Find a vulnerability

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112192",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T17:13:11.731385Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T17:13:51.582Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "app/Model/Server.php (readModuleSettings)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Server.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata.\u003c/p\u003e\u003cp\u003eAs a result:\u003c/p\u003e\u003cp\u003e- A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings.\u003c/p\u003e\u003cp\u003e- A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction.\u003c/p\u003e\u003cp\u003eAn authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata.\n\nAs a result:\n\n- A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings.\n\n- A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction.\n\nAn authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access.\n\nAffected: \u003c2.5.48"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Sensitive Data Discovery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-19T09:23:47Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T10:06:28.714Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/6c02f0f5c"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix ensures that the redacted and cli_only flags declared by a module in its own setting definition are preserved when the server rebuilds the setting for API exposure. By carrying these flags through to the final setting object, the existing enforcement logic (which checks these flags before serving values or accepting edits) now correctly applies to module-supplied settings, preventing disclosure of redacted values and blocking API-based modification of CLI-only settings.\u003c/p\u003e"
            }
          ],
          "value": "The fix ensures that the redacted and cli_only flags declared by a module in its own setting definition are preserved when the server rebuilds the setting for API exposure. By carrying these flags through to the final setting object, the existing enforcement logic (which checks these flags before serving values or accepting edits) now correctly applies to module-supplied settings, preventing disclosure of redacted values and blocking API-based modification of CLI-only settings."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (fix is 10 commits after v2.5.48); the exact fixed release version is not stated in the patch metadata.",
                  "PR:L assumes that reading server settings requires an authenticated MISP user with appropriate role permissions; the patch does not specify the exact permission level required.",
                  "The CAPEC-126 mapping is the closest available pattern for the information-disclosure aspect; the authorization-bypass aspect (cli_only) does not have a precise CAPEC match and is subsumed under the same mapping.",
                  "VC:L assumes the exposed data is limited to module-specific API keys rather than system-wide credentials; the actual sensitivity depends on which modules are installed.",
                  "The commit message references a separate issue (branch read) reported by Jeroen Pinoy; this vulnerability was discovered as a side effect of fixing that issue, so Jeroen Pinoy is not credited as a finder of this specific vulnerability."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The primary impact is that sensitive data (module API keys marked as redacted) is discoverable via standard API endpoints because the redaction flag was not enforced. An authenticated user querying server settings can obtain credentials that the module author intended to keep hidden. This is the closest CAPEC to the information-disclosure aspect of the vulnerability. The secondary aspect (CLI-only settings editable via API) is an authorization bypass that does not map cleanly to a single CAPEC; CAPEC-126 is selected as the best available match for the overall pattern of accessing data that should be restricted."
                  }
                ],
                "commit": "6c02f0f5c33aab96e90df8791c3873303d7e99ce",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a web application accessible over the network. AC:L: No special race conditions or complex setup are needed; a standard API call to the settings endpoint triggers the issue. AT:N: No manipulation of the attack target is required. PR:L: The attacker needs an authenticated MISP account with permission to view server settings. UI:N: No user interaction is required. VC:L: Sensitive module API keys are exposed, but the scope is limited to settings of modules that declare the redacted flag. VI:N: No direct integrity impact on the vulnerable component\u0027s data beyond the VA impact. VA:L: CLI-only settings can be modified via the API, representing a limited integrity impact on the vulnerable component\u0027s configuration. SC/SI/SA:N: No evidence of impact on other components or systems.",
                "fixSummary": "The fix ensures that the redacted and cli_only flags declared by a module in its own setting definition are preserved when the server rebuilds the setting for API exposure. By carrying these flags through to the final setting object, the existing enforcement logic (which checks these flags before serving values or accepting edits) now correctly applies to module-supplied settings, preventing disclosure of redacted values and blocking API-based modification of CLI-only settings.",
                "generatedAt": "2026-10-19T09:23:47.526920Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "e7e99bab776b221dd41bf562693fc308d8a2ee619806b1bfef26bb008212205a",
                "patchSummary": "In app/Model/Server.php, within the readModuleSettings() method, a loop was added after the setting fields are populated that iterates over the strings \u0027redacted\u0027 and \u0027cli_only\u0027. For each flag, if the module\u0027s own result array contains a truthy value for that key, the flag is set to true on the rebuilt $setting object before it is stored in $serverSettings. This is a 6-line addition that preserves the module-declared guard flags that were previously discarded during the setting reconstruction.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "6c02f0f5c33aab96e90df8791c3873303d7e99ce",
                    "date": "Mon, 28 Sep 2026 12:14:28 +0200",
                    "patchSha256": "e7e99bab776b221dd41bf562693fc308d8a2ee619806b1bfef26bb008212205a",
                    "source": "https://github.com/MISP/MISP/commit/6c02f0f5c.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/6c02f0f5c.patch",
                    "subject": "fix: [settings] Module settings keep the flags the module"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/6c02f0f5c.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-19T09:23:47Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [settings] Module settings keep the flags the module",
                "tagVersionBoundary": {
                  "commits_after_fix": 10,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-200",
                    "rationale": "The redacted flag, which instructs the server to mask a setting\u0027s value (e.g., an API key), was dropped during setting reconstruction. This caused the sensitive value to be served in plaintext via API endpoints to any authenticated user, constituting an information exposure."
                  },
                  {
                    "cweId": "CWE-862",
                    "rationale": "The cli_only flag, which restricts a setting to command-line modification only, was dropped during setting reconstruction. This allowed the setting to be modified via the web API without the intended authorization restriction, effectively bypassing the access control the module author specified."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (6c02f0f5c33aab96e90df8791c3873303d7e99ce): fix: [settings] Module settings keep the flags the module",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/6c02f0f5c.patch"
                    ],
                    "timestamp": "2026-09-28T10:14:28Z",
                    "type": "fix-developed"
                  },
                  {
                    "description": "Fix released in MISP v2.5.48.",
                    "id": "evt-fix-available-1",
                    "referencedEvents": [
                      "evt-fix-developed-1"
                    ],
                    "references": [
                      "https://github.com/MISP/MISP/releases/tag/v2.5.48"
                    ],
                    "timestamp": "2026-09-29T08:11:29Z",
                    "type": "fix-available"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20310"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-112192",
    "datePublished": "2026-10-19T09:28:08.054Z",
    "dateReserved": "2026-10-19T09:28:06.573Z",
    "dateUpdated": "2026-10-30T10:06:28.714Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112188",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-28T17:47:38.444785Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-28T20:05:58.430Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Server settings (app/Model/Server.php)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Server.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.\u003c/p\u003e\u003cp\u003eThe settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys.\u003c/p\u003e\u003cp\u003eA second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller.\u003c/p\u003e\u003cp\u003eThe impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints.\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.\n\nThe settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys.\n\nA second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller.\n\nThe impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints.\n\nAffected versions: \u003c2.5.48."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-124",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-124 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "total"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-19T09:21:00Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:22:37.880Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/30b849102"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe settings lookup function now validates that the resolved node is a leaf setting (has a \u0027level\u0027 property and is not an array representing a branch). If the resolved node is a branch or otherwise does not represent a single setting, the function returns false, indicating an invalid setting. This prevents the redaction check from being bypassed and stops the endpoints from returning entire configuration branches containing sensitive values.\u003c/p\u003e"
            }
          ],
          "value": "The settings lookup function now validates that the resolved node is a leaf setting (has a \u0027level\u0027 property and is not an array representing a branch). If the resolved node is a branch or otherwise does not represent a single setting, the function returns false, indicating an invalid setting. This prevents the redaction check from being bypassed and stops the endpoints from returning entire configuration branches containing sensitive values."
        }
      ],
      "title": "MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact privilege level required to access the server settings endpoints (admin vs. any authenticated user) is not stated in the patch; PR:L is assumed as the most conservative defensible value.",
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48 with 11 commits after fix); the exact last affected version and first fixed version are not explicitly confirmed.",
                  "CAPEC-124 (Parameter Tampering) is the closest available attack pattern; no CAPEC specifically models configuration-tree branch traversal, so the mapping is approximate.",
                  "The patch does not indicate whether unauthenticated access is possible; authentication is assumed based on the nature of server settings endpoints in MISP.",
                  "The Co-Authored-By line references an AI tool (Claude Opus 5); it is listed as a tool credit rather than a human remediation developer."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-124",
                    "rationale": "The attacker manipulates the setting name parameter supplied to the settings lookup endpoint, substituting a branch name (e.g., \u0027Security\u0027) for a leaf setting name. This causes the application to return a broader data set than intended. CAPEC-124 is the closest match because the core technique is altering a request parameter to change the application\u0027s response scope. The mapping is approximate because the parameter is not a traditional HTTP parameter but an application-level setting identifier; no CAPEC specifically covers configuration-tree traversal."
                  }
                ],
                "commit": "30b849102c687bb53919f1d5d20851bc20fafa4e",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The attack requires only substituting a branch name for a leaf setting name in an existing API call; no race conditions or complex timing are needed. AT:N: No manipulation of the target environment is required. PR:L: The attacker needs an authenticated account with access to the server settings endpoints; the exact privilege level (admin vs. regular user) is not confirmed in the patch, so Low is assumed. UI:N: No victim interaction is required. VC:H: Sensitive secrets (security salt, Redis passwords, plugin API keys) are fully disclosed. VI:N, VA:N: No integrity or availability impact is evidenced. SC:N, SI:N, SA:N: No impact on subsequent components is indicated.",
                "fixSummary": "The settings lookup function now validates that the resolved node is a leaf setting (has a \u0027level\u0027 property and is not an array representing a branch). If the resolved node is a branch or otherwise does not represent a single setting, the function returns false, indicating an invalid setting. This prevents the redaction check from being bypassed and stops the endpoints from returning entire configuration branches containing sensitive values.",
                "generatedAt": "2026-10-19T09:21:00.388917Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "70885748c270bb21036c46d9142ef00525834a5c03669c4c4a856d7db6ef58e2",
                "patchSummary": "In app/Model/Server.php, the getSettingData() method previously checked only for the presence of a \u0027level\u0027 key before returning the setting. The patch adds a guard clause: if the resolved setting is an array (i.e., a branch/sub-tree) or lacks the \u0027level\u0027 key, the function immediately returns false. The existing logic for setting the name and resolving options is then applied only to confirmed leaf settings. This ensures callers that assumed a single-setting result never receive a multi-key branch.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "30b849102c687bb53919f1d5d20851bc20fafa4e",
                    "date": "Mon, 28 Sep 2026 12:03:56 +0200",
                    "patchSha256": "70885748c270bb21036c46d9142ef00525834a5c03669c4c4a856d7db6ef58e2",
                    "source": "https://github.com/MISP/MISP/commit/30b849102.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/30b849102.patch",
                    "subject": "fix: [settings] Server setting lookups address one setting,"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/30b849102.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "total"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-19T09:21:00Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [settings] Server setting lookups address one setting,",
                "tagVersionBoundary": {
                  "commits_after_fix": 11,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-200",
                    "rationale": "The settings endpoint returned sensitive configuration values (security salt, Redis passwords, plugin API keys) to a caller who requested a branch name, bypassing the intended redaction mechanism. The data was exposed to an actor who should not have had access to those specific values."
                  },
                  {
                    "cweId": "CWE-285",
                    "rationale": "The redaction check, which serves as an authorization control for sensitive setting values, was effectively bypassed because branch nodes do not carry a redacted flag. The system failed to enforce the intended access restriction on sensitive configuration data."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (30b849102c687bb53919f1d5d20851bc20fafa4e): fix: [settings] Server setting lookups address one setting,",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/30b849102.patch"
                    ],
                    "timestamp": "2026-09-28T10:03:56Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20327"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-112188",
    "datePublished": "2026-10-19T09:22:37.880Z",
    "dateReserved": "2026-10-19T09:22:31.139Z",
    "dateUpdated": "2026-10-28T20:05:58.430Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112184",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T17:14:29.630953Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T17:14:52.401Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Workflow Modules (Module_misp_module)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/WorkflowModules/Module_misp_module.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user\u0027s browser.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- The attacker must be able to control or influence parameter names reported by the misp-modules service.\u003c/p\u003e\u003cp\u003e- A victim must be authenticated and view the affected workflow module page.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Execution of arbitrary JavaScript in the victim\u0027s browser session.\u003c/p\u003e\u003cp\u003e- Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim.\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user\u0027s browser.\n\nPreconditions:\n\n- The attacker must be able to control or influence parameter names reported by the misp-modules service.\n\n- A victim must be authenticated and view the affected workflow module page.\n\nImpact:\n\n- Execution of arbitrary JavaScript in the victim\u0027s browser session.\n\n- Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim.\n\nAffected versions: \u003c2.5.48."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 XSS - Reflected"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-19T09:16:56Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:19:45.056Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/813a48b2b"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix applies HTML output encoding (the h() helper) to the parameter name before it is used as a form label, ensuring that any HTML metacharacters in the value are neutralized and rendered as inert text rather than executable markup.\u003c/p\u003e"
            }
          ],
          "value": "The fix applies HTML output encoding (the h() helper) to the parameter name before it is used as a form label, ensuring that any HTML metacharacters in the value are neutralized and rendered as inert text rather than executable markup."
        }
      ],
      "title": "MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The misp-modules service is assumed to be a component whose output can be influenced by a module developer or a compromised service endpoint; the exact attack vector for injecting a malicious parameter name is not detailed in the patch.",
                  "MISP requires authentication to access the workflow module page; PR:L is assumed based on MISP\u0027s standard access model.",
                  "The affected version boundary (\u003c 2.5.48) is inferred from the tag_version_boundary metadata (v2.5.48, 25 commits after fix); the exact first affected version is not specified.",
                  "CAPEC-1 (Reflected XSS) is the closest match; the data source is a backend service rather than a direct request parameter, but the unencoded reflection into HTML is the defining characteristic.",
                  "The h() function is assumed to be CakePHP\u0027s HTML-encoding helper (equivalent to htmlspecialchars), based on the framework context of the MISP codebase."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "The misp-modules service supplies parameter names that are reflected into the HTML of the workflow module page without encoding. The attacker-controlled data flows from an external source into the rendered output, matching the reflected XSS pattern. Uncertainty: the data originates from a backend service rather than a direct HTTP parameter, but the effect (untrusted data reflected into HTML without encoding) is functionally identical to reflected XSS."
