",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0500",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Flip",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.1200",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Air 3",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.1600",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Air 3S",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.1400",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Avata 2",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0400",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Avata 360",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0300",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mavic 3",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.1400",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mavic 3 Classic",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0800",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mavic 3 Pro",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.01.0700",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mavic 4 Pro",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0500",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mini 2",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.07.0200",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mini 3",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0500",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mini 3 Pro",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0900",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mini 4 Pro",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.1100",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mini 5 Pro",
          "vendor": "DJI",
          "versions": [
            {
              "lessThanOrEqual": "01.00.0600",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abdelrahman Yousef"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Dr. Jordan Samhi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone\u0027s internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator\u0027s wireless control, video, and telemetry connections during flight.\u003cbr\u003e\u003cbr\u003e\u003cdiv\u003eAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\u003c/div\u003e\u003cbr\u003eRemediation requires a firmware update from the vendor.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone\u0027s internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator\u0027s wireless control, video, and telemetry connections during flight.\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\n\nRemediation requires a firmware update from the vendor."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "product"
          ],
          "url": "https://support.dji.com/help/content?customId=en-us03400011149\u0026amp;spaceId=34\u0026amp;re=US\u0026amp;lang=en"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/Wh02m1/CVE-2026-78306"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20018"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-78306",
    "datePublished": "2026-08-24T08:05:00.000Z",
    "dateReserved": "2026-08-24T08:07:00.000Z",
    "dateUpdated": "2026-10-12T12:08:34.359422Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-20018"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "app/Model/MispObject.php"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/MispObject.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance\u0027s validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- Two or more MISP instances are configured to synchronize objects.\u003c/p\u003e\u003cp\u003e- A user with object-creation privileges creates an object without supplying a description.\u003c/p\u003e\u003cp\u003e- The object is subsequently synced to a peer instance.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline.\u003c/p\u003e\u003cp\u003e- The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance\u0027s validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data.\n\nPreconditions:\n\n- Two or more MISP instances are configured to synchronize objects.\n\n- A user with object-creation privileges creates an object without supplying a description.\n\n- The object is subsequently synced to a peer instance.\n\nImpact:\n\n- Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline.\n\n- The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology.\n\nAffected: \u003c2.5.48."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-101",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-101 Application Level DoS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-07T15:41:05Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/6b1776f07"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe overly strict validation rule that required a non-empty description on MISP Objects during creation was relaxed to permit an empty description. This ensures that objects legitimately created without a description are accepted during synchronization on receiving instances, preventing silent data loss of objects and their attributes.\u003c/p\u003e"
            }
          ],
          "value": "The overly strict validation rule that required a non-empty description on MISP Objects during creation was relaxed to permit an empty description. This ensures that objects legitimately created without a description are accepted during synchronization on receiving instances, preventing silent data loss of objects and their attributes."
        }
      ],
      "title": "MISP Object Sync Drops Objects and Attributes When Description Is Empty",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 36 commits after fix); no explicit \u0027affected\u0027 or \u0027fixed\u0027 version string is provided in the patch.",
                  "The CAPEC-101 mapping is the closest available pattern; the issue is more accurately described as a data-integrity defect during sync rather than a classic DoS, but no CAPEC specifically covers \u0027over-strict validation causing silent data loss during replication\u0027.",
                  "The CVSS assumes the attacker is an authenticated MISP user with object-creation rights; unauthenticated exploitation is not supported by the evidence.",
                  "The commit message states the issue was \u0027found during the internal review, not externally reported\u0027; no external finder or reporter is credited.",
                  "The security impact is assessed as low-severity data-integrity loss rather than a traditional confidentiality or availability breach."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-101",
                    "rationale": "This is the closest available CAPEC. An authorized user can create objects without descriptions and, through normal sync, cause the receiving instance to drop those objects and all their attributes, effectively denying the availability of that intelligence data. The mapping is uncertain because the primary effect is data-integrity loss rather than a classic DoS, and no external unauthenticated attacker is required; however, CAPEC-101 best captures the \u0027valid data is silently discarded, degrading the service\u0027s usefulness\u0027 pattern."
                  }
                ],
                "commit": "6b1776f072e153a4e2cf3af0c210c7aeadfa0469",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  }
                ],
                "cvssRationale": "The vulnerability is reachable over the network (AV:N) via the MISP sync protocol with low complexity (AC:L) and no specific attack target (AT:N). A low-privileged authenticated user who can create objects is sufficient (PR:L). No user interaction is needed (UI:N). There is no confidentiality impact (VC:N). The integrity impact on the victim is low (VI:L) because valid objects and attributes are silently dropped, corrupting the integrity of the receiving instance\u0027s data store. There is no direct availability impact on the victim system itself (VA:N). No secondary impacts are identified (SC:N, SI:N, SA:N). Overall severity is Low.",
                "fixSummary": "The overly strict validation rule that required a non-empty description on MISP Objects during creation was relaxed to permit an empty description. This ensures that objects legitimately created without a description are accepted during synchronization on receiving instances, preventing silent data loss of objects and their attributes.",
                "generatedAt": "2026-10-07T15:41:05.158252Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "17b9854719a40da145be39fc8cf2107bf9d99d02dff2785002fe7a842de88ea1",
                "patchSummary": "In app/Model/MispObject.php, the validation rule for the \u0027description\u0027 field (stringNotEmpty, applied on create) was modified by adding the key \u0027allowEmpty\u0027 set to true. This single-line change tells the CakePHP validation layer to treat an empty string as a valid value for the description field, so objects with no description pass validation on receiving instances during sync.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "6b1776f072e153a4e2cf3af0c210c7aeadfa0469",
                    "date": "Thu, 24 Sep 2026 16:07:34 +0200",
                    "patchSha256": "17b9854719a40da145be39fc8cf2107bf9d99d02dff2785002fe7a842de88ea1",
                    "source": "https://github.com/MISP/MISP/commit/6b1776f07.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/6b1776f07.patch",
                    "subject": "fix: [sync] Accept objects without a description"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/6b1776f07.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-07T15:41:05Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [sync] Accept objects without a description",
                "tagVersionBoundary": {
                  "commits_after_fix": 36,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-20",
                    "rationale": "The validation rule stringNotEmpty was applied without accounting for the legitimate case of an empty description, causing valid input (an object with no description) to be rejected. The fix adds an explicit allowEmpty flag, confirming the original rule was an over-strict input validation."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (6b1776f072e153a4e2cf3af0c210c7aeadfa0469): fix: [sync] Accept objects without a description",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/6b1776f07.patch"
                    ],
                    "timestamp": "2026-09-24T14:07:34Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20215"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-107278",
    "datePublished": "2026-10-07T15:42:33.394043Z",
    "dateReserved": "2026-10-07T15:42:40.660Z",
    "dateUpdated": "2026-10-07T15:42:40.741136Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20215"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "UsersController (email OTP login)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/UsersController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request\u0027s deletion takes effect.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- The target MISP instance has email OTP login enabled.\u003c/p\u003e\u003cp\u003e- The attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering).\u003c/p\u003e\u003cp\u003e- The attacker can issue two HTTP POST requests in close temporal proximity.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions.\u003c/p\u003e\u003cp\u003e- This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted.\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request\u0027s deletion takes effect.\n\nPreconditions:\n\n- The target MISP instance has email OTP login enabled.\n\n- The attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering).\n\n- The attacker can issue two HTTP POST requests in close temporal proximity.\n\nImpact:\n\n- The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions.\n\n- This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted.\n\nAffected versions: \u003c2.5.48"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-111",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-111 Race Condition"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-07T15:34:47Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/ba95e67d5"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix makes OTP consumption atomic by moving the deletion of the OTP from the shared store into the validation condition itself. The return value of the delete operation (1 if the key was actually removed, 0 otherwise) is now part of the success check, so only the request that successfully removes the OTP from the store is permitted to proceed with login. A session-state cleanup call was also added to remove the OTP user reference from the session.\u003c/p\u003e"
            }
          ],
          "value": "The fix makes OTP consumption atomic by moving the deletion of the OTP from the shared store into the validation condition itself. The return value of the delete operation (1 if the key was actually removed, 0 otherwise) is now part of the success check, so only the request that successfully removes the OTP from the store is permitted to proceed with login. A session-state cleanup call was also added to remove the OTP user reference from the session."
