CVE-2026-112180 (GCVE-0-2026-112180)
Vulnerability from cvelistv5 – Published: 2026-10-19 09:00 – Updated: 2026-10-19 17:19
VLAI
EPSS
VEX
Title
MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records
Summary
MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal (shadow attribute) correlations, fuzzy ssdeep correlation chunks, and attachment scan results.
These orphaned records may contain sensitive threat intelligence data such as correlation mappings, scan results, and report metadata that should have been removed along with the parent event. Their persistence beyond the intended deletion lifecycle creates a risk of unintended data retention and potential information exposure if the records are reachable through other application queries or administrative interfaces.
Preconditions:
- An authenticated user with sufficient privileges to delete events in MISP.
- The event must have associated reports, graphs, correlations, ssdeep chunks, or attachment scan results.
Impact:
- Residual sensitive data persists in the database after the parent event is deleted.
- Accumulation of orphaned records over time may contribute to storage bloat.
- Orphaned records may be inadvertently exposed through other data-access paths that do not validate the existence of the parent event.
Affected versions: <2.5.48
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
Supplier · CIRCL (v2.0.3)
Decision recorded 2026-10-19 08:55 UTC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:19 UTC
CWE
- CWE-459 - Incomplete Cleanup
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/5f78634af | patch |
Impacted products
GCVE extensions
AI-generated
Human-reviewed
Confidence: medium
Model
qwen3.8:27b
1 event
advisory
bcp-05-x-01bcp-05-x-02bcp-05-x-03
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-10-19 08:55 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/5f78634af.patch
2a311f89681d… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
5f78634af8ad
|
fix: [event] Remove every row belonging to an event when | 2a311f89681d… |
Fix summary
The event deletion routine was extended to cascade-remove all associated child records that were previously left behind. Specifically, the fix ensures that event report tags, event graph rows, shadow attribute correlation rows (on both event_id and 1_event_id foreign keys), fuzzy ssdeep chunks, and attachment scan results are all purged within the same transaction as the parent event deletion, eliminating the orphaned-data condition.
Patch summary
In app/Model/Event.php, the quickDelete method was modified to: (1) add event_graph and shadow_attribute_correlations (both event_id and 1_event_id) to the relations array used for raw DELETE statements; (2) before executing the raw deletes, query for the IDs of event reports and for attribute/shadow-attribute IDs of type 'attachment' or 'malware-sample'; (3) delete EventReportTag rows matching those report IDs; (4) delete AttachmentScan rows matching those attribute IDs; (5) invoke FuzzyCorrelateSsdeep::purge() to remove ssdeep chunks for the event. All operations occur within the existing database transaction.
CVSS rationale
The vulnerability is in a web-based application (AV:N) and requires a straightforward authenticated action (AC:L, AT:N). Deleting events requires elevated privileges (PR:H). No user interaction is needed (UI:N). The primary impact is on the integrity of the vulnerable system's data store: orphaned records persist that should have been removed (VI:L). There is no direct confidentiality impact on the vulnerable system itself because the data was already accessible to the deleting user, and no evidence shows the orphans are exposed to other users (VC:N). No availability impact is demonstrated (VA:N). No impact on subsequent systems (SC:N, SI:N, SA:N).
Weakness rationale
- CWE-459 The event deletion logic failed to remove all associated child records (report tags, graphs, correlations, ssdeep chunks, scan results), leaving them as orphans in the database. This is a textbook incomplete cleanup of related resources when a parent object is destroyed.
Attack pattern rationale
- CAPEC-126 The event object transitions to a 'deleted' state, but related child objects (report tags, correlations, scan results, ssdeep chunks) do not follow the expected state transition and remain in an active/persisted state. An attacker with delete privileges could exploit this by creating events with sensitive associated data, deleting the event, and then attempting to access the orphaned records through other application endpoints. This is the closest CAPEC to the observed incomplete state propagation; the mapping is uncertain because the primary issue is a maintenance/cleanup defect rather than a directly exploitable state machine flaw.
Assumptions to verify
- The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48 with 33 commits after fix); the exact fixed release version is not specified in the patch.