                  }
                ],
                "commit": "813a48b2bac0c9034f532b9181ac9a0c5fa59857",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N \u2013 web-based, reachable over the network. AC:L \u2013 no race or special timing; the misp-modules service simply needs to return a crafted parameter name. AT:N \u2013 no manipulation of the target system required. PR:L \u2013 the victim must be an authenticated MISP user to view the workflow module page. UI:A \u2013 the victim must actively load the workflow module page for the script to execute. VC/VI/VA:N \u2013 the MISP server itself is not compromised. SC:L \u2013 the attacker can read cookies or session data in the victim\u0027s browser. SI:L \u2013 the attacker can modify the page or perform actions in the victim\u0027s session. SA:N \u2013 no elevation of security authority on the server.",
                "fixSummary": "The fix applies HTML output encoding (the h() helper) to the parameter name before it is used as a form label, ensuring that any HTML metacharacters in the value are neutralized and rendered as inert text rather than executable markup.",
                "generatedAt": "2026-10-19T09:16:56.467726Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "691d31d09a8db397d602b6d179507339a60ca0125e91b55d408353abf8473bac",
                "patchSummary": "In app/Model/WorkflowModules/Module_misp_module.php, the translateParams method was modified: the \u0027label\u0027 array element changed from Inflector::humanize($paramName) to h(Inflector::humanize($paramName)), wrapping the humanized parameter name in CakePHP\u0027s HTML-encoding function before it is assigned as a form label.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "813a48b2bac0c9034f532b9181ac9a0c5fa59857",
                    "date": "Fri, 25 Sep 2026 00:12:54 +0200",
                    "patchSha256": "691d31d09a8db397d602b6d179507339a60ca0125e91b55d408353abf8473bac",
                    "source": "https://github.com/MISP/MISP/commit/813a48b2b.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/813a48b2b.patch",
                    "subject": "fix: [workflows] Escape misp-module parameter names used as"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/813a48b2b.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-19T09:16:56Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [workflows] Escape misp-module parameter names used as",
                "tagVersionBoundary": {
                  "commits_after_fix": 25,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "The parameter name from an external service is inserted into HTML output (a form label) without HTML encoding, allowing injected markup or script to execute in the victim\u0027s browser. This is a textbook reflected XSS."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (813a48b2bac0c9034f532b9181ac9a0c5fa59857): fix: [workflows] Escape misp-module parameter names used as",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/813a48b2b.patch"
                    ],
                    "timestamp": "2026-09-24T22:12:54Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20332"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-112184",
    "datePublished": "2026-10-19T09:19:45.056Z",
    "dateReserved": "2026-10-19T09:19:41.258Z",
    "dateUpdated": "2026-10-19T17:14:52.401Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112183",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T17:15:24.498800Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T17:15:45.687Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Servers/preview_event (remote event preview)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/View/Servers/preview_event.ctp"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity encoding is applied, the value is interpreted as CSS within the style attribute, allowing a malicious or compromised linked server to inject arbitrary CSS declarations.\u003c/p\u003e\u003cp\u003eAn attacker with the ability to create or modify tags on a linked MISP instance can craft a tag colour value containing CSS injection payloads. When a user on the local instance views the event preview, the injected CSS is rendered, potentially allowing UI manipulation, visual spoofing, or limited information disclosure through CSS-based techniques.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- A linked MISP server relationship exists between the victim instance and the attacker-controlled instance.\u003c/p\u003e\u003cp\u003e- The attacker can create or modify tags on the linked server.\u003c/p\u003e\u003cp\u003e- A victim user views the remote event preview page.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity encoding is applied, the value is interpreted as CSS within the style attribute, allowing a malicious or compromised linked server to inject arbitrary CSS declarations.\n\nAn attacker with the ability to create or modify tags on a linked MISP instance can craft a tag colour value containing CSS injection payloads. When a user on the local instance views the event preview, the injected CSS is rendered, potentially allowing UI manipulation, visual spoofing, or limited information disclosure through CSS-based techniques.\n\nPreconditions:\n\n- A linked MISP server relationship exists between the victim instance and the attacker-controlled instance.\n\n- The attacker can create or modify tags on the linked server.\n\n- A victim user views the remote event preview page.\n\nAffected: \u003c2.5.48."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 Leveraging Trusted Relationships"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-19T09:01:35Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:15:47.453Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/91323b517"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces strict validation of the tag colour value before it is rendered into a CSS style attribute. Only values matching a valid six-digit hexadecimal colour pattern (e.g. #aabbcc) are accepted; any other value is replaced with a safe default (#ffffff). This prevents arbitrary CSS from being injected through the colour field, aligning the remote tag handling with the validation already applied to local tags.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces strict validation of the tag colour value before it is rendered into a CSS style attribute. Only values matching a valid six-digit hexadecimal colour pattern (e.g. #aabbcc) are accepted; any other value is replaced with a safe default (#ffffff). This prevents arbitrary CSS from being injected through the colour field, aligning the remote tag handling with the validation already applied to local tags."
        }
      ],
      "title": "MISP CSS Injection via Remote Tag Colour in Event Preview",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 27 commits after fix); the exact first affected version is not stated in the patch.",
                  "PR:L assumes that creating or modifying a tag on a linked MISP server requires only low-level user privileges; the exact permission model was not verified from the patch.",
                  "SC:L assumes CSS injection could enable limited client-side information disclosure (e.g., via CSS selectors or layout manipulation); full XSS or data exfiltration is not evidenced.",
                  "CAPEC-66 is the closest available mapping; no CAPEC specifically models CSS injection via trusted inter-instance data, so this mapping carries uncertainty.",
                  "The commit message states the issue was found during internal review and not externally reported; no external finder or reporter is credited.",
                  "The Co-Authored-By line references an AI tool (Claude Opus 5.5); it is credited as a tool rather than a human remediation developer."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-66",
                    "rationale": "The attack exploits the inherent trust between linked MISP instances. The local instance accepts and renders data (tag colours) from a remote linked server without sufficient validation, assuming the data is well-formed. The attacker leverages this trusted relationship to inject CSS. This is the closest CAPEC; no CAPEC specifically models CSS injection via trusted data sources, so CAPEC-66 is the best available match."
                  }
                ],
                "commit": "91323b517bb5a34f413363faf8703a3c0a1a9904",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N \u2013 the attack originates from a remote linked MISP server over the network. AC:L \u2013 no race conditions or special timing; simply setting a tag colour suffices. AT:N \u2013 no manipulation of the attack target is required. PR:L \u2013 the attacker needs low-privilege access (tag creation) on the linked server. UI:A \u2013 the victim must actively navigate to the event preview page. VC:N \u2013 no direct confidentiality loss on the vulnerable system. VI:N \u2013 no integrity impact on the vulnerable system\u0027s data. VA:N \u2013 no availability impact. SC:L \u2013 CSS injection may allow limited information disclosure on the client (e.g., reading page structure via CSS selectors or side channels). SI:L \u2013 the attacker can modify the visual presentation of the preview page (UI manipulation, overlay, spoofing). SA:N \u2013 no security authority impact.",
                "fixSummary": "The fix introduces strict validation of the tag colour value before it is rendered into a CSS style attribute. Only values matching a valid six-digit hexadecimal colour pattern (e.g. #aabbcc) are accepted; any other value is replaced with a safe default (#ffffff). This prevents arbitrary CSS from being injected through the colour field, aligning the remote tag handling with the validation already applied to local tags.",
                "generatedAt": "2026-10-19T09:01:35.918427Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 6,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "8be436940ffd0e21b7145fcb604ebfb0b529f6bbac717ee5cdf38c2e0dc2904e",
                "patchSummary": "In app/View/Servers/preview_event.ctp, a regex check (preg_match against /^#[0-9a-f]{6}$/i) is added before the tag colour is used. If the colour does not match the hex pattern, it defaults to #ffffff. The validated $colour variable replaces the raw $tag[\u0027colour\u0027] in both the background-color style property and the getTextColour() call, eliminating the untrusted value from the CSS context.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "91323b517bb5a34f413363faf8703a3c0a1a9904",
                    "date": "Thu, 24 Sep 2026 23:54:30 +0200",
                    "patchSha256": "8be436940ffd0e21b7145fcb604ebfb0b529f6bbac717ee5cdf38c2e0dc2904e",
                    "source": "https://github.com/MISP/MISP/commit/91323b517.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/91323b517.patch",
                    "subject": "fix: [sync] Only use a valid colour for remote tags in the"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/91323b517.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-19T09:01:35Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [sync] Only use a valid colour for remote tags in the",
                "tagVersionBoundary": {
                  "commits_after_fix": 27,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-74",
                    "rationale": "The tag colour value is not neutralized for the CSS context in which it is placed. HTML entity encoding (h()) does not sanitize CSS metacharacters such as semicolons, colons, or function calls, allowing CSS injection. CWE-74 is the most precise parent weakness covering injection into a downstream component (CSS) without a more specific child CWE for CSS injection."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (91323b517bb5a34f413363faf8703a3c0a1a9904): fix: [sync] Only use a valid colour for remote tags in the",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/91323b517.patch"
                    ],
                    "timestamp": "2026-09-24T21:54:30Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20339"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-112183",
    "datePublished": "2026-10-19T09:15:47.453Z",
    "dateReserved": "2026-10-19T09:15:45.556Z",
    "dateUpdated": "2026-10-19T17:15:45.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112180",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T17:19:43.619080Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T17:19:56.212Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Event model (app/Model/Event.php)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Event.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThanOrEqual": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal (shadow attribute) correlations, fuzzy ssdeep correlation chunks, and attachment scan results.\u003c/p\u003e\u003cp\u003eThese orphaned records may contain sensitive threat intelligence data such as correlation mappings, scan results, and report metadata that should have been removed along with the parent event. Their persistence beyond the intended deletion lifecycle creates a risk of unintended data retention and potential information exposure if the records are reachable through other application queries or administrative interfaces.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- An authenticated user with sufficient privileges to delete events in MISP.\u003c/p\u003e\u003cp\u003e- The event must have associated reports, graphs, correlations, ssdeep chunks, or attachment scan results.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Residual sensitive data persists in the database after the parent event is deleted.\u003c/p\u003e\u003cp\u003e- Accumulation of orphaned records over time may contribute to storage bloat.\u003c/p\u003e\u003cp\u003e- Orphaned records may be inadvertently exposed through other data-access paths that do not validate the existence of the parent event.\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal (shadow attribute) correlations, fuzzy ssdeep correlation chunks, and attachment scan results.\n\nThese orphaned records may contain sensitive threat intelligence data such as correlation mappings, scan results, and report metadata that should have been removed along with the parent event. Their persistence beyond the intended deletion lifecycle creates a risk of unintended data retention and potential information exposure if the records are reachable through other application queries or administrative interfaces.\n\nPreconditions:\n\n- An authenticated user with sufficient privileges to delete events in MISP.\n\n- The event must have associated reports, graphs, correlations, ssdeep chunks, or attachment scan results.\n\nImpact:\n\n- Residual sensitive data persists in the database after the parent event is deleted.\n\n- Accumulation of orphaned records over time may contribute to storage bloat.\n\n- Orphaned records may be inadvertently exposed through other data-access paths that do not validate the existence of the parent event.\n\nAffected versions: \u003c2.5.48"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Exploiting Incorrect Object State Transition"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-19T08:55:14Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-459",
              "description": "CWE-459 Incomplete Cleanup",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:00:13.049Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/5f78634af"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe event deletion routine was extended to cascade-remove all associated child records that were previously left behind. Specifically, the fix ensures that event report tags, event graph rows, shadow attribute correlation rows (on both event_id and 1_event_id foreign keys), fuzzy ssdeep chunks, and attachment scan results are all purged within the same transaction as the parent event deletion, eliminating the orphaned-data condition.\u003c/p\u003e"
            }
          ],
          "value": "The event deletion routine was extended to cascade-remove all associated child records that were previously left behind. Specifically, the fix ensures that event report tags, event graph rows, shadow attribute correlation rows (on both event_id and 1_event_id foreign keys), fuzzy ssdeep chunks, and attachment scan results are all purged within the same transaction as the parent event deletion, eliminating the orphaned-data condition."
        }
      ],
      "title": "MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48 with 33 commits after fix); the exact fixed release version is not specified in the patch.",
                  "The CAPEC-126 mapping is the closest available match; the vulnerability is fundamentally an incomplete cleanup defect rather than a classic state-transition exploit, so the mapping carries uncertainty.",
                  "The confidentiality impact is assessed as None because the patch does not demonstrate that orphaned records are accessible to unauthorized users; the primary concern is data integrity and retention policy.",
                  "The commit message states the issue was \u0027found during the internal review, not externally reported,\u0027 so no external finder or reporter is credited.",
                  "The CVSS assumes the orphaned data is not directly queryable by other users through existing MISP endpoints; if such access paths exist, the confidentiality impact could be higher."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The event object transitions to a \u0027deleted\u0027 state, but related child objects (report tags, correlations, scan results, ssdeep chunks) do not follow the expected state transition and remain in an active/persisted state. An attacker with delete privileges could exploit this by creating events with sensitive associated data, deleting the event, and then attempting to access the orphaned records through other application endpoints. This is the closest CAPEC to the observed incomplete state propagation; the mapping is uncertain because the primary issue is a maintenance/cleanup defect rather than a directly exploitable state machine flaw."
                  }
                ],
                "commit": "5f78634af8ad2374a51ed979ffbac3084ae5f9d9",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  }
                ],
                "cvssRationale": "The vulnerability is in a web-based application (AV:N) and requires a straightforward authenticated action (AC:L, AT:N). Deleting events requires elevated privileges (PR:H). No user interaction is needed (UI:N). The primary impact is on the integrity of the vulnerable system\u0027s data store: orphaned records persist that should have been removed (VI:L). There is no direct confidentiality impact on the vulnerable system itself because the data was already accessible to the deleting user, and no evidence shows the orphans are exposed to other users (VC:N). No availability impact is demonstrated (VA:N). No impact on subsequent systems (SC:N, SI:N, SA:N).",
                "fixSummary": "The event deletion routine was extended to cascade-remove all associated child records that were previously left behind. Specifically, the fix ensures that event report tags, event graph rows, shadow attribute correlation rows (on both event_id and 1_event_id foreign keys), fuzzy ssdeep chunks, and attachment scan results are all purged within the same transaction as the parent event deletion, eliminating the orphaned-data condition.",
                "generatedAt": "2026-10-19T08:55:14.973651Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "2a311f89681d303b7c915af1a5dbac4a4b7f2998bd50ce77bb78f1586f72cf95",
                "patchSummary": "In app/Model/Event.php, the quickDelete method was modified to: (1) add event_graph and shadow_attribute_correlations (both event_id and 1_event_id) to the relations array used for raw DELETE statements; (2) before executing the raw deletes, query for the IDs of event reports and for attribute/shadow-attribute IDs of type \u0027attachment\u0027 or \u0027malware-sample\u0027; (3) delete EventReportTag rows matching those report IDs; (4) delete AttachmentScan rows matching those attribute IDs; (5) invoke FuzzyCorrelateSsdeep::purge() to remove ssdeep chunks for the event. All operations occur within the existing database transaction.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "5f78634af8ad2374a51ed979ffbac3084ae5f9d9",
                    "date": "Thu, 24 Sep 2026 16:43:27 +0200",
                    "patchSha256": "2a311f89681d303b7c915af1a5dbac4a4b7f2998bd50ce77bb78f1586f72cf95",
                    "source": "https://github.com/MISP/MISP/commit/5f78634af.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/5f78634af.patch",
                    "subject": "fix: [event] Remove every row belonging to an event when"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/5f78634af.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-19T08:55:14Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [event] Remove every row belonging to an event when",
                "tagVersionBoundary": {
                  "commits_after_fix": 33,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-459",
                    "rationale": "The event deletion logic failed to remove all associated child records (report tags, graphs, correlations, ssdeep chunks, scan results), leaving them as orphans in the database. This is a textbook incomplete cleanup of related resources when a parent object is destroyed."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (5f78634af8ad2374a51ed979ffbac3084ae5f9d9): fix: [event] Remove every row belonging to an event when",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/5f78634af.patch"
                    ],
                    "timestamp": "2026-09-24T14:43:27Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20224"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-112180",
    "datePublished": "2026-10-19T09:00:13.049Z",
    "dateReserved": "2026-10-19T09:00:11.375Z",
    "dateUpdated": "2026-10-19T17:19:56.212Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112179",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T18:32:17.990508Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T18:32:29.985Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Event Synchronization"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Event.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "elhoim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report.\u003c/p\u003e\u003cp\u003eAs a result:\u003c/p\u003e\u003cp\u003e- All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance.\u003c/p\u003e\u003cp\u003e- When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event.\u003c/p\u003e\u003cp\u003eThis issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48.\u003c/p\u003e"
            }
          ],
          "value": "In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report.\n\nAs a result:\n\n- All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance.\n\n- When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event.\n\nThis issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization.\n\nAffected: \u003c2.5.48."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-128",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-128 Leverage Executable Code to Alter Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-19T08:52:13Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:53:57.689Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/0be4564a9"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe non-exportable tag filtering is now invoked for each individual event report within the iteration loop, ensuring that restricted tags are removed from every report before it is transmitted to the remote MISP instance. This prevents the leakage of tags that were explicitly marked as non-exportable.\u003c/p\u003e"
            }
          ],
          "value": "The non-exportable tag filtering is now invoked for each individual event report within the iteration loop, ensuring that restricted tags are removed from every report before it is transmitted to the remote MISP instance. This prevents the leakage of tags that were explicitly marked as non-exportable."