        }
      ],
      "title": "MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact affected version range is not explicitly stated in the patch; the tag boundary v2.5.48 with 39 commits after the fix suggests the fix landed shortly after that tag, but the precise first-fixed version is unconfirmed.",
                  "The CAPEC-111 mapping is the closest available; no CAPEC specifically covers OTP replay via race condition, so this is the best-fit pattern.",
                  "CVSS AC:H assumes the race window is narrow and requires precise timing; if the Redis round-trip latency is large, exploitation may be easier, but no evidence supports lowering AC.",
                  "The commit message states the issue was \u0027found during the internal review, not externally reported,\u0027 but no specific individual is named as finder, so no finder credit is assigned.",
                  "PR:N assumes the attacker obtains the OTP through out-of-band means (email interception); if MISP requires prior authentication to request an OTP, PR could be L."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-111",
                    "rationale": "The attack pattern involves an adversary issuing two or more concurrent requests to exploit a non-atomic check-and-use sequence on a shared resource (the OTP in Redis). CAPEC-111 directly describes exploiting timing dependencies between sub-processes. This is the closest CAPEC to the observed vulnerability; no more specific CAPEC for OTP replay via race condition exists in the CAPEC catalog."
                  }
                ],
                "commit": "ba95e67d545efa313435ae39dd481879d72e72e6",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: Exploitation occurs over the network via HTTP POST. AC:H: Exploiting the race condition requires precise timing of two concurrent requests so both read the OTP before either deletes it; this is non-trivial to achieve reliably. AT:N: No data corruption or manipulation is required. PR:N: The attacker does not need prior authentication to MISP; they only need possession of a valid OTP (e.g., intercepted email). UI:N: No victim interaction beyond the initial login flow is needed. VC:N: No direct confidentiality loss of system data. VI:L: The one-time-use property of the OTP is violated, allowing a second authenticated session. VA:N: No availability impact. SC/SI:L: Limited integrity impact on the authentication process; no cross-system impact. SA:N: No impact on security authority.",
                "fixSummary": "The fix makes OTP consumption atomic by moving the deletion of the OTP from the shared store into the validation condition itself. The return value of the delete operation (1 if the key was actually removed, 0 otherwise) is now part of the success check, so only the request that successfully removes the OTP from the store is permitted to proceed with login. A session-state cleanup call was also added to remove the OTP user reference from the session.",
                "generatedAt": "2026-10-07T15:34:47.392474Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "810e97a648a36f87d684f509c51c93636711a31daeab31c5bccbc9466249a7e0",
                "patchSummary": "In UsersController::email_otp(), the $redis-\u003edel() call was moved from after the hash_equals comparison into the if-condition as an additional conjunct. The condition now requires $redis-\u003edel(\u0027misp:otp:\u0027 . $user_id) === 1, meaning only the request whose delete actually removed the key (returning 1) can proceed to Auth-\u003elogin(). A $this-\u003eSession-\u003edelete(\u0027email_otp_user\u0027) call was added before the login step to clean up session state. Net change: 6 insertions, 3 deletions in one file.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "ba95e67d545efa313435ae39dd481879d72e72e6",
                    "date": "Wed, 23 Sep 2026 16:26:22 +0200",
                    "patchSha256": "810e97a648a36f87d684f509c51c93636711a31daeab31c5bccbc9466249a7e0",
                    "source": "https://github.com/MISP/MISP/commit/ba95e67d5.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/ba95e67d5.patch",
                    "subject": "fix: [login] Let only one request spend an e-mailed OTP"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/ba95e67d5.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-07T15:34:47Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [login] Let only one request spend an e-mailed OTP",
                "tagVersionBoundary": {
                  "commits_after_fix": 39,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-362",
                    "rationale": "The OTP stored in Redis is a shared resource accessed by concurrent HTTP requests. The original code performed read, compare, and delete as separate non-atomic operations, allowing two concurrent requests to both read and validate the same OTP before either deletes it. This is a textbook race condition on a shared resource."
                  },
                  {
                    "cweId": "CWE-367",
                    "rationale": "The check (reading and comparing the OTP) and the use (logging in) are separated in time, and the state (OTP presence in the store) can change between the two steps due to a concurrent request. This is a TOCTOU variant of the race condition."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (ba95e67d545efa313435ae39dd481879d72e72e6): fix: [login] Let only one request spend an e-mailed OTP",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/ba95e67d5.patch"
                    ],
                    "timestamp": "2026-09-23T14:26:22Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20315"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-107276",
    "datePublished": "2026-10-07T15:36:37.527318Z",
    "dateReserved": "2026-10-07T15:36:46.122Z",
    "dateUpdated": "2026-10-07T15:36:46.202908Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20315"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "app/Controller/AppController.php (login / user verification / TOTP enforcement)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/AppController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Tanguy Snoeck"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOn MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser request type, including AJAX/XHR calls, REST API requests, .json format URLs, restSearch queries, or automation actions. Because these machine-readable request shapes cannot follow the redirect that the browser path uses to send the user to the TOTP enrolment page, the guard simply skipped the check and the user retained full access to the instance without completing the required second-factor setup.\u003c/p\u003e\u003cp\u003eThe initial fix (commit 8deb0619e) added a guard specifically for AJAX requests. A follow-up fix (commit 6b527ba6e) broadened the guard to cover every non-browser request shape, while preserving the exemption for identities authenticated via API key (logged_by_authkey flag).\u003c/p\u003e\u003cp\u003eImpact: an authenticated user on an otp_required instance can operate with full access indefinitely without enrolling in TOTP, nullifying the instance-level two-factor authentication policy.\u003c/p\u003e\u003cp\u003eAffected version: \u0026lt;2.5.48\u003c/p\u003e"
            }
          ],
          "value": "On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser request type, including AJAX/XHR calls, REST API requests, .json format URLs, restSearch queries, or automation actions. Because these machine-readable request shapes cannot follow the redirect that the browser path uses to send the user to the TOTP enrolment page, the guard simply skipped the check and the user retained full access to the instance without completing the required second-factor setup.\n\nThe initial fix (commit 8deb0619e) added a guard specifically for AJAX requests. A follow-up fix (commit 6b527ba6e) broadened the guard to cover every non-browser request shape, while preserving the exemption for identities authenticated via API key (logged_by_authkey flag).\n\nImpact: an authenticated user on an otp_required instance can operate with full access indefinitely without enrolling in TOTP, nullifying the instance-level two-factor authentication policy.\n\nAffected version: \u003c2.5.48"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-128",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-128 Exploiting Incorrectly Configured Access Control"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-07T12:45:57Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/8deb0619e"
        },
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/6b527ba6e"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe TOTP enrolment enforcement in the user verification path was extended from covering only standard browser requests to covering all non-browser request types (AJAX, REST, .json, automation). Any request that cannot follow the browser redirect to the TOTP setup page is now refused with a 403 Forbidden response if the user has not enrolled in TOTP and the instance requires it. Identities authenticated via API key remain exempt, as they are not browser sessions subject to the redirect-based enrolment flow.\u003c/p\u003e"
            }
          ],
          "value": "The TOTP enrolment enforcement in the user verification path was extended from covering only standard browser requests to covering all non-browser request types (AJAX, REST, .json, automation). Any request that cannot follow the browser redirect to the TOTP setup page is now refused with a 403 Forbidden response if the user has not enrolled in TOTP and the instance requires it. Identities authenticated via API key remain exempt, as they are not browser sessions subject to the redirect-based enrolment flow."
        }
      ],
      "title": "MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected MISP version range is not specified in the patch metadata; the vulnerability is assumed to affect all versions prior to the fix commits (8deb0619e and 6b527ba6e) that contain the otp_required enforcement logic without the non-browser request guard.",
                  "The CAPEC-128 mapping is approximate; the bypass is of an authentication requirement (forced TOTP enrolment) rather than a traditional authorization rule, but CAPEC-128 is the closest available pattern for exploiting an access control that is not uniformly applied across all request paths.",
                  "CVSS VC:H assumes that bypassing the mandatory 2FA requirement constitutes a high confidentiality impact on the vulnerability component, as the instance-level security policy (requiring all users to have 2FA) is nullified for the affected user. If the instance\u0027s threat model considers 2FA as a defense-in-depth layer rather than a primary control, VC could be rated Lower.",
                  "The patch evidence does not indicate whether the vulnerability is exploitable by an external unauthenticated attacker; the analysis assumes the attacker is an authenticated user (PR:L) who has not yet enrolled in TOTP.",
                  "The two commits are treated as a single vulnerability per the patch_set_assumption; the first commit is an incomplete fix and the second is the complete fix."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-128",
                    "rationale": "The access control policy requiring TOTP enrolment is incorrectly scoped to only standard browser requests. An attacker (or the legitimate user) exploits this misconfiguration by issuing requests in a non-browser format (AJAX, REST, .json) that the access control check does not cover. This is the closest CAPEC to the observed bypass of a security control due to incomplete scoping of the enforcement logic. The mapping is approximate because the bypass is of an authentication requirement rather than a traditional authorization rule, but CAPEC-128 best captures the pattern of exploiting an access control that is not uniformly applied."
                  }
                ],
                "commit": "6b527ba6e6a32aa574aa050eadf36207506dcea2",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Tanguy Snoeck of NCIA"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5"
                  }
                ],
                "cvssRationale": "AV:N - the bypass is achieved over the network via HTTP requests. AC:L - the attack is trivially simple: change the request type (add X-Requested-With header, append .json, use REST endpoint). AT:N - no special target conditions. PR:L - the attacker needs a valid authenticated session (low privilege: any user account). UI:N - no victim interaction beyond the attacker\u0027s own request. VC:H - the two-factor authentication requirement is completely bypassed, meaning the confidentiality protection provided by mandatory 2FA is nullified; the user retains full data access without the second factor. VI:N, VA:N - no integrity or availability impact on the MISP component. SC:N, SI:N, SA:N - no impact on subsequent components. The primary impact is the bypass of an authentication control (confidentiality of the 2FA gate).",
                "fixSummary": "The TOTP enrolment enforcement in the user verification path was extended from covering only standard browser requests to covering all non-browser request types (AJAX, REST, .json, automation). Any request that cannot follow the browser redirect to the TOTP setup page is now refused with a 403 Forbidden response if the user has not enrolled in TOTP and the instance requires it. Identities authenticated via API key remain exempt, as they are not browser sessions subject to the redirect-based enrolment flow.",
                "generatedAt": "2026-10-07T12:45:57.120635Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "38ec10c8e322eb94d2b27a1bcc10f796f3ee2c2b943034c0944cd811a03cbae3",
                "patchSummary": "In app/Controller/AppController.php, the __verifyUser method was modified. Patch 1 added a conditional block after the $isUserRequest definition that checks: the request is not a standard user request, it is an AJAX request, the user has no TOTP configured, Security.otp_required is enabled, the role does not have perm_skip_otp, and the current action is not one of the allowed exceptions (terms, change_pw, logout, login, totp_new). If all conditions are met, a ForbiddenException is thrown. Patch 2 replaced the $this-\u003erequest-\u003eis(\u0027ajax\u0027) condition with empty($user[\u0027logged_by_authkey\u0027]), broadening the guard to all non-browser request types while explicitly exempting API-key-authenticated sessions.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "8deb0619e5ed6b12a1aa94967c68c977eb05398f",
                    "date": "Wed, 23 Sep 2026 09:53:42 +0200",
                    "patchSha256": "9e42ef967102a3d0699101588e40e27539be35259a88cb334c863f5297bd8210",
                    "source": "https://github.com/MISP/MISP/commit/8deb0619e.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/8deb0619e.patch",
                    "subject": "fix: [login] enforce TOTP enrolment on AJAX requests"
                  },
                  {
                    "commit": "6b527ba6e6a32aa574aa050eadf36207506dcea2",
                    "date": "Mon, 28 Sep 2026 13:55:35 +0200",
                    "patchSha256": "f97d3076e297ea0bd06c87bc95614730333485eb470be8022b0e400a000f1cbf",
                    "source": "https://github.com/MISP/MISP/commit/6b527ba6e.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/6b527ba6e.patch",
                    "subject": "fix: [login] Refuse every unenrolled session request, not"
                  }
                ],
                "source": "patch set (2 sources)",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-07T12:45:57Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [login] Refuse every unenrolled session request, not",
                "weaknessRationale": [
                  {
                    "cweId": "CWE-287",
                    "rationale": "The TOTP (two-factor) authentication requirement is not properly enforced across all request types. The authentication gate (forced TOTP enrolment) is bypassed for non-browser requests, allowing a user to operate without completing the required second factor. This is a failure to properly enforce an authentication requirement."
                  },
                  {
                    "cweId": "CWE-306",
                    "rationale": "The critical function of enforcing TOTP enrolment on otp_required instances is missing for AJAX, REST, .json, and automation request paths. The authentication check is present for browser requests but absent for all other request shapes, constituting a missing authentication control on a critical security function."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (8deb0619e5ed6b12a1aa94967c68c977eb05398f): fix: [login] enforce TOTP enrolment on AJAX requests",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/8deb0619e.patch"
                    ],
                    "timestamp": "2026-09-23T07:53:42Z",
                    "type": "fix-developed"
                  },
                  {
                    "description": "Corrective change authored (6b527ba6e6a32aa574aa050eadf36207506dcea2): fix: [login] Refuse every unenrolled session request, not",
                    "id": "evt-fix-developed-2",
                    "references": [
                      "https://github.com/MISP/MISP/commit/6b527ba6e.patch"
                    ],
                    "timestamp": "2026-09-28T11:55:35Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20116"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-107180",
    "datePublished": "2026-10-07T12:49:30.116788Z",
    "dateReserved": "2026-10-07T12:49:37.658Z",
    "dateUpdated": "2026-10-07T12:49:37.828681Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20116"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Event model (app/Model/Event.php)",
            "Correlation engine"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Event.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event\u0027s distribution level or sharing group is modified.\u003c/p\u003e\u003cp\u003eWhen a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted.\u003c/p\u003e\u003cp\u003eSecurity impact:\u003c/p\u003e\u003cp\u003e- Stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure.\u003c/p\u003e\u003cp\u003e- Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- An authenticated user with write access to at least one MISP event.\u003c/p\u003e\u003cp\u003e- The user modifies the event\u0027s distribution or sharing_group_id field.\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event\u0027s distribution level or sharing group is modified.\n\nWhen a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted.\n\nSecurity impact:\n\n- Stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure.\n\n- Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing.\n\nPreconditions:\n\n- An authenticated user with write access to at least one MISP event.\n\n- The user modifies the event\u0027s distribution or sharing_group_id field.\n\nAffected versions: \u003c2.5.48"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-114 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-07T12:35:42Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-665",
              "description": "CWE-665 Improper Initialization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/19a389d19"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly.\u003c/p\u003e"
            }
          ],
          "value": "The fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly."