        }
      ],
      "title": "MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48 with 34 commits after fix), suggesting the fix is included in v2.5.48 and prior versions are affected. No explicit version range is stated in the patch.",
                  "PR:L assumes that a non-admin authenticated user with push-to-remote permissions can trigger the sync; if only administrators can initiate sync, PR should be raised to H.",
                  "The CAPEC-128 mapping is uncertain; no CAPEC pattern precisely describes a per-item filtering logic error causing data leakage during a legitimate operation.",
                  "The security impact is assessed as limited to tag disclosure; the actual sensitivity of \u0027non-exportable\u0027 tags depends on MISP deployment configuration and is not specified in the patch.",
                  "The availability impact (null report push causing remote save failure) is considered minor and not reflected in the CVSS vector as the primary concern is information disclosure."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-128",
                    "rationale": "This is the closest available CAPEC pattern. The vulnerability arises from a code logic error that causes data (non-exportable tags) to be improperly exposed during a legitimate sync operation. The mapping is uncertain because the issue is a logic bug in data filtering rather than a deliberate attacker action; no CAPEC pattern precisely covers \u0027improper per-item filtering in a loop causing data leakage during a legitimate API operation.\u0027"
                  }
                ],
                "commit": "0be4564a98f37c568a35aa88c5b2bf598a23328a",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  },
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "elhoim"
                  }
                ],
                "cvssRationale": "AV:N: The vulnerability is triggered over the network during MISP-to-MISP synchronization. AC:L: No special conditions are needed beyond a configured sync relationship and an event with multiple reports. AT:N: No attacker interaction is required; the bug triggers on any sync push. PR:L: An authenticated user with permission to push events to a remote server is required. UI:N: No user interaction beyond initiating the sync. VC:L: Non-exportable tags (restricted metadata) are disclosed to the remote instance; the core event data is not exposed. VI:N, VA:N: No integrity or availability impact on the local instance. SC:N, SI:N, SA:N: No impact on the remote instance\u0027s confidentiality, integrity, or availability beyond receiving the tags it should not have.",
                "fixSummary": "The non-exportable tag filtering is now invoked for each individual event report within the iteration loop, ensuring that restricted tags are removed from every report before it is transmitted to the remote MISP instance. This prevents the leakage of tags that were explicitly marked as non-exportable.",
                "generatedAt": "2026-10-19T08:52:13.881684Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "4195b30bddf42380bf30e617b46cdf8e6a5db388a559dc133f98d401f36c35de",
                "patchSummary": "In app/Model/Event.php, the call to __removeNonExportableTags was moved from a single post-loop invocation (which used the last $key value from the foreach) into the else branch of the loop body, so it executes for each non-empty report individually. The post-loop else block that applied the filter to a single report was removed, eliminating both the tag-leakage bug and the null-report push when the last report was empty.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "0be4564a98f37c568a35aa88c5b2bf598a23328a",
                    "date": "Thu, 24 Sep 2026 16:32:31 +0200",
                    "patchSha256": "4195b30bddf42380bf30e617b46cdf8e6a5db388a559dc133f98d401f36c35de",
                    "source": "https://github.com/MISP/MISP/commit/0be4564a9.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/0be4564a9.patch",
                    "subject": "fix: [sync] Filter the tags of every event report pushed to a"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/0be4564a9.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-19T08:52:13Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [sync] Filter the tags of every event report pushed to a",
                "tagVersionBoundary": {
                  "commits_after_fix": 34,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-200",
                    "rationale": "Tags explicitly marked as non-exportable were not filtered from event reports during synchronization, exposing restricted information to the remote MISP instance. The root cause is a logic error (filter applied once instead of per-item), but the security consequence is information disclosure."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (0be4564a98f37c568a35aa88c5b2bf598a23328a): fix: [sync] Filter the tags of every event report pushed to a",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/0be4564a9.patch"
                    ],
                    "timestamp": "2026-09-24T14:32:31Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20283"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-112179",
    "datePublished": "2026-10-19T08:53:57.689Z",
    "dateReserved": "2026-10-19T08:53:56.176Z",
    "dateUpdated": "2026-10-19T18:32:29.985Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112178",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T17:20:26.843308Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T17:20:40.642Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "ShadowAttribute (proposal/shadow attribute handling)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/ShadowAttribute.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "elhoim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user\u0027s sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.\u003c/p\u003e\u003cp\u003e- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute\u0027s distribution level (levels 1-3 should restrict visibility)\u003c/p\u003e\u003cp\u003e- The owning organisation could not view proposals on its own org-only attributes\u003c/p\u003e\u003cp\u003eSecurity impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48\u003c/p\u003e"
            }
          ],
          "value": "MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user\u0027s sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.\n\n- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute\u0027s distribution level (levels 1-3 should restrict visibility)\n\n- The owning organisation could not view proposals on its own org-only attributes\n\nSecurity impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.\n\nAffected: \u003c2.5.48"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-2",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-2 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-19T08:49:14Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:50:52.402Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/9c5af321f"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix enforces the distribution level constraint in the sharing group access check, requiring distribution level 4 (All communities) for the sharing group test to apply. Additionally, the owning organisation is now explicitly granted access to proposals on its own attributes regardless of distribution level, correcting the over-restrictive behavior.\u003c/p\u003e"
            }
          ],
          "value": "The fix enforces the distribution level constraint in the sharing group access check, requiring distribution level 4 (All communities) for the sharing group test to apply. Additionally, the owning organisation is now explicitly granted access to proposals on its own attributes regardless of distribution level, correcting the over-restrictive behavior."
        }
      ],
      "title": "MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The CAPEC mapping (CAPEC-2, Parameter Tampering) is the closest available match but is uncertain; the vulnerability is more accurately a missing authorization check (incomplete ACL evaluation) rather than active parameter manipulation by the attacker.",
                  "The affected version boundary is inferred from the tag v2.5.48 and the commit position (35 commits after the fix); exact version boundaries are not explicitly stated in the patch metadata.",
                  "The second aspect of the vulnerability (owner organisation denied access to its own proposals) is primarily a functional/availability defect rather than a security vulnerability, but is included as part of the same fix and the same root cause (incomplete ACL logic).",
                  "CVSS PR:L assumes the attacker must be an authenticated MISP user with membership in a relevant sharing group; no evidence supports unauthenticated access.",
                  "The Co-Authored-By line credits an AI assistant (Claude Opus 5.5) as a remediation developer; this is recorded as-is from the commit metadata."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-2",
                    "rationale": "The user\u0027s sharing group membership (a parameter of their identity/session) was leveraged by the flawed authorization logic to grant access to proposals without the required distribution level check. This is the closest available CAPEC pattern; the user is not actively tampering with parameters, but the system improperly treats group membership as a sufficient access parameter without enforcing the additional distribution constraint. The mapping is uncertain because the vulnerability is more accurately a missing authorization check than active parameter manipulation."
                  }
                ],
                "commit": "9c5af321fe8f1d2209c8b3c35f4d570d47e9af9e",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  },
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "elhoim"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The user only needs to be a member of a sharing group; no special conditions or race conditions are required. AT:N: No active attack requirements beyond normal API usage. PR:L: The attacker must be an authenticated user with membership in a relevant sharing group. UI:N: No user interaction is required; the check is server-side. VC:H: The user can view proposals (proposed attribute changes) that should be restricted by distribution level, disclosing sensitive information about proposed changes. VI:N: No integrity impact; the user cannot modify proposals. VA:N: No availability impact. SC/SI/SA:N: No impact on subsequent components.",
                "fixSummary": "The fix enforces the distribution level constraint in the sharing group access check, requiring distribution level 4 (All communities) for the sharing group test to apply. Additionally, the owning organisation is now explicitly granted access to proposals on its own attributes regardless of distribution level, correcting the over-restrictive behavior.",
                "generatedAt": "2026-10-19T08:49:14.568262Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "c50a0b040ef7da05d8dffbdc10599991ce441f3fe965e1025620e2e0581b7166",
                "patchSummary": "In the shadow attribute model\u0027s condition builder, the sharing group check for both objects and attributes now includes an AND condition requiring distribution = 4 alongside the sharing_group_id IN check. The attribute distribution condition was changed from a simple sharing_group_id IN clause to a compound AND condition with distribution = 4. A new OR condition (Event.org_id matching the user\u0027s org_id) was added to grant the owning organisation access to proposals on its own attributes.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "9c5af321fe8f1d2209c8b3c35f4d570d47e9af9e",
                    "date": "Thu, 24 Sep 2026 16:23:08 +0200",
                    "patchSha256": "c50a0b040ef7da05d8dffbdc10599991ce441f3fe965e1025620e2e0581b7166",
                    "source": "https://github.com/MISP/MISP/commit/9c5af321f.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/9c5af321f.patch",
                    "subject": "fix: [proposals] Apply the attribute ACL rules to proposals"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/9c5af321f.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-19T08:49:14Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [proposals] Apply the attribute ACL rules to proposals",
                "tagVersionBoundary": {
                  "commits_after_fix": 35,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The authorization check for proposal visibility was missing the distribution level constraint. The system evaluated sharing group membership as sufficient for access without also requiring the distribution level to be 4 (All communities), resulting in an incomplete authorization check that allowed access to proposals on more restrictively distributed attributes."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (9c5af321fe8f1d2209c8b3c35f4d570d47e9af9e): fix: [proposals] Apply the attribute ACL rules to proposals",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/9c5af321f.patch"
                    ],
                    "timestamp": "2026-09-24T14:23:08Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20337"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-112178",
    "datePublished": "2026-10-19T08:50:52.402Z",
    "dateReserved": "2026-10-19T08:50:50.711Z",
    "dateUpdated": "2026-10-19T17:20:40.642Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107278",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T20:28:40.258470Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T20:28:50.215Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "app/Model/MispObject.php"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/MispObject.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance\u0027s validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- Two or more MISP instances are configured to synchronize objects.\u003c/p\u003e\u003cp\u003e- A user with object-creation privileges creates an object without supplying a description.\u003c/p\u003e\u003cp\u003e- The object is subsequently synced to a peer instance.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline.\u003c/p\u003e\u003cp\u003e- The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance\u0027s validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data.\n\nPreconditions:\n\n- Two or more MISP instances are configured to synchronize objects.\n\n- A user with object-creation privileges creates an object without supplying a description.\n\n- The object is subsequently synced to a peer instance.\n\nImpact:\n\n- Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline.\n\n- The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology.\n\nAffected: \u003c2.5.48."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-101",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-101 Application Level DoS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-07T15:41:05Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T15:42:42.472Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/6b1776f07"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe overly strict validation rule that required a non-empty description on MISP Objects during creation was relaxed to permit an empty description. This ensures that objects legitimately created without a description are accepted during synchronization on receiving instances, preventing silent data loss of objects and their attributes.\u003c/p\u003e"
            }
          ],
          "value": "The overly strict validation rule that required a non-empty description on MISP Objects during creation was relaxed to permit an empty description. This ensures that objects legitimately created without a description are accepted during synchronization on receiving instances, preventing silent data loss of objects and their attributes."
        }
      ],
      "title": "MISP Object Sync Drops Objects and Attributes When Description Is Empty",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 36 commits after fix); no explicit \u0027affected\u0027 or \u0027fixed\u0027 version string is provided in the patch.",
                  "The CAPEC-101 mapping is the closest available pattern; the issue is more accurately described as a data-integrity defect during sync rather than a classic DoS, but no CAPEC specifically covers \u0027over-strict validation causing silent data loss during replication\u0027.",
                  "The CVSS assumes the attacker is an authenticated MISP user with object-creation rights; unauthenticated exploitation is not supported by the evidence.",
                  "The commit message states the issue was \u0027found during the internal review, not externally reported\u0027; no external finder or reporter is credited.",
                  "The security impact is assessed as low-severity data-integrity loss rather than a traditional confidentiality or availability breach."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-101",
                    "rationale": "This is the closest available CAPEC. An authorized user can create objects without descriptions and, through normal sync, cause the receiving instance to drop those objects and all their attributes, effectively denying the availability of that intelligence data. The mapping is uncertain because the primary effect is data-integrity loss rather than a classic DoS, and no external unauthenticated attacker is required; however, CAPEC-101 best captures the \u0027valid data is silently discarded, degrading the service\u0027s usefulness\u0027 pattern."
                  }
                ],
                "commit": "6b1776f072e153a4e2cf3af0c210c7aeadfa0469",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  }
                ],
                "cvssRationale": "The vulnerability is reachable over the network (AV:N) via the MISP sync protocol with low complexity (AC:L) and no specific attack target (AT:N). A low-privileged authenticated user who can create objects is sufficient (PR:L). No user interaction is needed (UI:N). There is no confidentiality impact (VC:N). The integrity impact on the victim is low (VI:L) because valid objects and attributes are silently dropped, corrupting the integrity of the receiving instance\u0027s data store. There is no direct availability impact on the victim system itself (VA:N). No secondary impacts are identified (SC:N, SI:N, SA:N). Overall severity is Low.",
                "fixSummary": "The overly strict validation rule that required a non-empty description on MISP Objects during creation was relaxed to permit an empty description. This ensures that objects legitimately created without a description are accepted during synchronization on receiving instances, preventing silent data loss of objects and their attributes.",
                "generatedAt": "2026-10-07T15:41:05.158252Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "17b9854719a40da145be39fc8cf2107bf9d99d02dff2785002fe7a842de88ea1",
                "patchSummary": "In app/Model/MispObject.php, the validation rule for the \u0027description\u0027 field (stringNotEmpty, applied on create) was modified by adding the key \u0027allowEmpty\u0027 set to true. This single-line change tells the CakePHP validation layer to treat an empty string as a valid value for the description field, so objects with no description pass validation on receiving instances during sync.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "6b1776f072e153a4e2cf3af0c210c7aeadfa0469",
                    "date": "Thu, 24 Sep 2026 16:07:34 +0200",
                    "patchSha256": "17b9854719a40da145be39fc8cf2107bf9d99d02dff2785002fe7a842de88ea1",
                    "source": "https://github.com/MISP/MISP/commit/6b1776f07.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/6b1776f07.patch",
                    "subject": "fix: [sync] Accept objects without a description"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/6b1776f07.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-07T15:41:05Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [sync] Accept objects without a description",
                "tagVersionBoundary": {
                  "commits_after_fix": 36,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-20",
                    "rationale": "The validation rule stringNotEmpty was applied without accounting for the legitimate case of an empty description, causing valid input (an object with no description) to be rejected. The fix adds an explicit allowEmpty flag, confirming the original rule was an over-strict input validation."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (6b1776f072e153a4e2cf3af0c210c7aeadfa0469): fix: [sync] Accept objects without a description",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/6b1776f07.patch"
                    ],
                    "timestamp": "2026-09-24T14:07:34Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20215"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-107278",
    "datePublished": "2026-10-07T15:42:42.472Z",
    "dateReserved": "2026-10-07T15:42:40.660Z",
    "dateUpdated": "2026-10-07T20:28:50.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107276",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T20:28:10.510425Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T20:28:21.466Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "UsersController (email OTP login)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/UsersController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request\u0027s deletion takes effect.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- The target MISP instance has email OTP login enabled.\u003c/p\u003e\u003cp\u003e- The attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering).\u003c/p\u003e\u003cp\u003e- The attacker can issue two HTTP POST requests in close temporal proximity.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions.\u003c/p\u003e\u003cp\u003e- This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted.\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request\u0027s deletion takes effect.\n\nPreconditions:\n\n- The target MISP instance has email OTP login enabled.\n\n- The attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering).\n\n- The attacker can issue two HTTP POST requests in close temporal proximity.\n\nImpact:\n\n- The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions.\n\n- This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted.\n\nAffected versions: \u003c2.5.48"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-111",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-111 Race Condition"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-07T15:34:47Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T15:36:49.564Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/ba95e67d5"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix makes OTP consumption atomic by moving the deletion of the OTP from the shared store into the validation condition itself. The return value of the delete operation (1 if the key was actually removed, 0 otherwise) is now part of the success check, so only the request that successfully removes the OTP from the store is permitted to proceed with login. A session-state cleanup call was also added to remove the OTP user reference from the session.\u003c/p\u003e"
            }
          ],
          "value": "The fix makes OTP consumption atomic by moving the deletion of the OTP from the shared store into the validation condition itself. The return value of the delete operation (1 if the key was actually removed, 0 otherwise) is now part of the success check, so only the request that successfully removes the OTP from the store is permitted to proceed with login. A session-state cleanup call was also added to remove the OTP user reference from the session."
        }
      ],
      "title": "MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact affected version range is not explicitly stated in the patch; the tag boundary v2.5.48 with 39 commits after the fix suggests the fix landed shortly after that tag, but the precise first-fixed version is unconfirmed.",
                  "The CAPEC-111 mapping is the closest available; no CAPEC specifically covers OTP replay via race condition, so this is the best-fit pattern.",
                  "CVSS AC:H assumes the race window is narrow and requires precise timing; if the Redis round-trip latency is large, exploitation may be easier, but no evidence supports lowering AC.",
                  "The commit message states the issue was \u0027found during the internal review, not externally reported,\u0027 but no specific individual is named as finder, so no finder credit is assigned.",
                  "PR:N assumes the attacker obtains the OTP through out-of-band means (email interception); if MISP requires prior authentication to request an OTP, PR could be L."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-111",
                    "rationale": "The attack pattern involves an adversary issuing two or more concurrent requests to exploit a non-atomic check-and-use sequence on a shared resource (the OTP in Redis). CAPEC-111 directly describes exploiting timing dependencies between sub-processes. This is the closest CAPEC to the observed vulnerability; no more specific CAPEC for OTP replay via race condition exists in the CAPEC catalog."
                  }
                ],
                "commit": "ba95e67d545efa313435ae39dd481879d72e72e6",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: Exploitation occurs over the network via HTTP POST. AC:H: Exploiting the race condition requires precise timing of two concurrent requests so both read the OTP before either deletes it; this is non-trivial to achieve reliably. AT:N: No data corruption or manipulation is required. PR:N: The attacker does not need prior authentication to MISP; they only need possession of a valid OTP (e.g., intercepted email). UI:N: No victim interaction beyond the initial login flow is needed. VC:N: No direct confidentiality loss of system data. VI:L: The one-time-use property of the OTP is violated, allowing a second authenticated session. VA:N: No availability impact. SC/SI:L: Limited integrity impact on the authentication process; no cross-system impact. SA:N: No impact on security authority.",
                "fixSummary": "The fix makes OTP consumption atomic by moving the deletion of the OTP from the shared store into the validation condition itself. The return value of the delete operation (1 if the key was actually removed, 0 otherwise) is now part of the success check, so only the request that successfully removes the OTP from the store is permitted to proceed with login. A session-state cleanup call was also added to remove the OTP user reference from the session.",
                "generatedAt": "2026-10-07T15:34:47.392474Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "810e97a648a36f87d684f509c51c93636711a31daeab31c5bccbc9466249a7e0",
                "patchSummary": "In UsersController::email_otp(), the $redis-\u003edel() call was moved from after the hash_equals comparison into the if-condition as an additional conjunct. The condition now requires $redis-\u003edel(\u0027misp:otp:\u0027 . $user_id) === 1, meaning only the request whose delete actually removed the key (returning 1) can proceed to Auth-\u003elogin(). A $this-\u003eSession-\u003edelete(\u0027email_otp_user\u0027) call was added before the login step to clean up session state. Net change: 6 insertions, 3 deletions in one file.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "ba95e67d545efa313435ae39dd481879d72e72e6",
                    "date": "Wed, 23 Sep 2026 16:26:22 +0200",
                    "patchSha256": "810e97a648a36f87d684f509c51c93636711a31daeab31c5bccbc9466249a7e0",
                    "source": "https://github.com/MISP/MISP/commit/ba95e67d5.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/ba95e67d5.patch",
                    "subject": "fix: [login] Let only one request spend an e-mailed OTP"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/ba95e67d5.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-07T15:34:47Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [login] Let only one request spend an e-mailed OTP",
                "tagVersionBoundary": {
                  "commits_after_fix": 39,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-362",
                    "rationale": "The OTP stored in Redis is a shared resource accessed by concurrent HTTP requests. The original code performed read, compare, and delete as separate non-atomic operations, allowing two concurrent requests to both read and validate the same OTP before either deletes it. This is a textbook race condition on a shared resource."
                  },
                  {
                    "cweId": "CWE-367",
                    "rationale": "The check (reading and comparing the OTP) and the use (logging in) are separated in time, and the state (OTP presence in the store) can change between the two steps due to a concurrent request. This is a TOCTOU variant of the race condition."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (ba95e67d545efa313435ae39dd481879d72e72e6): fix: [login] Let only one request spend an e-mailed OTP",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/ba95e67d5.patch"
                    ],
                    "timestamp": "2026-09-23T14:26:22Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20315"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-107276",
    "datePublished": "2026-10-07T15:36:49.564Z",
    "dateReserved": "2026-10-07T15:36:46.122Z",
    "dateUpdated": "2026-10-07T20:28:21.466Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107180",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T14:40:43.846815Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T14:40:54.178Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "app/Controller/AppController.php (login / user verification / TOTP enforcement)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/AppController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Tanguy Snoeck"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOn MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser request type, including AJAX/XHR calls, REST API requests, .json format URLs, restSearch queries, or automation actions. Because these machine-readable request shapes cannot follow the redirect that the browser path uses to send the user to the TOTP enrolment page, the guard simply skipped the check and the user retained full access to the instance without completing the required second-factor setup.\u003c/p\u003e\u003cp\u003eThe initial fix (commit 8deb0619e) added a guard specifically for AJAX requests. A follow-up fix (commit 6b527ba6e) broadened the guard to cover every non-browser request shape, while preserving the exemption for identities authenticated via API key (logged_by_authkey flag).\u003c/p\u003e\u003cp\u003eImpact: an authenticated user on an otp_required instance can operate with full access indefinitely without enrolling in TOTP, nullifying the instance-level two-factor authentication policy.\u003c/p\u003e\u003cp\u003eAffected version: \u0026lt;2.5.48\u003c/p\u003e"
            }
          ],
          "value": "On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser request type, including AJAX/XHR calls, REST API requests, .json format URLs, restSearch queries, or automation actions. Because these machine-readable request shapes cannot follow the redirect that the browser path uses to send the user to the TOTP enrolment page, the guard simply skipped the check and the user retained full access to the instance without completing the required second-factor setup.\n\nThe initial fix (commit 8deb0619e) added a guard specifically for AJAX requests. A follow-up fix (commit 6b527ba6e) broadened the guard to cover every non-browser request shape, while preserving the exemption for identities authenticated via API key (logged_by_authkey flag).\n\nImpact: an authenticated user on an otp_required instance can operate with full access indefinitely without enrolling in TOTP, nullifying the instance-level two-factor authentication policy.\n\nAffected version: \u003c2.5.48"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-128",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-128 Exploiting Incorrectly Configured Access Control"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-07T12:45:57Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T12:49:40.483Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/8deb0619e"
        },
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/6b527ba6e"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe TOTP enrolment enforcement in the user verification path was extended from covering only standard browser requests to covering all non-browser request types (AJAX, REST, .json, automation). Any request that cannot follow the browser redirect to the TOTP setup page is now refused with a 403 Forbidden response if the user has not enrolled in TOTP and the instance requires it. Identities authenticated via API key remain exempt, as they are not browser sessions subject to the redirect-based enrolment flow.\u003c/p\u003e"
            }
          ],
          "value": "The TOTP enrolment enforcement in the user verification path was extended from covering only standard browser requests to covering all non-browser request types (AJAX, REST, .json, automation). Any request that cannot follow the browser redirect to the TOTP setup page is now refused with a 403 Forbidden response if the user has not enrolled in TOTP and the instance requires it. Identities authenticated via API key remain exempt, as they are not browser sessions subject to the redirect-based enrolment flow."
        }
      ],
      "title": "MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected MISP version range is not specified in the patch metadata; the vulnerability is assumed to affect all versions prior to the fix commits (8deb0619e and 6b527ba6e) that contain the otp_required enforcement logic without the non-browser request guard.",
                  "The CAPEC-128 mapping is approximate; the bypass is of an authentication requirement (forced TOTP enrolment) rather than a traditional authorization rule, but CAPEC-128 is the closest available pattern for exploiting an access control that is not uniformly applied across all request paths.",
                  "CVSS VC:H assumes that bypassing the mandatory 2FA requirement constitutes a high confidentiality impact on the vulnerability component, as the instance-level security policy (requiring all users to have 2FA) is nullified for the affected user. If the instance\u0027s threat model considers 2FA as a defense-in-depth layer rather than a primary control, VC could be rated Lower.",
                  "The patch evidence does not indicate whether the vulnerability is exploitable by an external unauthenticated attacker; the analysis assumes the attacker is an authenticated user (PR:L) who has not yet enrolled in TOTP.",
                  "The two commits are treated as a single vulnerability per the patch_set_assumption; the first commit is an incomplete fix and the second is the complete fix."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-128",
                    "rationale": "The access control policy requiring TOTP enrolment is incorrectly scoped to only standard browser requests. An attacker (or the legitimate user) exploits this misconfiguration by issuing requests in a non-browser format (AJAX, REST, .json) that the access control check does not cover. This is the closest CAPEC to the observed bypass of a security control due to incomplete scoping of the enforcement logic. The mapping is approximate because the bypass is of an authentication requirement rather than a traditional authorization rule, but CAPEC-128 best captures the pattern of exploiting an access control that is not uniformly applied."
                  }
                ],
                "commit": "6b527ba6e6a32aa574aa050eadf36207506dcea2",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Tanguy Snoeck of NCIA"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5"
                  }
                ],
                "cvssRationale": "AV:N - the bypass is achieved over the network via HTTP requests. AC:L - the attack is trivially simple: change the request type (add X-Requested-With header, append .json, use REST endpoint). AT:N - no special target conditions. PR:L - the attacker needs a valid authenticated session (low privilege: any user account). UI:N - no victim interaction beyond the attacker\u0027s own request. VC:H - the two-factor authentication requirement is completely bypassed, meaning the confidentiality protection provided by mandatory 2FA is nullified; the user retains full data access without the second factor. VI:N, VA:N - no integrity or availability impact on the MISP component. SC:N, SI:N, SA:N - no impact on subsequent components. The primary impact is the bypass of an authentication control (confidentiality of the 2FA gate).",
                "fixSummary": "The TOTP enrolment enforcement in the user verification path was extended from covering only standard browser requests to covering all non-browser request types (AJAX, REST, .json, automation). Any request that cannot follow the browser redirect to the TOTP setup page is now refused with a 403 Forbidden response if the user has not enrolled in TOTP and the instance requires it. Identities authenticated via API key remain exempt, as they are not browser sessions subject to the redirect-based enrolment flow.",
                "generatedAt": "2026-10-07T12:45:57.120635Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "38ec10c8e322eb94d2b27a1bcc10f796f3ee2c2b943034c0944cd811a03cbae3",
                "patchSummary": "In app/Controller/AppController.php, the __verifyUser method was modified. Patch 1 added a conditional block after the $isUserRequest definition that checks: the request is not a standard user request, it is an AJAX request, the user has no TOTP configured, Security.otp_required is enabled, the role does not have perm_skip_otp, and the current action is not one of the allowed exceptions (terms, change_pw, logout, login, totp_new). If all conditions are met, a ForbiddenException is thrown. Patch 2 replaced the $this-\u003erequest-\u003eis(\u0027ajax\u0027) condition with empty($user[\u0027logged_by_authkey\u0027]), broadening the guard to all non-browser request types while explicitly exempting API-key-authenticated sessions.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "8deb0619e5ed6b12a1aa94967c68c977eb05398f",
                    "date": "Wed, 23 Sep 2026 09:53:42 +0200",
                    "patchSha256": "9e42ef967102a3d0699101588e40e27539be35259a88cb334c863f5297bd8210",
                    "source": "https://github.com/MISP/MISP/commit/8deb0619e.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/8deb0619e.patch",
                    "subject": "fix: [login] enforce TOTP enrolment on AJAX requests"
                  },
                  {
                    "commit": "6b527ba6e6a32aa574aa050eadf36207506dcea2",
                    "date": "Mon, 28 Sep 2026 13:55:35 +0200",
                    "patchSha256": "f97d3076e297ea0bd06c87bc95614730333485eb470be8022b0e400a000f1cbf",
                    "source": "https://github.com/MISP/MISP/commit/6b527ba6e.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/6b527ba6e.patch",
                    "subject": "fix: [login] Refuse every unenrolled session request, not"
                  }
                ],
                "source": "patch set (2 sources)",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-07T12:45:57Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [login] Refuse every unenrolled session request, not",
                "weaknessRationale": [
                  {
                    "cweId": "CWE-287",
                    "rationale": "The TOTP (two-factor) authentication requirement is not properly enforced across all request types. The authentication gate (forced TOTP enrolment) is bypassed for non-browser requests, allowing a user to operate without completing the required second factor. This is a failure to properly enforce an authentication requirement."