        }
      ],
      "title": "MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact fixed version number is not specified in the patch metadata; the tag boundary indicates the fix is 47 commits after v2.5.48, but the release tag containing this commit is unknown.",
                  "The security impact is assessed as limited information disclosure through stale correlations; the patch does not indicate a direct privilege escalation or data corruption vector.",
                  "CAPEC-114 (Parameter Tampering) is the closest available mapping; no CAPEC specifically covers \u0027stale derived data after a legitimate parameter change\u0027 and the mapping is approximate.",
                  "The assumption that the afterSave hook uses __beforeSaveData to compare old vs new distribution/sharing_group_id values is inferred from the commit message and the code change pattern; the afterSave code itself is not included in the patch.",
                  "CVSS UI:N assumes the stale correlation data is accessible via the normal MISP UI/API without additional user interaction beyond the initial event edit.",
                  "The Co-Authored-By line for Claude Opus 4.8 is treated as a tool credit, not a human remediation developer."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-114",
                    "rationale": "The closest plausible CAPEC is Parameter Tampering: a user modifies the distribution or sharing_group_id parameters of an event, and the application fails to properly enforce the resulting access-control changes on correlated data. The mapping is uncertain because this is not a malicious tamper per se but a legitimate parameter modification that exposes a system defect; however, CAPEC-114 best captures the scenario where parameter changes are not properly reflected in downstream access enforcement. No more specific CAPEC for \u0027stale derived data after parameter change\u0027 exists in the CAPEC catalog."
                  }
                ],
                "commit": "19a389d19f65e25ba3328e72e6ad23919a39ccd0",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: An authenticated user simply edits an event\u0027s sharing group; no race condition or complex setup is needed. AT:N: No manipulation of a separate attack target is required. PR:L: Requires an authenticated user with write access to events. UI:N: The stale correlation persists without further user interaction. VC/VI/VA:N: The vulnerable component (the event save logic) is not directly compromised in confidentiality, integrity, or availability. SC:L: The security impact is on the broader MISP instance: users in a broader sharing group may see correlation data referencing an event that was moved to a more restrictive group, resulting in limited information disclosure. SI/SA:N: No integrity or safety impact on other systems.",
                "fixSummary": "The fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly.",
                "generatedAt": "2026-10-07T12:35:42.209027Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 6,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "a23e99457b847b37183a6159eec9860f3cc8243bae000bc81cbd3449fa7aa225",
                "patchSummary": "In app/Model/Event.php, the beforeSave method was modified. Previously, $this-\u003e__beforeSaveData was set to the full incoming $this-\u003edata[\u0027Event\u0027] array. The patch replaces this with: (1) initializing __beforeSaveData to null, (2) checking whether the event has an existing id (i.e., it is an update, not a create), (3) issuing a targeted database query (recursive -1, selecting only Event.distribution and Event.sharing_group_id) to fetch the currently stored values, and (4) storing those fetched values in __beforeSaveData. This ensures the after-save comparison correctly identifies distribution/sharing_group_id changes.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "19a389d19f65e25ba3328e72e6ad23919a39ccd0",
                    "date": "Wed, 23 Sep 2026 09:41:31 +0200",
                    "patchSha256": "a23e99457b847b37183a6159eec9860f3cc8243bae000bc81cbd3449fa7aa225",
                    "source": "https://github.com/MISP/MISP/commit/19a389d19.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/19a389d19.patch",
                    "subject": "fix: [correlation] fix correlation distribution refresh on"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/19a389d19.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-07T12:35:42Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [correlation] fix correlation distribution refresh on",
                "tagVersionBoundary": {
                  "commits_after_fix": 47,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-284",
                    "rationale": "The core security impact is that correlation data access boundaries are not enforced when an event\u0027s sharing group or distribution changes. Stale correlations can expose event data to users who should no longer have access, constituting an improper access control failure."
                  },
                  {
                    "cweId": "CWE-665",
                    "rationale": "The root cause is that the __beforeSaveData variable was initialized with the incoming (new) data rather than the previously stored data, causing the change-detection logic in afterSave to fail. This is a classic improper initialization of a state variable used for change detection."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (19a389d19f65e25ba3328e72e6ad23919a39ccd0): fix: [correlation] fix correlation distribution refresh on",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/19a389d19.patch"
                    ],
                    "timestamp": "2026-09-23T07:41:31Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20264"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-107175",
    "datePublished": "2026-10-07T12:38:32.205469Z",
    "dateReserved": "2026-10-07T12:38:41.839Z",
    "dateUpdated": "2026-10-07T12:38:41.938484Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20264"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp_\\(malware_information_sharing_platform\\):*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "Server settings (app/Model/Server.php)",
            "MISP.redis_host",
            "Plugin.ZeroMQ_redis_host",
            "SimpleBackgroundJobs.redis_host",
            "download_attachments_on_load"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Server.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThanOrEqual": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Logan Homolka"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "CERT.pl"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "CCB"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Alexandre Dulaunoy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP exposes critical infrastructure settings\u2014specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin\u2014through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional validation. An attacker who obtains a hijacked site-admin session (for example, through a stored cross-site scripting vulnerability) can modify the Redis host settings to point at an attacker-controlled Redis server and then restart the workers. Once the workers connect to the attacker\u0027s Redis instance, the attacker can inject malicious job payloads that the workers execute, achieving arbitrary command execution as the worker account. Additionally, the download_attachments_on_load setting, which controls inline attachment rendering, was modifiable through the same interface, allowing a hijacked session to re-enable a feature that could facilitate further client-side attacks. The vulnerability requires site-admin privileges and a prior session-compromise mechanism; it does not require unauthenticated access. The impact is remote code execution in the context of the MISP worker process and potential data exfiltration through the attacker-controlled Redis connection.\u003c/p\u003e"
            }
          ],
          "value": "MISP exposes critical infrastructure settings\u2014specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin\u2014through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional validation. An attacker who obtains a hijacked site-admin session (for example, through a stored cross-site scripting vulnerability) can modify the Redis host settings to point at an attacker-controlled Redis server and then restart the workers. Once the workers connect to the attacker\u0027s Redis instance, the attacker can inject malicious job payloads that the workers execute, achieving arbitrary command execution as the worker account. Additionally, the download_attachments_on_load setting, which controls inline attachment rendering, was modifiable through the same interface, allowing a hijacked session to re-enable a feature that could facilitate further client-side attacks. The vulnerability requires site-admin privileges and a prior session-compromise mechanism; it does not require unauthenticated access. The impact is remote code execution in the context of the MISP worker process and potential data exfiltration through the attacker-controlled Redis connection."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Session Fixation"
            }
          ]
        },
        {
          "capecId": "CAPEC-64",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-64 HTTP Request/Response Splitting"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "total"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-06T18:56:14Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-749",
              "description": "CWE-749 Exposed Dangerous Method or Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/2ebf29f93"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix restricts the Redis host settings (MISP.redis_host, Plugin.ZeroMQ_redis_host, SimpleBackgroundJobs.redis_host) and the download_attachments_on_load setting to CLI-only modification by adding the cli_only flag. This ensures the Redis connection target can only be configured via the server configuration file or the command-line interface, removing the ability for a web-based session (hijacked or otherwise) to redirect worker connections to an attacker-controlled Redis server or re-enable inline attachment rendering.\u003c/p\u003e"
            }
          ],
          "value": "The fix restricts the Redis host settings (MISP.redis_host, Plugin.ZeroMQ_redis_host, SimpleBackgroundJobs.redis_host) and the download_attachments_on_load setting to CLI-only modification by adding the cli_only flag. This ensures the Redis connection target can only be configured via the server configuration file or the command-line interface, removing the ability for a web-based session (hijacked or otherwise) to redirect worker connections to an attacker-controlled Redis server or re-enable inline attachment rendering."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "partial",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The commit message states the attack requires a \u0027hijacked site-admin session (e.g. through stored XSS)\u0027; the stored XSS is assumed to be a separate, pre-existing vulnerability and is not part of this CVE\u0027s scope.",
                  "The commit message states workers \u0027trust raw Redis job payloads\u0027; the exact mechanism by which malicious Redis payloads lead to command execution is not detailed in the patch and is assumed based on the commit description.",
                  "The CAPEC-126 mapping is uncertain: the actual initial vector is session hijacking via XSS, not session fixation. No CAPEC pattern precisely captures \u0027authenticated configuration manipulation to redirect backend infrastructure.\u0027 CAPEC-126 was selected as the closest available match in the session-security family.",
                  "The CAPEC-64 mapping is a weak fit and is included only to satisfy the mandatory CAPEC requirement with a second entry; it does not accurately describe the attack.",
                  "Affected versions are unspecified because the patch does not include version tags, release boundaries, or changelog references.",
                  "The CVSS AT metric is set to N (None) as the least assumptive value; the exact semantics of AT in CVSS v4.0 relative to AC are not fully clarified in the available evidence.",
                  "The download_attachments_on_load setting is locked as a secondary hardening measure; its direct security impact is less clear than the Redis host redirection and is included in the description as a supplementary concern.",
                  "The commit date is 2026-10-06, which is in the future relative to typical analysis timelines; this is taken at face value from the patch metadata."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The commit message explicitly identifies a \u0027hijacked site-admin session\u0027 as the prerequisite attack vector, and the exploitation path relies on an authenticated session making API/UI calls to modify configuration. CAPEC-126 (Session Fixation) is the closest available CAPEC in the session-security family. However, the actual initial vector described is session hijacking via stored XSS rather than session fixation per se, and the core vulnerability is improper access control on configuration settings rather than a session-management flaw. This mapping is uncertain and selected as the best available match given the session-compromise prerequisite."