                  },
                  {
                    "cweId": "CWE-306",
                    "rationale": "The critical function of enforcing TOTP enrolment on otp_required instances is missing for AJAX, REST, .json, and automation request paths. The authentication check is present for browser requests but absent for all other request shapes, constituting a missing authentication control on a critical security function."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (8deb0619e5ed6b12a1aa94967c68c977eb05398f): fix: [login] enforce TOTP enrolment on AJAX requests",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/8deb0619e.patch"
                    ],
                    "timestamp": "2026-09-23T07:53:42Z",
                    "type": "fix-developed"
                  },
                  {
                    "description": "Corrective change authored (6b527ba6e6a32aa574aa050eadf36207506dcea2): fix: [login] Refuse every unenrolled session request, not",
                    "id": "evt-fix-developed-2",
                    "references": [
                      "https://github.com/MISP/MISP/commit/6b527ba6e.patch"
                    ],
                    "timestamp": "2026-09-28T11:55:35Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20116"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-107180",
    "datePublished": "2026-10-07T12:49:40.483Z",
    "dateReserved": "2026-10-07T12:49:37.658Z",
    "dateUpdated": "2026-10-07T14:40:54.178Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107175",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T14:39:59.827397Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T14:40:14.998Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Event model (app/Model/Event.php)",
            "Correlation engine"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Event.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event\u0027s distribution level or sharing group is modified.\u003c/p\u003e\u003cp\u003eWhen a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted.\u003c/p\u003e\u003cp\u003eSecurity impact:\u003c/p\u003e\u003cp\u003e- Stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure.\u003c/p\u003e\u003cp\u003e- Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- An authenticated user with write access to at least one MISP event.\u003c/p\u003e\u003cp\u003e- The user modifies the event\u0027s distribution or sharing_group_id field.\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event\u0027s distribution level or sharing group is modified.\n\nWhen a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted.\n\nSecurity impact:\n\n- Stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure.\n\n- Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing.\n\nPreconditions:\n\n- An authenticated user with write access to at least one MISP event.\n\n- The user modifies the event\u0027s distribution or sharing_group_id field.\n\nAffected versions: \u003c2.5.48"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-114 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-07T12:35:42Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-665",
              "description": "CWE-665 Improper Initialization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T12:38:44.252Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/19a389d19"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly.\u003c/p\u003e"
            }
          ],
          "value": "The fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly."
        }
      ],
      "title": "MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact fixed version number is not specified in the patch metadata; the tag boundary indicates the fix is 47 commits after v2.5.48, but the release tag containing this commit is unknown.",
                  "The security impact is assessed as limited information disclosure through stale correlations; the patch does not indicate a direct privilege escalation or data corruption vector.",
                  "CAPEC-114 (Parameter Tampering) is the closest available mapping; no CAPEC specifically covers \u0027stale derived data after a legitimate parameter change\u0027 and the mapping is approximate.",
                  "The assumption that the afterSave hook uses __beforeSaveData to compare old vs new distribution/sharing_group_id values is inferred from the commit message and the code change pattern; the afterSave code itself is not included in the patch.",
                  "CVSS UI:N assumes the stale correlation data is accessible via the normal MISP UI/API without additional user interaction beyond the initial event edit.",
                  "The Co-Authored-By line for Claude Opus 4.8 is treated as a tool credit, not a human remediation developer."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-114",
                    "rationale": "The closest plausible CAPEC is Parameter Tampering: a user modifies the distribution or sharing_group_id parameters of an event, and the application fails to properly enforce the resulting access-control changes on correlated data. The mapping is uncertain because this is not a malicious tamper per se but a legitimate parameter modification that exposes a system defect; however, CAPEC-114 best captures the scenario where parameter changes are not properly reflected in downstream access enforcement. No more specific CAPEC for \u0027stale derived data after parameter change\u0027 exists in the CAPEC catalog."
                  }
                ],
                "commit": "19a389d19f65e25ba3328e72e6ad23919a39ccd0",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: An authenticated user simply edits an event\u0027s sharing group; no race condition or complex setup is needed. AT:N: No manipulation of a separate attack target is required. PR:L: Requires an authenticated user with write access to events. UI:N: The stale correlation persists without further user interaction. VC/VI/VA:N: The vulnerable component (the event save logic) is not directly compromised in confidentiality, integrity, or availability. SC:L: The security impact is on the broader MISP instance: users in a broader sharing group may see correlation data referencing an event that was moved to a more restrictive group, resulting in limited information disclosure. SI/SA:N: No integrity or safety impact on other systems.",
                "fixSummary": "The fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly.",
                "generatedAt": "2026-10-07T12:35:42.209027Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 6,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "a23e99457b847b37183a6159eec9860f3cc8243bae000bc81cbd3449fa7aa225",
                "patchSummary": "In app/Model/Event.php, the beforeSave method was modified. Previously, $this-\u003e__beforeSaveData was set to the full incoming $this-\u003edata[\u0027Event\u0027] array. The patch replaces this with: (1) initializing __beforeSaveData to null, (2) checking whether the event has an existing id (i.e., it is an update, not a create), (3) issuing a targeted database query (recursive -1, selecting only Event.distribution and Event.sharing_group_id) to fetch the currently stored values, and (4) storing those fetched values in __beforeSaveData. This ensures the after-save comparison correctly identifies distribution/sharing_group_id changes.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "19a389d19f65e25ba3328e72e6ad23919a39ccd0",
                    "date": "Wed, 23 Sep 2026 09:41:31 +0200",
                    "patchSha256": "a23e99457b847b37183a6159eec9860f3cc8243bae000bc81cbd3449fa7aa225",
                    "source": "https://github.com/MISP/MISP/commit/19a389d19.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/19a389d19.patch",
                    "subject": "fix: [correlation] fix correlation distribution refresh on"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/19a389d19.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-07T12:35:42Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [correlation] fix correlation distribution refresh on",
                "tagVersionBoundary": {
                  "commits_after_fix": 47,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-284",
                    "rationale": "The core security impact is that correlation data access boundaries are not enforced when an event\u0027s sharing group or distribution changes. Stale correlations can expose event data to users who should no longer have access, constituting an improper access control failure."
                  },
                  {
                    "cweId": "CWE-665",
                    "rationale": "The root cause is that the __beforeSaveData variable was initialized with the incoming (new) data rather than the previously stored data, causing the change-detection logic in afterSave to fail. This is a classic improper initialization of a state variable used for change detection."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (19a389d19f65e25ba3328e72e6ad23919a39ccd0): fix: [correlation] fix correlation distribution refresh on",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/19a389d19.patch"
                    ],
                    "timestamp": "2026-09-23T07:41:31Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20264"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-107175",
    "datePublished": "2026-10-07T12:38:44.252Z",
    "dateReserved": "2026-10-07T12:38:41.839Z",
    "dateUpdated": "2026-10-07T14:40:14.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112192",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T17:13:11.731385Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T17:13:51.582Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "app/Model/Server.php (readModuleSettings)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Server.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata.\u003c/p\u003e\u003cp\u003eAs a result:\u003c/p\u003e\u003cp\u003e- A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings.\u003c/p\u003e\u003cp\u003e- A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction.\u003c/p\u003e\u003cp\u003eAn authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata.\n\nAs a result:\n\n- A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings.\n\n- A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction.\n\nAn authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access.\n\nAffected: \u003c2.5.48"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Sensitive Data Discovery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-19T09:23:47Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T10:06:28.714Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/6c02f0f5c"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix ensures that the redacted and cli_only flags declared by a module in its own setting definition are preserved when the server rebuilds the setting for API exposure. By carrying these flags through to the final setting object, the existing enforcement logic (which checks these flags before serving values or accepting edits) now correctly applies to module-supplied settings, preventing disclosure of redacted values and blocking API-based modification of CLI-only settings.\u003c/p\u003e"
            }
          ],
          "value": "The fix ensures that the redacted and cli_only flags declared by a module in its own setting definition are preserved when the server rebuilds the setting for API exposure. By carrying these flags through to the final setting object, the existing enforcement logic (which checks these flags before serving values or accepting edits) now correctly applies to module-supplied settings, preventing disclosure of redacted values and blocking API-based modification of CLI-only settings."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (fix is 10 commits after v2.5.48); the exact fixed release version is not stated in the patch metadata.",
                  "PR:L assumes that reading server settings requires an authenticated MISP user with appropriate role permissions; the patch does not specify the exact permission level required.",
                  "The CAPEC-126 mapping is the closest available pattern for the information-disclosure aspect; the authorization-bypass aspect (cli_only) does not have a precise CAPEC match and is subsumed under the same mapping.",
                  "VC:L assumes the exposed data is limited to module-specific API keys rather than system-wide credentials; the actual sensitivity depends on which modules are installed.",
                  "The commit message references a separate issue (branch read) reported by Jeroen Pinoy; this vulnerability was discovered as a side effect of fixing that issue, so Jeroen Pinoy is not credited as a finder of this specific vulnerability."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The primary impact is that sensitive data (module API keys marked as redacted) is discoverable via standard API endpoints because the redaction flag was not enforced. An authenticated user querying server settings can obtain credentials that the module author intended to keep hidden. This is the closest CAPEC to the information-disclosure aspect of the vulnerability. The secondary aspect (CLI-only settings editable via API) is an authorization bypass that does not map cleanly to a single CAPEC; CAPEC-126 is selected as the best available match for the overall pattern of accessing data that should be restricted."
                  }
                ],
                "commit": "6c02f0f5c33aab96e90df8791c3873303d7e99ce",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a web application accessible over the network. AC:L: No special race conditions or complex setup are needed; a standard API call to the settings endpoint triggers the issue. AT:N: No manipulation of the attack target is required. PR:L: The attacker needs an authenticated MISP account with permission to view server settings. UI:N: No user interaction is required. VC:L: Sensitive module API keys are exposed, but the scope is limited to settings of modules that declare the redacted flag. VI:N: No direct integrity impact on the vulnerable component\u0027s data beyond the VA impact. VA:L: CLI-only settings can be modified via the API, representing a limited integrity impact on the vulnerable component\u0027s configuration. SC/SI/SA:N: No evidence of impact on other components or systems.",
                "fixSummary": "The fix ensures that the redacted and cli_only flags declared by a module in its own setting definition are preserved when the server rebuilds the setting for API exposure. By carrying these flags through to the final setting object, the existing enforcement logic (which checks these flags before serving values or accepting edits) now correctly applies to module-supplied settings, preventing disclosure of redacted values and blocking API-based modification of CLI-only settings.",
                "generatedAt": "2026-10-19T09:23:47.526920Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "e7e99bab776b221dd41bf562693fc308d8a2ee619806b1bfef26bb008212205a",
                "patchSummary": "In app/Model/Server.php, within the readModuleSettings() method, a loop was added after the setting fields are populated that iterates over the strings \u0027redacted\u0027 and \u0027cli_only\u0027. For each flag, if the module\u0027s own result array contains a truthy value for that key, the flag is set to true on the rebuilt $setting object before it is stored in $serverSettings. This is a 6-line addition that preserves the module-declared guard flags that were previously discarded during the setting reconstruction.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "6c02f0f5c33aab96e90df8791c3873303d7e99ce",
                    "date": "Mon, 28 Sep 2026 12:14:28 +0200",
                    "patchSha256": "e7e99bab776b221dd41bf562693fc308d8a2ee619806b1bfef26bb008212205a",
                    "source": "https://github.com/MISP/MISP/commit/6c02f0f5c.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/6c02f0f5c.patch",
                    "subject": "fix: [settings] Module settings keep the flags the module"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/6c02f0f5c.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-19T09:23:47Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [settings] Module settings keep the flags the module",
                "tagVersionBoundary": {
                  "commits_after_fix": 10,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-200",
                    "rationale": "The redacted flag, which instructs the server to mask a setting\u0027s value (e.g., an API key), was dropped during setting reconstruction. This caused the sensitive value to be served in plaintext via API endpoints to any authenticated user, constituting an information exposure."
                  },
                  {
                    "cweId": "CWE-862",
                    "rationale": "The cli_only flag, which restricts a setting to command-line modification only, was dropped during setting reconstruction. This allowed the setting to be modified via the web API without the intended authorization restriction, effectively bypassing the access control the module author specified."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (6c02f0f5c33aab96e90df8791c3873303d7e99ce): fix: [settings] Module settings keep the flags the module",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/6c02f0f5c.patch"
                    ],
                    "timestamp": "2026-09-28T10:14:28Z",
                    "type": "fix-developed"
                  },
                  {
                    "description": "Fix released in MISP v2.5.48.",
                    "id": "evt-fix-available-1",
                    "referencedEvents": [
                      "evt-fix-developed-1"
                    ],
                    "references": [
                      "https://github.com/MISP/MISP/releases/tag/v2.5.48"
                    ],
                    "timestamp": "2026-09-29T08:11:29Z",
                    "type": "fix-available"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20310"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-112192",
    "datePublished": "2026-10-19T09:28:08.054Z",
    "dateReserved": "2026-10-19T09:28:06.573Z",
    "dateUpdated": "2026-10-30T10:06:28.714Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112188",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-28T17:47:38.444785Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-28T20:05:58.430Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Server settings (app/Model/Server.php)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Server.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.\u003c/p\u003e\u003cp\u003eThe settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys.\u003c/p\u003e\u003cp\u003eA second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller.\u003c/p\u003e\u003cp\u003eThe impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints.\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.\n\nThe settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys.\n\nA second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller.\n\nThe impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints.\n\nAffected versions: \u003c2.5.48."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-124",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-124 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "total"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-19T09:21:00Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:22:37.880Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/30b849102"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe settings lookup function now validates that the resolved node is a leaf setting (has a \u0027level\u0027 property and is not an array representing a branch). If the resolved node is a branch or otherwise does not represent a single setting, the function returns false, indicating an invalid setting. This prevents the redaction check from being bypassed and stops the endpoints from returning entire configuration branches containing sensitive values.\u003c/p\u003e"
            }
          ],
          "value": "The settings lookup function now validates that the resolved node is a leaf setting (has a \u0027level\u0027 property and is not an array representing a branch). If the resolved node is a branch or otherwise does not represent a single setting, the function returns false, indicating an invalid setting. This prevents the redaction check from being bypassed and stops the endpoints from returning entire configuration branches containing sensitive values."
        }
      ],
      "title": "MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact privilege level required to access the server settings endpoints (admin vs. any authenticated user) is not stated in the patch; PR:L is assumed as the most conservative defensible value.",
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48 with 11 commits after fix); the exact last affected version and first fixed version are not explicitly confirmed.",
                  "CAPEC-124 (Parameter Tampering) is the closest available attack pattern; no CAPEC specifically models configuration-tree branch traversal, so the mapping is approximate.",
                  "The patch does not indicate whether unauthenticated access is possible; authentication is assumed based on the nature of server settings endpoints in MISP.",
                  "The Co-Authored-By line references an AI tool (Claude Opus 5); it is listed as a tool credit rather than a human remediation developer."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-124",
                    "rationale": "The attacker manipulates the setting name parameter supplied to the settings lookup endpoint, substituting a branch name (e.g., \u0027Security\u0027) for a leaf setting name. This causes the application to return a broader data set than intended. CAPEC-124 is the closest match because the core technique is altering a request parameter to change the application\u0027s response scope. The mapping is approximate because the parameter is not a traditional HTTP parameter but an application-level setting identifier; no CAPEC specifically covers configuration-tree traversal."
                  }
                ],
                "commit": "30b849102c687bb53919f1d5d20851bc20fafa4e",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The attack requires only substituting a branch name for a leaf setting name in an existing API call; no race conditions or complex timing are needed. AT:N: No manipulation of the target environment is required. PR:L: The attacker needs an authenticated account with access to the server settings endpoints; the exact privilege level (admin vs. regular user) is not confirmed in the patch, so Low is assumed. UI:N: No victim interaction is required. VC:H: Sensitive secrets (security salt, Redis passwords, plugin API keys) are fully disclosed. VI:N, VA:N: No integrity or availability impact is evidenced. SC:N, SI:N, SA:N: No impact on subsequent components is indicated.",
                "fixSummary": "The settings lookup function now validates that the resolved node is a leaf setting (has a \u0027level\u0027 property and is not an array representing a branch). If the resolved node is a branch or otherwise does not represent a single setting, the function returns false, indicating an invalid setting. This prevents the redaction check from being bypassed and stops the endpoints from returning entire configuration branches containing sensitive values.",
                "generatedAt": "2026-10-19T09:21:00.388917Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "70885748c270bb21036c46d9142ef00525834a5c03669c4c4a856d7db6ef58e2",
                "patchSummary": "In app/Model/Server.php, the getSettingData() method previously checked only for the presence of a \u0027level\u0027 key before returning the setting. The patch adds a guard clause: if the resolved setting is an array (i.e., a branch/sub-tree) or lacks the \u0027level\u0027 key, the function immediately returns false. The existing logic for setting the name and resolving options is then applied only to confirmed leaf settings. This ensures callers that assumed a single-setting result never receive a multi-key branch.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "30b849102c687bb53919f1d5d20851bc20fafa4e",
                    "date": "Mon, 28 Sep 2026 12:03:56 +0200",
                    "patchSha256": "70885748c270bb21036c46d9142ef00525834a5c03669c4c4a856d7db6ef58e2",
                    "source": "https://github.com/MISP/MISP/commit/30b849102.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/30b849102.patch",
                    "subject": "fix: [settings] Server setting lookups address one setting,"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/30b849102.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "total"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-19T09:21:00Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [settings] Server setting lookups address one setting,",
                "tagVersionBoundary": {
                  "commits_after_fix": 11,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-200",
                    "rationale": "The settings endpoint returned sensitive configuration values (security salt, Redis passwords, plugin API keys) to a caller who requested a branch name, bypassing the intended redaction mechanism. The data was exposed to an actor who should not have had access to those specific values."
                  },
                  {
                    "cweId": "CWE-285",
                    "rationale": "The redaction check, which serves as an authorization control for sensitive setting values, was effectively bypassed because branch nodes do not carry a redacted flag. The system failed to enforce the intended access restriction on sensitive configuration data."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (30b849102c687bb53919f1d5d20851bc20fafa4e): fix: [settings] Server setting lookups address one setting,",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/30b849102.patch"
                    ],
                    "timestamp": "2026-09-28T10:03:56Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20327"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-112188",
    "datePublished": "2026-10-19T09:22:37.880Z",
    "dateReserved": "2026-10-19T09:22:31.139Z",
    "dateUpdated": "2026-10-28T20:05:58.430Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112184",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T17:14:29.630953Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T17:14:52.401Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Workflow Modules (Module_misp_module)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/WorkflowModules/Module_misp_module.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user\u0027s browser.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- The attacker must be able to control or influence parameter names reported by the misp-modules service.\u003c/p\u003e\u003cp\u003e- A victim must be authenticated and view the affected workflow module page.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Execution of arbitrary JavaScript in the victim\u0027s browser session.\u003c/p\u003e\u003cp\u003e- Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim.\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user\u0027s browser.\n\nPreconditions:\n\n- The attacker must be able to control or influence parameter names reported by the misp-modules service.\n\n- A victim must be authenticated and view the affected workflow module page.\n\nImpact:\n\n- Execution of arbitrary JavaScript in the victim\u0027s browser session.\n\n- Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim.\n\nAffected versions: \u003c2.5.48."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 XSS - Reflected"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-19T09:16:56Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:19:45.056Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/813a48b2b"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix applies HTML output encoding (the h() helper) to the parameter name before it is used as a form label, ensuring that any HTML metacharacters in the value are neutralized and rendered as inert text rather than executable markup.\u003c/p\u003e"
            }
          ],
          "value": "The fix applies HTML output encoding (the h() helper) to the parameter name before it is used as a form label, ensuring that any HTML metacharacters in the value are neutralized and rendered as inert text rather than executable markup."
        }
      ],
      "title": "MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The misp-modules service is assumed to be a component whose output can be influenced by a module developer or a compromised service endpoint; the exact attack vector for injecting a malicious parameter name is not detailed in the patch.",
                  "MISP requires authentication to access the workflow module page; PR:L is assumed based on MISP\u0027s standard access model.",
                  "The affected version boundary (\u003c 2.5.48) is inferred from the tag_version_boundary metadata (v2.5.48, 25 commits after fix); the exact first affected version is not specified.",
                  "CAPEC-1 (Reflected XSS) is the closest match; the data source is a backend service rather than a direct request parameter, but the unencoded reflection into HTML is the defining characteristic.",
                  "The h() function is assumed to be CakePHP\u0027s HTML-encoding helper (equivalent to htmlspecialchars), based on the framework context of the MISP codebase."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "The misp-modules service supplies parameter names that are reflected into the HTML of the workflow module page without encoding. The attacker-controlled data flows from an external source into the rendered output, matching the reflected XSS pattern. Uncertainty: the data originates from a backend service rather than a direct HTTP parameter, but the effect (untrusted data reflected into HTML without encoding) is functionally identical to reflected XSS."
                  }
                ],
                "commit": "813a48b2bac0c9034f532b9181ac9a0c5fa59857",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N \u2013 web-based, reachable over the network. AC:L \u2013 no race or special timing; the misp-modules service simply needs to return a crafted parameter name. AT:N \u2013 no manipulation of the target system required. PR:L \u2013 the victim must be an authenticated MISP user to view the workflow module page. UI:A \u2013 the victim must actively load the workflow module page for the script to execute. VC/VI/VA:N \u2013 the MISP server itself is not compromised. SC:L \u2013 the attacker can read cookies or session data in the victim\u0027s browser. SI:L \u2013 the attacker can modify the page or perform actions in the victim\u0027s session. SA:N \u2013 no elevation of security authority on the server.",
                "fixSummary": "The fix applies HTML output encoding (the h() helper) to the parameter name before it is used as a form label, ensuring that any HTML metacharacters in the value are neutralized and rendered as inert text rather than executable markup.",
                "generatedAt": "2026-10-19T09:16:56.467726Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "691d31d09a8db397d602b6d179507339a60ca0125e91b55d408353abf8473bac",
                "patchSummary": "In app/Model/WorkflowModules/Module_misp_module.php, the translateParams method was modified: the \u0027label\u0027 array element changed from Inflector::humanize($paramName) to h(Inflector::humanize($paramName)), wrapping the humanized parameter name in CakePHP\u0027s HTML-encoding function before it is assigned as a form label.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "813a48b2bac0c9034f532b9181ac9a0c5fa59857",
                    "date": "Fri, 25 Sep 2026 00:12:54 +0200",
                    "patchSha256": "691d31d09a8db397d602b6d179507339a60ca0125e91b55d408353abf8473bac",
                    "source": "https://github.com/MISP/MISP/commit/813a48b2b.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/813a48b2b.patch",
                    "subject": "fix: [workflows] Escape misp-module parameter names used as"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/813a48b2b.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-19T09:16:56Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [workflows] Escape misp-module parameter names used as",
                "tagVersionBoundary": {
                  "commits_after_fix": 25,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "The parameter name from an external service is inserted into HTML output (a form label) without HTML encoding, allowing injected markup or script to execute in the victim\u0027s browser. This is a textbook reflected XSS."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (813a48b2bac0c9034f532b9181ac9a0c5fa59857): fix: [workflows] Escape misp-module parameter names used as",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/813a48b2b.patch"
                    ],
                    "timestamp": "2026-09-24T22:12:54Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20332"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-112184",
    "datePublished": "2026-10-19T09:19:45.056Z",
    "dateReserved": "2026-10-19T09:19:41.258Z",
    "dateUpdated": "2026-10-19T17:14:52.401Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112183",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T17:15:24.498800Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T17:15:45.687Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Servers/preview_event (remote event preview)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/View/Servers/preview_event.ctp"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity encoding is applied, the value is interpreted as CSS within the style attribute, allowing a malicious or compromised linked server to inject arbitrary CSS declarations.\u003c/p\u003e\u003cp\u003eAn attacker with the ability to create or modify tags on a linked MISP instance can craft a tag colour value containing CSS injection payloads. When a user on the local instance views the event preview, the injected CSS is rendered, potentially allowing UI manipulation, visual spoofing, or limited information disclosure through CSS-based techniques.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- A linked MISP server relationship exists between the victim instance and the attacker-controlled instance.\u003c/p\u003e\u003cp\u003e- The attacker can create or modify tags on the linked server.\u003c/p\u003e\u003cp\u003e- A victim user views the remote event preview page.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity encoding is applied, the value is interpreted as CSS within the style attribute, allowing a malicious or compromised linked server to inject arbitrary CSS declarations.\n\nAn attacker with the ability to create or modify tags on a linked MISP instance can craft a tag colour value containing CSS injection payloads. When a user on the local instance views the event preview, the injected CSS is rendered, potentially allowing UI manipulation, visual spoofing, or limited information disclosure through CSS-based techniques.\n\nPreconditions:\n\n- A linked MISP server relationship exists between the victim instance and the attacker-controlled instance.\n\n- The attacker can create or modify tags on the linked server.\n\n- A victim user views the remote event preview page.\n\nAffected: \u003c2.5.48."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 Leveraging Trusted Relationships"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-19T09:01:35Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:15:47.453Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/91323b517"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces strict validation of the tag colour value before it is rendered into a CSS style attribute. Only values matching a valid six-digit hexadecimal colour pattern (e.g. #aabbcc) are accepted; any other value is replaced with a safe default (#ffffff). This prevents arbitrary CSS from being injected through the colour field, aligning the remote tag handling with the validation already applied to local tags.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces strict validation of the tag colour value before it is rendered into a CSS style attribute. Only values matching a valid six-digit hexadecimal colour pattern (e.g. #aabbcc) are accepted; any other value is replaced with a safe default (#ffffff). This prevents arbitrary CSS from being injected through the colour field, aligning the remote tag handling with the validation already applied to local tags."
        }
      ],
      "title": "MISP CSS Injection via Remote Tag Colour in Event Preview",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 27 commits after fix); the exact first affected version is not stated in the patch.",
                  "PR:L assumes that creating or modifying a tag on a linked MISP server requires only low-level user privileges; the exact permission model was not verified from the patch.",
                  "SC:L assumes CSS injection could enable limited client-side information disclosure (e.g., via CSS selectors or layout manipulation); full XSS or data exfiltration is not evidenced.",
                  "CAPEC-66 is the closest available mapping; no CAPEC specifically models CSS injection via trusted inter-instance data, so this mapping carries uncertainty.",
                  "The commit message states the issue was found during internal review and not externally reported; no external finder or reporter is credited.",
                  "The Co-Authored-By line references an AI tool (Claude Opus 5.5); it is credited as a tool rather than a human remediation developer."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-66",
                    "rationale": "The attack exploits the inherent trust between linked MISP instances. The local instance accepts and renders data (tag colours) from a remote linked server without sufficient validation, assuming the data is well-formed. The attacker leverages this trusted relationship to inject CSS. This is the closest CAPEC; no CAPEC specifically models CSS injection via trusted data sources, so CAPEC-66 is the best available match."