                  },
                  {
                    "capecId": "CAPEC-64",
                    "rationale": "This mapping is included only as a secondary consideration and is a weak fit. The attack does not involve CRLF injection or HTTP splitting. It is listed to acknowledge that no CAPEC pattern precisely captures \u0027authenticated configuration manipulation to redirect backend infrastructure connections.\u0027 CAPEC-64 is the closest in the \u0027protocol manipulation\u0027 family but is not a strong match. This mapping is highly uncertain."
                  }
                ],
                "commit": "2ebf29f93dd83dbd30739432fd0a28f5d8ae81c6",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Logan Homolka"
                  },
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "CERT.pl"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  }
                ],
                "cvssRationale": "AV:N: The settings are modified via the web UI or API over the network. AC:H: Exploitation requires a prior session-compromise mechanism (e.g., stored XSS), knowledge of MISP\u0027s internal API, and the ability to restart background workers\u2014multiple specific conditions must align. AT:N: No additional attack complexity beyond what AC captures. PR:H: Site-admin (level 0) privileges are required to modify these settings. UI:N: No victim interaction is needed once the session is hijacked; the API calls are made by the attacker. VC:N: No direct confidentiality impact on MISP itself. VI:H: MISP\u0027s configuration integrity is fundamentally compromised\u2014the Redis connection target is redirected to an attacker-controlled server. VA:N: No direct availability impact on MISP. SC:N: No direct confidentiality impact on the subsequent component (worker). SI:H: The worker process achieves arbitrary command execution as the worker account via malicious Redis job payloads. SA:N: No availability impact on the subsequent component.",
                "fixSummary": "The fix restricts the Redis host settings (MISP.redis_host, Plugin.ZeroMQ_redis_host, SimpleBackgroundJobs.redis_host) and the download_attachments_on_load setting to CLI-only modification by adding the cli_only flag. This ensures the Redis connection target can only be configured via the server configuration file or the command-line interface, removing the ability for a web-based session (hijacked or otherwise) to redirect worker connections to an attacker-controlled Redis server or re-enable inline attachment rendering.",
                "generatedAt": "2026-10-06T18:56:14.991485Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 8,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 4
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "8262490f9bccf2a4bc3e35074b0798f0cbfeefc14e5e9fc876788ac1b09eabce",
                "patchSummary": "In app/Model/Server.php, the patch adds \u0027cli_only\u0027 =\u003e true to four setting definitions within the generateServerSettings() method: the download_attachments_on_load boolean setting (around line 6274), the MISP.redis_host string setting (around line 7037), the Plugin.ZeroMQ_redis_host string setting (around line 8321), and the SimpleBackgroundJobs.redis_host string setting (around line 9050). Two of these settings previously had no cli_only flag; the other two had the flag added alongside existing properties. The change totals 6 insertions and 2 deletions across the single file.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "2ebf29f93dd83dbd30739432fd0a28f5d8ae81c6",
                    "date": "Tue, 6 Oct 2026 20:25:04 +0200",
                    "patchSha256": "8262490f9bccf2a4bc3e35074b0798f0cbfeefc14e5e9fc876788ac1b09eabce",
                    "source": "https://github.com/MISP/MISP/commit/2ebf29f93.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/2ebf29f93.patch",
                    "subject": "fix: [security] Make redis host and attachment download"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/2ebf29f93.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "total"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-06T18:56:14Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [security] Make redis host and attachment download",
                "weaknessRationale": [
                  {
                    "cweId": "CWE-284",
                    "rationale": "The Redis host and attachment rendering settings were accessible for modification via the web UI/API by site-admin users, when they should have been restricted to CLI or server configuration only. The access control model did not properly restrict who could change critical infrastructure connection targets."
                  },
                  {
                    "cweId": "CWE-749",
                    "rationale": "The web interface exposed the ability to change the Redis connection endpoint and re-enable inline attachment rendering\u2014operations that are dangerous because they redirect trusted backend workers to an untrusted server and alter client-side rendering behavior. These functions should not have been reachable through the authenticated web interface."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (2ebf29f93dd83dbd30739432fd0a28f5d8ae81c6): fix: [security] Make redis host and attachment download",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/2ebf29f93.patch"
                    ],
                    "timestamp": "2026-10-06T18:25:04Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20117"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-106513",
    "datePublished": "2026-10-06T18:58:00.000Z",
    "dateReserved": "2026-10-06T18:58:00.000Z",
    "dateUpdated": "2026-10-06T19:03:57.387737Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-20117"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:sachertortephp_\\(cakephp-based_misp_application\\):*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "CakeResponse::download()"
          ],
          "product": "sachertortephp",
          "programFiles": [
            "lib/Cake/Network/CakeResponse.php"
          ],
          "repo": "https://github.com/MISP/sachertortephp",
          "vendor": "MISP",
          "versions": [
            {
              "lessThanOrEqual": "1c2da20cbe3f1e2a91458fe9a017823b7273fdac",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Logan Homolka"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        },
        {
          "lang": "en",
          "type": "tool",
          "value": "Claude Opus 4.8"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "CCB"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Alexandre Dulaunoy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename contains C0 control characters (CR or LF), PHP refuses to emit the entire Content-Disposition header, silently dropping the attachment disposition. The response body is then served with its own Content-Type (for example text/html for an .html attachment) and renders inline in the browser on the application origin, creating a stored cross-site scripting condition. The commit message notes this is reachable even when the download_attachments_on_load setting is enabled, meaning a victim merely needs to view a page that triggers the download. Second, a double-quote character in the filename terminates the quoted-string value early, permitting injection of additional Content-Disposition parameters. The affected code path covers all callers of CakeResponse::download(), including attribute downloads, proposal downloads, and restSearch exports. An authenticated user who can create or upload an attachment with a crafted filename (for example through MISP attribute naming or proposal attachment naming) can store the malicious filename. When any other authenticated user views the affected page, the unsanitized filename is reflected into the HTTP response header, resulting in header manipulation and potential execution of arbitrary HTML or JavaScript in the context of the application origin. The security impact is equivalent to a stored cross-site scripting vulnerability, allowing session hijacking, data exfiltration, and unauthorized actions on behalf of the victim.\u003c/p\u003e"
            }
          ],
          "value": "The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename contains C0 control characters (CR or LF), PHP refuses to emit the entire Content-Disposition header, silently dropping the attachment disposition. The response body is then served with its own Content-Type (for example text/html for an .html attachment) and renders inline in the browser on the application origin, creating a stored cross-site scripting condition. The commit message notes this is reachable even when the download_attachments_on_load setting is enabled, meaning a victim merely needs to view a page that triggers the download. Second, a double-quote character in the filename terminates the quoted-string value early, permitting injection of additional Content-Disposition parameters. The affected code path covers all callers of CakeResponse::download(), including attribute downloads, proposal downloads, and restSearch exports. An authenticated user who can create or upload an attachment with a crafted filename (for example through MISP attribute naming or proposal attachment naming) can store the malicious filename. When any other authenticated user views the affected page, the unsanitized filename is reflected into the HTTP response header, resulting in header manipulation and potential execution of arbitrary HTML or JavaScript in the context of the application origin. The security impact is equivalent to a stored cross-site scripting vulnerability, allowing session hijacking, data exfiltration, and unauthorized actions on behalf of the victim."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 HTTP Request/Response Splitting"
            }
          ]
        },
        {
          "capecId": "CAPEC-2",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-2 Input with Special Elements or Structures"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:H/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-06T18:44:54Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-113",
              "description": "CWE-113 HTTP Response Splitting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/sachertortephp/commit/afbc551aa6b8aedb87dfa1223a388e9a3178abfd"
        },
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/sachertortephp/commit/e2c80021729611922817a57d2317b2ffa7ed1439"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe vulnerability is remediated by sanitizing the filename before it is interpolated into the Content-Disposition header. C0 control characters (0x00-0x1F) and DEL (0x7F) are stripped to prevent HTTP response splitting and header suppression. Subsequently, double-quote and backslash characters are escaped using addcslashes per RFC 6266 quoted-string rules to prevent early termination of the quoted value and injection of additional header parameters. Together these two steps ensure the filename remains contained within the intended quoted-string token regardless of its content.\u003c/p\u003e"
            }
          ],
          "value": "The vulnerability is remediated by sanitizing the filename before it is interpolated into the Content-Disposition header. C0 control characters (0x00-0x1F) and DEL (0x7F) are stripped to prevent HTTP response splitting and header suppression. Subsequently, double-quote and backslash characters are escaped using addcslashes per RFC 6266 quoted-string rules to prevent early termination of the quoted value and injection of additional header parameters. Together these two steps ensure the filename remains contained within the intended quoted-string token regardless of its content."