                  }
                ],
                "commit": "91323b517bb5a34f413363faf8703a3c0a1a9904",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N \u2013 the attack originates from a remote linked MISP server over the network. AC:L \u2013 no race conditions or special timing; simply setting a tag colour suffices. AT:N \u2013 no manipulation of the attack target is required. PR:L \u2013 the attacker needs low-privilege access (tag creation) on the linked server. UI:A \u2013 the victim must actively navigate to the event preview page. VC:N \u2013 no direct confidentiality loss on the vulnerable system. VI:N \u2013 no integrity impact on the vulnerable system\u0027s data. VA:N \u2013 no availability impact. SC:L \u2013 CSS injection may allow limited information disclosure on the client (e.g., reading page structure via CSS selectors or side channels). SI:L \u2013 the attacker can modify the visual presentation of the preview page (UI manipulation, overlay, spoofing). SA:N \u2013 no security authority impact.",
                "fixSummary": "The fix introduces strict validation of the tag colour value before it is rendered into a CSS style attribute. Only values matching a valid six-digit hexadecimal colour pattern (e.g. #aabbcc) are accepted; any other value is replaced with a safe default (#ffffff). This prevents arbitrary CSS from being injected through the colour field, aligning the remote tag handling with the validation already applied to local tags.",
                "generatedAt": "2026-10-19T09:01:35.918427Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 6,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "8be436940ffd0e21b7145fcb604ebfb0b529f6bbac717ee5cdf38c2e0dc2904e",
                "patchSummary": "In app/View/Servers/preview_event.ctp, a regex check (preg_match against /^#[0-9a-f]{6}$/i) is added before the tag colour is used. If the colour does not match the hex pattern, it defaults to #ffffff. The validated $colour variable replaces the raw $tag[\u0027colour\u0027] in both the background-color style property and the getTextColour() call, eliminating the untrusted value from the CSS context.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "91323b517bb5a34f413363faf8703a3c0a1a9904",
                    "date": "Thu, 24 Sep 2026 23:54:30 +0200",
                    "patchSha256": "8be436940ffd0e21b7145fcb604ebfb0b529f6bbac717ee5cdf38c2e0dc2904e",
                    "source": "https://github.com/MISP/MISP/commit/91323b517.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/91323b517.patch",
                    "subject": "fix: [sync] Only use a valid colour for remote tags in the"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/91323b517.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-19T09:01:35Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [sync] Only use a valid colour for remote tags in the",
                "tagVersionBoundary": {
                  "commits_after_fix": 27,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-74",
                    "rationale": "The tag colour value is not neutralized for the CSS context in which it is placed. HTML entity encoding (h()) does not sanitize CSS metacharacters such as semicolons, colons, or function calls, allowing CSS injection. CWE-74 is the most precise parent weakness covering injection into a downstream component (CSS) without a more specific child CWE for CSS injection."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (91323b517bb5a34f413363faf8703a3c0a1a9904): fix: [sync] Only use a valid colour for remote tags in the",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/91323b517.patch"
                    ],
                    "timestamp": "2026-09-24T21:54:30Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20339"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-112183",
    "datePublished": "2026-10-19T09:15:47.453Z",
    "dateReserved": "2026-10-19T09:15:45.556Z",
    "dateUpdated": "2026-10-19T17:15:45.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112180",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T17:19:43.619080Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T17:19:56.212Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Event model (app/Model/Event.php)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Event.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThanOrEqual": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal (shadow attribute) correlations, fuzzy ssdeep correlation chunks, and attachment scan results.\u003c/p\u003e\u003cp\u003eThese orphaned records may contain sensitive threat intelligence data such as correlation mappings, scan results, and report metadata that should have been removed along with the parent event. Their persistence beyond the intended deletion lifecycle creates a risk of unintended data retention and potential information exposure if the records are reachable through other application queries or administrative interfaces.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- An authenticated user with sufficient privileges to delete events in MISP.\u003c/p\u003e\u003cp\u003e- The event must have associated reports, graphs, correlations, ssdeep chunks, or attachment scan results.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Residual sensitive data persists in the database after the parent event is deleted.\u003c/p\u003e\u003cp\u003e- Accumulation of orphaned records over time may contribute to storage bloat.\u003c/p\u003e\u003cp\u003e- Orphaned records may be inadvertently exposed through other data-access paths that do not validate the existence of the parent event.\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal (shadow attribute) correlations, fuzzy ssdeep correlation chunks, and attachment scan results.\n\nThese orphaned records may contain sensitive threat intelligence data such as correlation mappings, scan results, and report metadata that should have been removed along with the parent event. Their persistence beyond the intended deletion lifecycle creates a risk of unintended data retention and potential information exposure if the records are reachable through other application queries or administrative interfaces.\n\nPreconditions:\n\n- An authenticated user with sufficient privileges to delete events in MISP.\n\n- The event must have associated reports, graphs, correlations, ssdeep chunks, or attachment scan results.\n\nImpact:\n\n- Residual sensitive data persists in the database after the parent event is deleted.\n\n- Accumulation of orphaned records over time may contribute to storage bloat.\n\n- Orphaned records may be inadvertently exposed through other data-access paths that do not validate the existence of the parent event.\n\nAffected versions: \u003c2.5.48"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Exploiting Incorrect Object State Transition"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-19T08:55:14Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-459",
              "description": "CWE-459 Incomplete Cleanup",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:00:13.049Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/5f78634af"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe event deletion routine was extended to cascade-remove all associated child records that were previously left behind. Specifically, the fix ensures that event report tags, event graph rows, shadow attribute correlation rows (on both event_id and 1_event_id foreign keys), fuzzy ssdeep chunks, and attachment scan results are all purged within the same transaction as the parent event deletion, eliminating the orphaned-data condition.\u003c/p\u003e"
            }
          ],
          "value": "The event deletion routine was extended to cascade-remove all associated child records that were previously left behind. Specifically, the fix ensures that event report tags, event graph rows, shadow attribute correlation rows (on both event_id and 1_event_id foreign keys), fuzzy ssdeep chunks, and attachment scan results are all purged within the same transaction as the parent event deletion, eliminating the orphaned-data condition."
        }
      ],
      "title": "MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48 with 33 commits after fix); the exact fixed release version is not specified in the patch.",
                  "The CAPEC-126 mapping is the closest available match; the vulnerability is fundamentally an incomplete cleanup defect rather than a classic state-transition exploit, so the mapping carries uncertainty.",
                  "The confidentiality impact is assessed as None because the patch does not demonstrate that orphaned records are accessible to unauthorized users; the primary concern is data integrity and retention policy.",
                  "The commit message states the issue was \u0027found during the internal review, not externally reported,\u0027 so no external finder or reporter is credited.",
                  "The CVSS assumes the orphaned data is not directly queryable by other users through existing MISP endpoints; if such access paths exist, the confidentiality impact could be higher."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The event object transitions to a \u0027deleted\u0027 state, but related child objects (report tags, correlations, scan results, ssdeep chunks) do not follow the expected state transition and remain in an active/persisted state. An attacker with delete privileges could exploit this by creating events with sensitive associated data, deleting the event, and then attempting to access the orphaned records through other application endpoints. This is the closest CAPEC to the observed incomplete state propagation; the mapping is uncertain because the primary issue is a maintenance/cleanup defect rather than a directly exploitable state machine flaw."
                  }
                ],
                "commit": "5f78634af8ad2374a51ed979ffbac3084ae5f9d9",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  }
                ],
                "cvssRationale": "The vulnerability is in a web-based application (AV:N) and requires a straightforward authenticated action (AC:L, AT:N). Deleting events requires elevated privileges (PR:H). No user interaction is needed (UI:N). The primary impact is on the integrity of the vulnerable system\u0027s data store: orphaned records persist that should have been removed (VI:L). There is no direct confidentiality impact on the vulnerable system itself because the data was already accessible to the deleting user, and no evidence shows the orphans are exposed to other users (VC:N). No availability impact is demonstrated (VA:N). No impact on subsequent systems (SC:N, SI:N, SA:N).",
                "fixSummary": "The event deletion routine was extended to cascade-remove all associated child records that were previously left behind. Specifically, the fix ensures that event report tags, event graph rows, shadow attribute correlation rows (on both event_id and 1_event_id foreign keys), fuzzy ssdeep chunks, and attachment scan results are all purged within the same transaction as the parent event deletion, eliminating the orphaned-data condition.",
                "generatedAt": "2026-10-19T08:55:14.973651Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "2a311f89681d303b7c915af1a5dbac4a4b7f2998bd50ce77bb78f1586f72cf95",
                "patchSummary": "In app/Model/Event.php, the quickDelete method was modified to: (1) add event_graph and shadow_attribute_correlations (both event_id and 1_event_id) to the relations array used for raw DELETE statements; (2) before executing the raw deletes, query for the IDs of event reports and for attribute/shadow-attribute IDs of type \u0027attachment\u0027 or \u0027malware-sample\u0027; (3) delete EventReportTag rows matching those report IDs; (4) delete AttachmentScan rows matching those attribute IDs; (5) invoke FuzzyCorrelateSsdeep::purge() to remove ssdeep chunks for the event. All operations occur within the existing database transaction.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "5f78634af8ad2374a51ed979ffbac3084ae5f9d9",
                    "date": "Thu, 24 Sep 2026 16:43:27 +0200",
                    "patchSha256": "2a311f89681d303b7c915af1a5dbac4a4b7f2998bd50ce77bb78f1586f72cf95",
                    "source": "https://github.com/MISP/MISP/commit/5f78634af.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/5f78634af.patch",
                    "subject": "fix: [event] Remove every row belonging to an event when"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/5f78634af.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-19T08:55:14Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [event] Remove every row belonging to an event when",
                "tagVersionBoundary": {
                  "commits_after_fix": 33,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-459",
                    "rationale": "The event deletion logic failed to remove all associated child records (report tags, graphs, correlations, ssdeep chunks, scan results), leaving them as orphans in the database. This is a textbook incomplete cleanup of related resources when a parent object is destroyed."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (5f78634af8ad2374a51ed979ffbac3084ae5f9d9): fix: [event] Remove every row belonging to an event when",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/5f78634af.patch"
                    ],
                    "timestamp": "2026-09-24T14:43:27Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20224"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-112180",
    "datePublished": "2026-10-19T09:00:13.049Z",
    "dateReserved": "2026-10-19T09:00:11.375Z",
    "dateUpdated": "2026-10-19T17:19:56.212Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112179",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T18:32:17.990508Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T18:32:29.985Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Event Synchronization"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Event.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "elhoim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report.\u003c/p\u003e\u003cp\u003eAs a result:\u003c/p\u003e\u003cp\u003e- All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance.\u003c/p\u003e\u003cp\u003e- When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event.\u003c/p\u003e\u003cp\u003eThis issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48.\u003c/p\u003e"
            }
          ],
          "value": "In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report.\n\nAs a result:\n\n- All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance.\n\n- When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event.\n\nThis issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization.\n\nAffected: \u003c2.5.48."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-128",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-128 Leverage Executable Code to Alter Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-19T08:52:13Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:53:57.689Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/0be4564a9"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe non-exportable tag filtering is now invoked for each individual event report within the iteration loop, ensuring that restricted tags are removed from every report before it is transmitted to the remote MISP instance. This prevents the leakage of tags that were explicitly marked as non-exportable.\u003c/p\u003e"
            }
          ],
          "value": "The non-exportable tag filtering is now invoked for each individual event report within the iteration loop, ensuring that restricted tags are removed from every report before it is transmitted to the remote MISP instance. This prevents the leakage of tags that were explicitly marked as non-exportable."
        }
      ],
      "title": "MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48 with 34 commits after fix), suggesting the fix is included in v2.5.48 and prior versions are affected. No explicit version range is stated in the patch.",
                  "PR:L assumes that a non-admin authenticated user with push-to-remote permissions can trigger the sync; if only administrators can initiate sync, PR should be raised to H.",
                  "The CAPEC-128 mapping is uncertain; no CAPEC pattern precisely describes a per-item filtering logic error causing data leakage during a legitimate operation.",
                  "The security impact is assessed as limited to tag disclosure; the actual sensitivity of \u0027non-exportable\u0027 tags depends on MISP deployment configuration and is not specified in the patch.",
                  "The availability impact (null report push causing remote save failure) is considered minor and not reflected in the CVSS vector as the primary concern is information disclosure."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-128",
                    "rationale": "This is the closest available CAPEC pattern. The vulnerability arises from a code logic error that causes data (non-exportable tags) to be improperly exposed during a legitimate sync operation. The mapping is uncertain because the issue is a logic bug in data filtering rather than a deliberate attacker action; no CAPEC pattern precisely covers \u0027improper per-item filtering in a loop causing data leakage during a legitimate API operation.\u0027"
                  }
                ],
                "commit": "0be4564a98f37c568a35aa88c5b2bf598a23328a",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  },
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "elhoim"
                  }
                ],
                "cvssRationale": "AV:N: The vulnerability is triggered over the network during MISP-to-MISP synchronization. AC:L: No special conditions are needed beyond a configured sync relationship and an event with multiple reports. AT:N: No attacker interaction is required; the bug triggers on any sync push. PR:L: An authenticated user with permission to push events to a remote server is required. UI:N: No user interaction beyond initiating the sync. VC:L: Non-exportable tags (restricted metadata) are disclosed to the remote instance; the core event data is not exposed. VI:N, VA:N: No integrity or availability impact on the local instance. SC:N, SI:N, SA:N: No impact on the remote instance\u0027s confidentiality, integrity, or availability beyond receiving the tags it should not have.",
                "fixSummary": "The non-exportable tag filtering is now invoked for each individual event report within the iteration loop, ensuring that restricted tags are removed from every report before it is transmitted to the remote MISP instance. This prevents the leakage of tags that were explicitly marked as non-exportable.",
                "generatedAt": "2026-10-19T08:52:13.881684Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "4195b30bddf42380bf30e617b46cdf8e6a5db388a559dc133f98d401f36c35de",
                "patchSummary": "In app/Model/Event.php, the call to __removeNonExportableTags was moved from a single post-loop invocation (which used the last $key value from the foreach) into the else branch of the loop body, so it executes for each non-empty report individually. The post-loop else block that applied the filter to a single report was removed, eliminating both the tag-leakage bug and the null-report push when the last report was empty.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "0be4564a98f37c568a35aa88c5b2bf598a23328a",
                    "date": "Thu, 24 Sep 2026 16:32:31 +0200",
                    "patchSha256": "4195b30bddf42380bf30e617b46cdf8e6a5db388a559dc133f98d401f36c35de",
                    "source": "https://github.com/MISP/MISP/commit/0be4564a9.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/0be4564a9.patch",
                    "subject": "fix: [sync] Filter the tags of every event report pushed to a"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/0be4564a9.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-19T08:52:13Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [sync] Filter the tags of every event report pushed to a",
                "tagVersionBoundary": {
                  "commits_after_fix": 34,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-200",
                    "rationale": "Tags explicitly marked as non-exportable were not filtered from event reports during synchronization, exposing restricted information to the remote MISP instance. The root cause is a logic error (filter applied once instead of per-item), but the security consequence is information disclosure."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (0be4564a98f37c568a35aa88c5b2bf598a23328a): fix: [sync] Filter the tags of every event report pushed to a",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/0be4564a9.patch"
                    ],
                    "timestamp": "2026-09-24T14:32:31Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20283"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-112179",
    "datePublished": "2026-10-19T08:53:57.689Z",
    "dateReserved": "2026-10-19T08:53:56.176Z",
    "dateUpdated": "2026-10-19T18:32:29.985Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112178",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T17:20:26.843308Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T17:20:40.642Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "ShadowAttribute (proposal/shadow attribute handling)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/ShadowAttribute.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "elhoim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user\u0027s sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.\u003c/p\u003e\u003cp\u003e- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute\u0027s distribution level (levels 1-3 should restrict visibility)\u003c/p\u003e\u003cp\u003e- The owning organisation could not view proposals on its own org-only attributes\u003c/p\u003e\u003cp\u003eSecurity impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48\u003c/p\u003e"
            }
          ],
          "value": "MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user\u0027s sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.\n\n- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute\u0027s distribution level (levels 1-3 should restrict visibility)\n\n- The owning organisation could not view proposals on its own org-only attributes\n\nSecurity impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.\n\nAffected: \u003c2.5.48"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-2",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-2 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-19T08:49:14Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:50:52.402Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/9c5af321f"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix enforces the distribution level constraint in the sharing group access check, requiring distribution level 4 (All communities) for the sharing group test to apply. Additionally, the owning organisation is now explicitly granted access to proposals on its own attributes regardless of distribution level, correcting the over-restrictive behavior.\u003c/p\u003e"
            }
          ],
          "value": "The fix enforces the distribution level constraint in the sharing group access check, requiring distribution level 4 (All communities) for the sharing group test to apply. Additionally, the owning organisation is now explicitly granted access to proposals on its own attributes regardless of distribution level, correcting the over-restrictive behavior."