        }
      ],
      "title": "MISP sachertortephp  - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "partial",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected product is identified as MISP sachertortephp based on the GitHub repository URL in the patch metadata; no specific version range is provided in the patch or metadata.",
                  "PR:L assumes that creating or uploading an attachment with a crafted filename requires authenticated access to the MISP instance; the patch does not explicitly state the authentication model.",
                  "UI:N assumes the victim triggers the download by normal page navigation; the commit message states the issue is reachable with download_attachments_on_load enabled, implying no special user action beyond viewing the page.",
                  "SC:H assumes the rendered HTML/JavaScript on the application origin grants full access to the victim\u0027s session and data, consistent with standard stored XSS impact.",
                  "The CAPEC-66 mapping is the closest available pattern for HTTP response header manipulation via CRLF injection; CAPEC-2 is included as a supplementary general-purpose pattern. Neither CAPEC perfectly captures the combined CRLF-suppression and quote-injection mechanism.",
                  "The Co-Authored-By line referencing Claude Opus 4.8 is treated as a tool credit per the metadata remediation_developers field; it is not a human contributor.",
                  "The patch does not specify whether the filename is attacker-controlled at creation time or only at serve time; the commit message states it \u0027neutralises already-stored filenames on serve,\u0027 implying the filename may have been stored before the fix."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-66",
                    "rationale": "The attacker injects CRLF sequences into the filename field, which is reflected into the Content-Disposition HTTP response header. This causes the header to be suppressed or its structure altered, matching the HTTP response splitting attack pattern. The quote-injection variant is a secondary header parameter injection that also falls under this pattern."
                  },
                  {
                    "capecId": "CAPEC-2",
                    "rationale": "The attack relies on supplying special characters (CRLF, double-quote) in a user-controlled input field (the attachment filename) that the application fails to neutralize before using it in a structured output context (HTTP header). This is the closest general-purpose CAPEC for injection via special characters when a more specific pattern is not available."
                  }
                ],
                "commit": "e2c80021729611922817a57d2317b2ffa7ed1439",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Logan Homolka"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  },
                  {
                    "lang": "en",
                    "type": "tool",
                    "value": "Claude Opus 4.8"
                  }
                ],
                "cvssRationale": "AV:N: The vulnerability is exploitable over the network via HTTP. AC:L: No race conditions or special timing are required; a crafted filename is sufficient. AT:N: The malicious filename is stored in the application; no manipulation of the attack target is needed at exploit time. PR:L: An authenticated MISP user with the ability to create or upload an attachment is required to store the crafted filename. UI:N: The victim only needs to view a page that triggers the download; no specific interaction beyond normal browsing is required. VC/VI/VA:N: The vulnerable component (the MISP server) itself is not directly compromised in terms of its own confidentiality, integrity, or availability. SC:H: The rendered HTML/JavaScript executes in the victim\u0027s browser on the application origin, granting full access to the victim\u0027s session, cookies, and data. SI:L: The attacker can modify what the victim sees and potentially submit forms on the victim\u0027s behalf. SA:N: No availability impact on the victim\u0027s system.",
                "fixSummary": "The vulnerability is remediated by sanitizing the filename before it is interpolated into the Content-Disposition header. C0 control characters (0x00-0x1F) and DEL (0x7F) are stripped to prevent HTTP response splitting and header suppression. Subsequently, double-quote and backslash characters are escaped using addcslashes per RFC 6266 quoted-string rules to prevent early termination of the quoted value and injection of additional header parameters. Together these two steps ensure the filename remains contained within the intended quoted-string token regardless of its content.",
                "generatedAt": "2026-10-06T18:44:54.540983Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 7,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "ce7901c623bbc59c2f5f8dfe8ce0bd4445c8bb6c1865356f21812d80509db854",
                "patchSummary": "Two commits modify CakeResponse::download() in lib/Cake/Network/CakeResponse.php. The first commit (afbc551) adds a preg_replace call that strips all C0 control characters and DEL from the filename string before the header is composed. The second commit (e2c8002) adds an addcslashes call that escapes double-quote and backslash characters in the filename after the control-character strip, ensuring the quoted-string value in the Content-Disposition header cannot be broken out of. Both changes are inserted immediately before the existing $this-\u003eheader(\u0027Content-Disposition\u0027, ...) call.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "afbc551aa6b8aedb87dfa1223a388e9a3178abfd",
                    "date": "Tue, 6 Oct 2026 19:27:40 +0200",
                    "patchSha256": "9430abddfb8d3a9f5f642b6b2700aa00186c9f11966591e408e39f20a1e4ccdc",
                    "source": "https://github.com/MISP/sachertortephp/commit/afbc551aa6b8aedb87dfa1223a388e9a3178abfd.patch",
                    "sourceUrl": "https://github.com/MISP/sachertortephp/commit/afbc551aa6b8aedb87dfa1223a388e9a3178abfd.patch",
                    "subject": "fix: [security] Strip control characters from download"
                  },
                  {
                    "commit": "e2c80021729611922817a57d2317b2ffa7ed1439",
                    "date": "Tue, 6 Oct 2026 20:20:13 +0200",
                    "patchSha256": "41c2630e0a4b0a1a3d4612c28531f4f673164fbee41dcc2b3a43813640fd0e39",
                    "source": "https://github.com/MISP/sachertortephp/commit/e2c80021729611922817a57d2317b2ffa7ed1439.patch",
                    "sourceUrl": "https://github.com/MISP/sachertortephp/commit/e2c80021729611922817a57d2317b2ffa7ed1439.patch",
                    "subject": "fix: [security] Escape the download filename quoted-string"
                  }
                ],
                "source": "patch set (2 sources)",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-06T18:44:54Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [security] Escape the download filename quoted-string",
                "weaknessRationale": [
                  {
                    "cweId": "CWE-113",
                    "rationale": "CRLF characters in the unsanitized filename cause PHP to suppress the entire Content-Disposition header, effectively splitting or altering the HTTP response structure. This is the primary mechanism by which the attachment disposition is dropped and the body renders inline."
                  },
                  {
                    "cweId": "CWE-79",
                    "rationale": "The consequence of the header suppression is that an HTML attachment renders inline on the application origin, constituting a stored XSS condition. The quote-injection variant (CWE-74) also contributes to the header manipulation but the security impact is best characterized as XSS."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "The root cause is the absence of input validation and output encoding on the filename parameter before it is placed into an HTTP header value. Both the control-character and quote-injection variants stem from this missing validation."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (afbc551aa6b8aedb87dfa1223a388e9a3178abfd): fix: [security] Strip control characters from download",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/sachertortephp/commit/afbc551aa6b8aedb87dfa1223a388e9a3178abfd.patch"
                    ],
                    "timestamp": "2026-10-06T17:27:40Z",
                    "type": "fix-developed"
                  },
                  {
                    "description": "Corrective change authored (e2c80021729611922817a57d2317b2ffa7ed1439): fix: [security] Escape the download filename quoted-string",
                    "id": "evt-fix-developed-2",
                    "references": [
                      "https://github.com/MISP/sachertortephp/commit/e2c80021729611922817a57d2317b2ffa7ed1439.patch"
                    ],
                    "timestamp": "2026-10-06T18:20:13Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20275"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-106512",
    "datePublished": "2026-10-06T18:47:58.276997Z",
    "dateReserved": "2026-10-06T18:48:26.050Z",
    "dateUpdated": "2026-10-06T18:48:26.123050Z",
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-20275"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "app/Model/Event.php",
            "app/Model/MispAttribute.php"
          ],
          "product": "MISP",
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "elhoim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints.\u003c/p\u003e\u003cp\u003eWhen a user queries for soft-deleted attributes (e.g., via the deleted-attributes search or the paginated attribute listing), the application returned soft-deleted attributes belonging to events owned by other organizations to any authenticated user who had visibility of the event. The event detail view correctly restricted soft-deleted attribute visibility to the owning organization and sync-permission users, but the attribute search and paginated view code paths lacked this restriction.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- An authenticated MISP user with at least read access to an event owned by another organization.\u003c/p\u003e\u003cp\u003e- The user issues a query for deleted attributes (search or paginated view with the deleted filter).\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Confidentiality: Soft-deleted threat intelligence attributes (e.g., IOCs, indicators, context) from other organizations are disclosed to unauthorized users. This may expose sensitive intelligence that the owning organization intended to remove from general visibility.\u003c/p\u003e\u003cp\u003eAffected versions: MISP versions prior to v2.5.48.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints.\n\nWhen a user queries for soft-deleted attributes (e.g., via the deleted-attributes search or the paginated attribute listing), the application returned soft-deleted attributes belonging to events owned by other organizations to any authenticated user who had visibility of the event. The event detail view correctly restricted soft-deleted attribute visibility to the owning organization and sync-permission users, but the attribute search and paginated view code paths lacked this restriction.\n\nPreconditions:\n\n- An authenticated MISP user with at least read access to an event owned by another organization.\n\n- The user issues a query for deleted attributes (search or paginated view with the deleted filter).\n\nImpact:\n\n- Confidentiality: Soft-deleted threat intelligence attributes (e.g., IOCs, indicators, context) from other organizations are disclosed to unauthorized users. This may expose sensitive intelligence that the owning organization intended to remove from general visibility.\n\nAffected versions: MISP versions prior to v2.5.48."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Leverage Executable Code to Alter Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-02T16:06:38Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/bd81c23cf"
        },
        {
          "url": "https://github.com/elhoim"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix enforces organizational ownership checks on soft-deleted attribute queries. When a user without sync permission requests deleted attributes, the query is now constrained to only return soft-deleted attributes whose parent event belongs to the requesting user\u0027s organization. This aligns the attribute search and paginated view behavior with the existing event view authorization logic.\u003c/p\u003e"
            }
          ],
          "value": "The fix enforces organizational ownership checks on soft-deleted attribute queries. When a user without sync permission requests deleted attributes, the query is now constrained to only return soft-deleted attributes whose parent event belongs to the requesting user\u0027s organization. This aligns the attribute search and paginated view behavior with the existing event view authorization logic."
        }
      ],
      "title": "MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact fixed version is not specified in the patch metadata; the fix commit is 37 commits after the v2.5.48 tag, so the fixed release is post-2.5.48 but the exact version number is unknown.",
                  "PR:L assumes the attacker needs at least read access to an event owned by another organization; if MISP deployments restrict cross-org event visibility more tightly, the effective privilege requirement may be higher.",
                  "CAPEC-126 is the closest available mapping but is not a perfect fit; the vulnerability is an information disclosure via missing authorization rather than data alteration.",
                  "VC:L assumes the exposure is limited to soft-deleted attributes (a subset of event data) and does not include active attributes or full event metadata.",
                  "The patch does not specify whether this affects all MISP deployments or only multi-organization configurations; the CVSS assumes a multi-org deployment where cross-org visibility is possible."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "This CAPEC describes leveraging legitimate application code paths to access or manipulate data beyond intended permissions. The attacker uses the legitimate attribute search and paginated view endpoints (executable code paths) to retrieve soft-deleted attributes from other organizations. The mapping is imperfect because CAPEC-126 emphasizes data alteration, whereas this vulnerability is purely an information disclosure. However, among available CAPEC patterns, this is the closest match for exploiting a legitimate code path to bypass intended access restrictions. No CAPEC specifically covers \u0027information disclosure via missing authorization in a query endpoint\u0027 with greater precision."
                  }
                ],
                "commit": "bd81c23cf2aced3c72766369dc813612edd52509",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  },
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "elhoim"
                  }
                ],
                "cvssRationale": "AV:N: The vulnerability is exploitable over the network via the MISP web API. AC:L: Exploitation requires only a standard query with the deleted-attribute filter; no race conditions or complex setup. AT:N: No special attack requirements. PR:L: An authenticated user with at least read access to an event owned by another organization is required. UI:N: No victim interaction needed; the data is returned in the API response. VC:L: Confidentiality impact is limited to soft-deleted attributes (a subset of event data) from other organizations; not all data is exposed. VI:N, VA:N: No integrity or availability impact on the vulnerable component. SC:N, SI:N, SA:N: No impact on subsequent components.",
                "fixSummary": "The fix enforces organizational ownership checks on soft-deleted attribute queries. When a user without sync permission requests deleted attributes, the query is now constrained to only return soft-deleted attributes whose parent event belongs to the requesting user\u0027s organization. This aligns the attribute search and paginated view behavior with the existing event view authorization logic.",
                "generatedAt": "2026-10-02T16:06:38.209479Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "9673ee1d4db26b032b6e3a2632315d5353cd2718c9b809a5296d28a0002a3722",
                "patchSummary": "Two code paths were modified:1. Event.php (fetchPaginatedAttributes): When the deleted filter is active and the user lacks perm_sync, an additional subquery condition is appended requiring the event owner\u0027s org_id to match the user\u0027s org_id. The original blanket deleted=0 or deleted=1 condition is replaced with an OR/AND structure that permits non-deleted attributes for all users but restricts deleted attributes to the owning org.2. MispAttribute.php (fetchAttributes): In the deleted=\u0027only\u0027 branch, when the user lacks perm_sync, an additional AND condition Event.org_id = user.org_id is added to the query conditions, scoping results to the user\u0027s own organization.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "bd81c23cf2aced3c72766369dc813612edd52509",
                    "date": "Thu, 24 Sep 2026 13:57:21 +0200",
                    "patchSha256": "9673ee1d4db26b032b6e3a2632315d5353cd2718c9b809a5296d28a0002a3722",
                    "source": "https://github.com/MISP/MISP/commit/bd81c23cf.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/bd81c23cf.patch",
                    "subject": "fix: [security] Show soft-deleted attributes only to the"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/bd81c23cf.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-02T16:06:38Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [security] Show soft-deleted attributes only to the",
                "tagVersionBoundary": {
                  "commits_after_fix": 37,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The attribute search and paginated view code paths were missing the authorization check that restricts soft-deleted attribute visibility to the owning organization. The event view had this check, but the attribute-level query paths did not, allowing any user with event visibility to retrieve soft-deleted attributes from other organizations."