        }
      ],
      "title": "MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The CAPEC mapping (CAPEC-2, Parameter Tampering) is the closest available match but is uncertain; the vulnerability is more accurately a missing authorization check (incomplete ACL evaluation) rather than active parameter manipulation by the attacker.",
                  "The affected version boundary is inferred from the tag v2.5.48 and the commit position (35 commits after the fix); exact version boundaries are not explicitly stated in the patch metadata.",
                  "The second aspect of the vulnerability (owner organisation denied access to its own proposals) is primarily a functional/availability defect rather than a security vulnerability, but is included as part of the same fix and the same root cause (incomplete ACL logic).",
                  "CVSS PR:L assumes the attacker must be an authenticated MISP user with membership in a relevant sharing group; no evidence supports unauthenticated access.",
                  "The Co-Authored-By line credits an AI assistant (Claude Opus 5.5) as a remediation developer; this is recorded as-is from the commit metadata."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-2",
                    "rationale": "The user\u0027s sharing group membership (a parameter of their identity/session) was leveraged by the flawed authorization logic to grant access to proposals without the required distribution level check. This is the closest available CAPEC pattern; the user is not actively tampering with parameters, but the system improperly treats group membership as a sufficient access parameter without enforcing the additional distribution constraint. The mapping is uncertain because the vulnerability is more accurately a missing authorization check than active parameter manipulation."
                  }
                ],
                "commit": "9c5af321fe8f1d2209c8b3c35f4d570d47e9af9e",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  },
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "elhoim"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The user only needs to be a member of a sharing group; no special conditions or race conditions are required. AT:N: No active attack requirements beyond normal API usage. PR:L: The attacker must be an authenticated user with membership in a relevant sharing group. UI:N: No user interaction is required; the check is server-side. VC:H: The user can view proposals (proposed attribute changes) that should be restricted by distribution level, disclosing sensitive information about proposed changes. VI:N: No integrity impact; the user cannot modify proposals. VA:N: No availability impact. SC/SI/SA:N: No impact on subsequent components.",
                "fixSummary": "The fix enforces the distribution level constraint in the sharing group access check, requiring distribution level 4 (All communities) for the sharing group test to apply. Additionally, the owning organisation is now explicitly granted access to proposals on its own attributes regardless of distribution level, correcting the over-restrictive behavior.",
                "generatedAt": "2026-10-19T08:49:14.568262Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "c50a0b040ef7da05d8dffbdc10599991ce441f3fe965e1025620e2e0581b7166",
                "patchSummary": "In the shadow attribute model\u0027s condition builder, the sharing group check for both objects and attributes now includes an AND condition requiring distribution = 4 alongside the sharing_group_id IN check. The attribute distribution condition was changed from a simple sharing_group_id IN clause to a compound AND condition with distribution = 4. A new OR condition (Event.org_id matching the user\u0027s org_id) was added to grant the owning organisation access to proposals on its own attributes.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "9c5af321fe8f1d2209c8b3c35f4d570d47e9af9e",
                    "date": "Thu, 24 Sep 2026 16:23:08 +0200",
                    "patchSha256": "c50a0b040ef7da05d8dffbdc10599991ce441f3fe965e1025620e2e0581b7166",
                    "source": "https://github.com/MISP/MISP/commit/9c5af321f.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/9c5af321f.patch",
                    "subject": "fix: [proposals] Apply the attribute ACL rules to proposals"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/9c5af321f.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-19T08:49:14Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [proposals] Apply the attribute ACL rules to proposals",
                "tagVersionBoundary": {
                  "commits_after_fix": 35,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The authorization check for proposal visibility was missing the distribution level constraint. The system evaluated sharing group membership as sufficient for access without also requiring the distribution level to be 4 (All communities), resulting in an incomplete authorization check that allowed access to proposals on more restrictively distributed attributes."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (9c5af321fe8f1d2209c8b3c35f4d570d47e9af9e): fix: [proposals] Apply the attribute ACL rules to proposals",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/9c5af321f.patch"
                    ],
                    "timestamp": "2026-09-24T14:23:08Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20337"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-112178",
    "datePublished": "2026-10-19T08:50:52.402Z",
    "dateReserved": "2026-10-19T08:50:50.711Z",
    "dateUpdated": "2026-10-19T17:20:40.642Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107278",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T20:28:40.258470Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T20:28:50.215Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "app/Model/MispObject.php"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/MispObject.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance\u0027s validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- Two or more MISP instances are configured to synchronize objects.\u003c/p\u003e\u003cp\u003e- A user with object-creation privileges creates an object without supplying a description.\u003c/p\u003e\u003cp\u003e- The object is subsequently synced to a peer instance.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline.\u003c/p\u003e\u003cp\u003e- The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance\u0027s validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data.\n\nPreconditions:\n\n- Two or more MISP instances are configured to synchronize objects.\n\n- A user with object-creation privileges creates an object without supplying a description.\n\n- The object is subsequently synced to a peer instance.\n\nImpact:\n\n- Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline.\n\n- The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology.\n\nAffected: \u003c2.5.48."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-101",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-101 Application Level DoS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-07T15:41:05Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T15:42:42.472Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/6b1776f07"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe overly strict validation rule that required a non-empty description on MISP Objects during creation was relaxed to permit an empty description. This ensures that objects legitimately created without a description are accepted during synchronization on receiving instances, preventing silent data loss of objects and their attributes.\u003c/p\u003e"
            }
          ],
          "value": "The overly strict validation rule that required a non-empty description on MISP Objects during creation was relaxed to permit an empty description. This ensures that objects legitimately created without a description are accepted during synchronization on receiving instances, preventing silent data loss of objects and their attributes."
        }
      ],
      "title": "MISP Object Sync Drops Objects and Attributes When Description Is Empty",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 36 commits after fix); no explicit \u0027affected\u0027 or \u0027fixed\u0027 version string is provided in the patch.",
                  "The CAPEC-101 mapping is the closest available pattern; the issue is more accurately described as a data-integrity defect during sync rather than a classic DoS, but no CAPEC specifically covers \u0027over-strict validation causing silent data loss during replication\u0027.",
                  "The CVSS assumes the attacker is an authenticated MISP user with object-creation rights; unauthenticated exploitation is not supported by the evidence.",
                  "The commit message states the issue was \u0027found during the internal review, not externally reported\u0027; no external finder or reporter is credited.",
                  "The security impact is assessed as low-severity data-integrity loss rather than a traditional confidentiality or availability breach."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-101",
                    "rationale": "This is the closest available CAPEC. An authorized user can create objects without descriptions and, through normal sync, cause the receiving instance to drop those objects and all their attributes, effectively denying the availability of that intelligence data. The mapping is uncertain because the primary effect is data-integrity loss rather than a classic DoS, and no external unauthenticated attacker is required; however, CAPEC-101 best captures the \u0027valid data is silently discarded, degrading the service\u0027s usefulness\u0027 pattern."
                  }
                ],
                "commit": "6b1776f072e153a4e2cf3af0c210c7aeadfa0469",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  }
                ],
                "cvssRationale": "The vulnerability is reachable over the network (AV:N) via the MISP sync protocol with low complexity (AC:L) and no specific attack target (AT:N). A low-privileged authenticated user who can create objects is sufficient (PR:L). No user interaction is needed (UI:N). There is no confidentiality impact (VC:N). The integrity impact on the victim is low (VI:L) because valid objects and attributes are silently dropped, corrupting the integrity of the receiving instance\u0027s data store. There is no direct availability impact on the victim system itself (VA:N). No secondary impacts are identified (SC:N, SI:N, SA:N). Overall severity is Low.",
                "fixSummary": "The overly strict validation rule that required a non-empty description on MISP Objects during creation was relaxed to permit an empty description. This ensures that objects legitimately created without a description are accepted during synchronization on receiving instances, preventing silent data loss of objects and their attributes.",
                "generatedAt": "2026-10-07T15:41:05.158252Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "17b9854719a40da145be39fc8cf2107bf9d99d02dff2785002fe7a842de88ea1",
                "patchSummary": "In app/Model/MispObject.php, the validation rule for the \u0027description\u0027 field (stringNotEmpty, applied on create) was modified by adding the key \u0027allowEmpty\u0027 set to true. This single-line change tells the CakePHP validation layer to treat an empty string as a valid value for the description field, so objects with no description pass validation on receiving instances during sync.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "6b1776f072e153a4e2cf3af0c210c7aeadfa0469",
                    "date": "Thu, 24 Sep 2026 16:07:34 +0200",
                    "patchSha256": "17b9854719a40da145be39fc8cf2107bf9d99d02dff2785002fe7a842de88ea1",
                    "source": "https://github.com/MISP/MISP/commit/6b1776f07.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/6b1776f07.patch",
                    "subject": "fix: [sync] Accept objects without a description"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/6b1776f07.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-07T15:41:05Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [sync] Accept objects without a description",
                "tagVersionBoundary": {
                  "commits_after_fix": 36,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-20",
                    "rationale": "The validation rule stringNotEmpty was applied without accounting for the legitimate case of an empty description, causing valid input (an object with no description) to be rejected. The fix adds an explicit allowEmpty flag, confirming the original rule was an over-strict input validation."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (6b1776f072e153a4e2cf3af0c210c7aeadfa0469): fix: [sync] Accept objects without a description",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/6b1776f07.patch"
                    ],
                    "timestamp": "2026-09-24T14:07:34Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20215"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-107278",
    "datePublished": "2026-10-07T15:42:42.472Z",
    "dateReserved": "2026-10-07T15:42:40.660Z",
    "dateUpdated": "2026-10-07T20:28:50.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107276",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T20:28:10.510425Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T20:28:21.466Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "UsersController (email OTP login)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/UsersController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request\u0027s deletion takes effect.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- The target MISP instance has email OTP login enabled.\u003c/p\u003e\u003cp\u003e- The attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering).\u003c/p\u003e\u003cp\u003e- The attacker can issue two HTTP POST requests in close temporal proximity.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions.\u003c/p\u003e\u003cp\u003e- This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted.\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request\u0027s deletion takes effect.\n\nPreconditions:\n\n- The target MISP instance has email OTP login enabled.\n\n- The attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering).\n\n- The attacker can issue two HTTP POST requests in close temporal proximity.\n\nImpact:\n\n- The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions.\n\n- This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted.\n\nAffected versions: \u003c2.5.48"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-111",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-111 Race Condition"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-07T15:34:47Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T15:36:49.564Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/ba95e67d5"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix makes OTP consumption atomic by moving the deletion of the OTP from the shared store into the validation condition itself. The return value of the delete operation (1 if the key was actually removed, 0 otherwise) is now part of the success check, so only the request that successfully removes the OTP from the store is permitted to proceed with login. A session-state cleanup call was also added to remove the OTP user reference from the session.\u003c/p\u003e"
            }
          ],
          "value": "The fix makes OTP consumption atomic by moving the deletion of the OTP from the shared store into the validation condition itself. The return value of the delete operation (1 if the key was actually removed, 0 otherwise) is now part of the success check, so only the request that successfully removes the OTP from the store is permitted to proceed with login. A session-state cleanup call was also added to remove the OTP user reference from the session."
        }
      ],
      "title": "MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact affected version range is not explicitly stated in the patch; the tag boundary v2.5.48 with 39 commits after the fix suggests the fix landed shortly after that tag, but the precise first-fixed version is unconfirmed.",
                  "The CAPEC-111 mapping is the closest available; no CAPEC specifically covers OTP replay via race condition, so this is the best-fit pattern.",
                  "CVSS AC:H assumes the race window is narrow and requires precise timing; if the Redis round-trip latency is large, exploitation may be easier, but no evidence supports lowering AC.",
                  "The commit message states the issue was \u0027found during the internal review, not externally reported,\u0027 but no specific individual is named as finder, so no finder credit is assigned.",
                  "PR:N assumes the attacker obtains the OTP through out-of-band means (email interception); if MISP requires prior authentication to request an OTP, PR could be L."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-111",
                    "rationale": "The attack pattern involves an adversary issuing two or more concurrent requests to exploit a non-atomic check-and-use sequence on a shared resource (the OTP in Redis). CAPEC-111 directly describes exploiting timing dependencies between sub-processes. This is the closest CAPEC to the observed vulnerability; no more specific CAPEC for OTP replay via race condition exists in the CAPEC catalog."
                  }
                ],
                "commit": "ba95e67d545efa313435ae39dd481879d72e72e6",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: Exploitation occurs over the network via HTTP POST. AC:H: Exploiting the race condition requires precise timing of two concurrent requests so both read the OTP before either deletes it; this is non-trivial to achieve reliably. AT:N: No data corruption or manipulation is required. PR:N: The attacker does not need prior authentication to MISP; they only need possession of a valid OTP (e.g., intercepted email). UI:N: No victim interaction beyond the initial login flow is needed. VC:N: No direct confidentiality loss of system data. VI:L: The one-time-use property of the OTP is violated, allowing a second authenticated session. VA:N: No availability impact. SC/SI:L: Limited integrity impact on the authentication process; no cross-system impact. SA:N: No impact on security authority.",
                "fixSummary": "The fix makes OTP consumption atomic by moving the deletion of the OTP from the shared store into the validation condition itself. The return value of the delete operation (1 if the key was actually removed, 0 otherwise) is now part of the success check, so only the request that successfully removes the OTP from the store is permitted to proceed with login. A session-state cleanup call was also added to remove the OTP user reference from the session.",
                "generatedAt": "2026-10-07T15:34:47.392474Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "810e97a648a36f87d684f509c51c93636711a31daeab31c5bccbc9466249a7e0",
                "patchSummary": "In UsersController::email_otp(), the $redis-\u003edel() call was moved from after the hash_equals comparison into the if-condition as an additional conjunct. The condition now requires $redis-\u003edel(\u0027misp:otp:\u0027 . $user_id) === 1, meaning only the request whose delete actually removed the key (returning 1) can proceed to Auth-\u003elogin(). A $this-\u003eSession-\u003edelete(\u0027email_otp_user\u0027) call was added before the login step to clean up session state. Net change: 6 insertions, 3 deletions in one file.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "ba95e67d545efa313435ae39dd481879d72e72e6",
                    "date": "Wed, 23 Sep 2026 16:26:22 +0200",
                    "patchSha256": "810e97a648a36f87d684f509c51c93636711a31daeab31c5bccbc9466249a7e0",
                    "source": "https://github.com/MISP/MISP/commit/ba95e67d5.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/ba95e67d5.patch",
                    "subject": "fix: [login] Let only one request spend an e-mailed OTP"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/ba95e67d5.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-07T15:34:47Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [login] Let only one request spend an e-mailed OTP",
                "tagVersionBoundary": {
                  "commits_after_fix": 39,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-362",
                    "rationale": "The OTP stored in Redis is a shared resource accessed by concurrent HTTP requests. The original code performed read, compare, and delete as separate non-atomic operations, allowing two concurrent requests to both read and validate the same OTP before either deletes it. This is a textbook race condition on a shared resource."
                  },
                  {
                    "cweId": "CWE-367",
                    "rationale": "The check (reading and comparing the OTP) and the use (logging in) are separated in time, and the state (OTP presence in the store) can change between the two steps due to a concurrent request. This is a TOCTOU variant of the race condition."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (ba95e67d545efa313435ae39dd481879d72e72e6): fix: [login] Let only one request spend an e-mailed OTP",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/ba95e67d5.patch"
                    ],
                    "timestamp": "2026-09-23T14:26:22Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20315"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-107276",
    "datePublished": "2026-10-07T15:36:49.564Z",
    "dateReserved": "2026-10-07T15:36:46.122Z",
    "dateUpdated": "2026-10-07T20:28:21.466Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}