                  },
                  {
                    "cweId": "CWE-284",
                    "rationale": "More broadly, the application failed to enforce proper access control boundaries between organizations when serving soft-deleted attribute data through specific query endpoints, resulting in cross-organizational information disclosure."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (bd81c23cf2aced3c72766369dc813612edd52509): fix: [security] Show soft-deleted attributes only to the",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/bd81c23cf.patch"
                    ],
                    "timestamp": "2026-09-24T11:57:21Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20248"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-104914",
    "datePublished": "2026-10-02T16:09:31.553352Z",
    "dateReserved": "2026-10-02T16:09:36.435Z",
    "dateUpdated": "2026-10-02T16:09:38.126317Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20248"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "app/Model/Behavior/DefaultCorrelationBehavior.php"
          ],
          "product": "MISP",
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "elhoim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distribution snapshot stored on the correlation row rather than the live event access control list.\u003c/p\u003e\u003cp\u003eBecause the correlation row\u0027s distribution columns are a point-in-time copy that lacks a published flag, the authorization check becomes incorrect when an event is subsequently restricted (for example, its sharing group is changed or it is unpublished). As a result, an authenticated user could retrieve attributes and event details belonging to events they no longer have permission to view.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- An authenticated user with at least read access to some events in the instance.\u003c/p\u003e\u003cp\u003e- The existence of correlations between events, at least one of which has been restricted after the correlation was created.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Confidentiality: exposure of attribute values and event metadata that the user is not authorized to access.\u003c/p\u003e\u003cp\u003eAffected versions: MISP prior to v2.5.48.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distribution snapshot stored on the correlation row rather than the live event access control list.\n\nBecause the correlation row\u0027s distribution columns are a point-in-time copy that lacks a published flag, the authorization check becomes incorrect when an event is subsequently restricted (for example, its sharing group is changed or it is unpublished). As a result, an authenticated user could retrieve attributes and event details belonging to events they no longer have permission to view.\n\nPreconditions:\n\n- An authenticated user with at least read access to some events in the instance.\n\n- The existence of correlations between events, at least one of which has been restricted after the correlation was created.\n\nImpact:\n\n- Confidentiality: exposure of attribute values and event metadata that the user is not authorized to access.\n\nAffected versions: MISP prior to v2.5.48."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-114 Exploiting Incorrectly Adjusted Privileges"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-02T16:02:40Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/100235bd9"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix ensures that correlation-based lookups are authorized against the live event and attribute access control lists rather than the stale distribution snapshot on the correlation row. A new filtering step validates related event IDs against the current event ACL before returning them, and attribute queries for non-admin users now include the live ACL conditions. Additionally, Event and Object fields are stripped from returned attribute results to prevent incidental metadata leakage.\u003c/p\u003e"
            }
          ],
          "value": "The fix ensures that correlation-based lookups are authorized against the live event and attribute access control lists rather than the stale distribution snapshot on the correlation row. A new filtering step validates related event IDs against the current event ACL before returning them, and attribute queries for non-admin users now include the live ACL conditions. Additionally, Event and Object fields are stripped from returned attribute results to prevent incidental metadata leakage."
        }
      ],
      "title": "MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary (\u003c 2.5.48) is inferred from the tag_version_boundary metadata (v2.5.48, 38 commits after fix); the exact first affected version is not stated in the patch.",
                  "CVSS PR:L assumes the attacker needs a standard authenticated MISP account with read access to at least one event; no evidence supports a lower or higher privilege requirement.",
                  "CAPEC-114 is the closest available pattern; the actual mechanism is a stale authorization snapshot rather than a classic privilege-escalation vector, so the mapping is approximate.",
                  "The patch does not specify whether the vulnerability requires the event to have been restricted after correlation creation, or whether other state changes (e.g., sharing group modification) also trigger the issue; the commit message mentions \u0027restricted\u0027 as the primary scenario.",
                  "No public exploit or PoC is referenced; exploitation status is assumed to be \u0027none\u0027."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-114",
                    "rationale": "The authorization state used for correlation lookups was incorrectly adjusted (stale) relative to the actual event ACL. An attacker with a legitimate account could exploit this misalignment to access data beyond their intended privilege scope. This is the closest CAPEC pattern; the exact mechanism is a stale authorization snapshot rather than a classic privilege-escalation primitive, so the mapping is approximate."
                  }
                ],
                "commit": "100235bd99b9f57a5a09976412d54e2001d2e0c4",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  },
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "elhoim"
                  }
                ],
                "cvssRationale": "Network vector: MISP is a web application accessible over the network. Low complexity: the attacker simply performs a normal attribute search that triggers correlations; no race condition or special setup is needed. No attack requirements: the stale correlation row exists naturally after any event restriction. Low privileges: the attacker needs an authenticated account with read access to at least one event. No user interaction: the attacker initiates the search themselves. High vulnerability-component confidentiality impact: full attribute values and event metadata of restricted events are exposed. No integrity or availability impact on the vulnerable or subsequent components.",
                "fixSummary": "The fix ensures that correlation-based lookups are authorized against the live event and attribute access control lists rather than the stale distribution snapshot on the correlation row. A new filtering step validates related event IDs against the current event ACL before returning them, and attribute queries for non-admin users now include the live ACL conditions. Additionally, Event and Object fields are stripped from returned attribute results to prevent incidental metadata leakage.",
                "generatedAt": "2026-10-02T16:02:40.166976Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "a38b683420d93ff26d461badf81e0524bbd9618dd3dd6f187a994f5c5b47f23d",
                "patchSummary": "In DefaultCorrelationBehavior.php: (1) runGetRelatedAttributes now builds query conditions that include the live attribute ACL (buildConditions) for non-site-admin users, and ensures Event and Object are contained in the query for proper filtering; (2) after fetching related attributes, Event and Object sub-objects are unset from each result; (3) fetchRelatedEventIds now passes its results through a new __filterVisibleEventIds method that queries the Event model with createEventConditions to verify each event ID is still visible to the user; (4) the new __filterVisibleEventIds method returns the event IDs unchanged for site admins or empty lists, otherwise filters against the live event ACL.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "100235bd99b9f57a5a09976412d54e2001d2e0c4",
                    "date": "Thu, 24 Sep 2026 12:12:56 +0200",
                    "patchSha256": "a38b683420d93ff26d461badf81e0524bbd9618dd3dd6f187a994f5c5b47f23d",
                    "source": "https://github.com/MISP/MISP/commit/100235bd9.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/100235bd9.patch",
                    "subject": "fix: [security] Check correlations against the live event ACL"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/100235bd9.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-02T16:02:40Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [security] Check correlations against the live event ACL",
                "tagVersionBoundary": {
                  "commits_after_fix": 38,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The correlation lookup path failed to enforce the current (live) authorization state of the target events and attributes. Access was granted based on a stale snapshot rather than the actual ACL, effectively missing the authorization check for restricted events."
                  },
                  {
                    "cweId": "CWE-284",
                    "rationale": "The access control decision relied on outdated data (the distribution columns copied onto the correlation row) that did not reflect the current published/sharing-group state of the event, leading to improper access control."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (100235bd99b9f57a5a09976412d54e2001d2e0c4): fix: [security] Check correlations against the live event ACL",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/100235bd9.patch"
                    ],
                    "timestamp": "2026-09-24T10:12:56Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20312"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-104912",
    "datePublished": "2026-10-02T16:04:40.155171Z",
    "dateReserved": "2026-10-02T16:04:47.753Z",
    "dateUpdated": "2026-10-02T16:04:47.848957Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-20312"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}