- The CAPEC-126 mapping is the closest available match; the vulnerability is fundamentally an incomplete cleanup defect rather than a classic state-transition exploit, so the mapping carries uncertainty.
- The confidentiality impact is assessed as None because the patch does not demonstrate that orphaned records are accessible to unauthorized users; the primary concern is data integrity and retention policy.
- The commit message states the issue was 'found during the internal review, not externally reported,' so no external finder or reporter is credited.
- The CVSS assumes the orphaned data is not directly queryable by other users through existing MISP endpoints; if such access paths exist, the confidentiality impact could be higher.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
7 | 11 | medium | 5 |
- 2026-09-24 14:43 UTC Fix developed Corrective change authored (5f78634af8ad2374a51ed979ffbac3084ae5f9d9): fix: [event] Remove every row belonging to an event when https://github.com/MISP/MISP/commit/5f78634af.patch
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112180",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:19:43.619080Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:19:56.212Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"Event model (app/Model/Event.php)"
],
"product": "MISP",
"programFiles": [
"app/Model/Event.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThanOrEqual": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal (shadow attribute) correlations, fuzzy ssdeep correlation chunks, and attachment scan results.\u003c/p\u003e\u003cp\u003eThese orphaned records may contain sensitive threat intelligence data such as correlation mappings, scan results, and report metadata that should have been removed along with the parent event. Their persistence beyond the intended deletion lifecycle creates a risk of unintended data retention and potential information exposure if the records are reachable through other application queries or administrative interfaces.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- An authenticated user with sufficient privileges to delete events in MISP.\u003c/p\u003e\u003cp\u003e- The event must have associated reports, graphs, correlations, ssdeep chunks, or attachment scan results.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Residual sensitive data persists in the database after the parent event is deleted.\u003c/p\u003e\u003cp\u003e- Accumulation of orphaned records over time may contribute to storage bloat.\u003c/p\u003e\u003cp\u003e- Orphaned records may be inadvertently exposed through other data-access paths that do not validate the existence of the parent event.\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48\u003c/p\u003e"
}
],
"value": "MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal (shadow attribute) correlations, fuzzy ssdeep correlation chunks, and attachment scan results.\n\nThese orphaned records may contain sensitive threat intelligence data such as correlation mappings, scan results, and report metadata that should have been removed along with the parent event. Their persistence beyond the intended deletion lifecycle creates a risk of unintended data retention and potential information exposure if the records are reachable through other application queries or administrative interfaces.\n\nPreconditions:\n\n- An authenticated user with sufficient privileges to delete events in MISP.\n\n- The event must have associated reports, graphs, correlations, ssdeep chunks, or attachment scan results.\n\nImpact:\n\n- Residual sensitive data persists in the database after the parent event is deleted.\n\n- Accumulation of orphaned records over time may contribute to storage bloat.\n\n- Orphaned records may be inadvertently exposed through other data-access paths that do not validate the existence of the parent event.\n\nAffected versions: \u003c2.5.48"
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Exploiting Incorrect Object State Transition"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-19T08:55:14Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-459",
"description": "CWE-459 Incomplete Cleanup",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:00:13.049Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/5f78634af"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe event deletion routine was extended to cascade-remove all associated child records that were previously left behind. Specifically, the fix ensures that event report tags, event graph rows, shadow attribute correlation rows (on both event_id and 1_event_id foreign keys), fuzzy ssdeep chunks, and attachment scan results are all purged within the same transaction as the parent event deletion, eliminating the orphaned-data condition.\u003c/p\u003e"
}
],
"value": "The event deletion routine was extended to cascade-remove all associated child records that were previously left behind. Specifically, the fix ensures that event report tags, event graph rows, shadow attribute correlation rows (on both event_id and 1_event_id foreign keys), fuzzy ssdeep chunks, and attachment scan results are all purged within the same transaction as the parent event deletion, eliminating the orphaned-data condition."
}
],
"title": "MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48 with 33 commits after fix); the exact fixed release version is not specified in the patch.",
"The CAPEC-126 mapping is the closest available match; the vulnerability is fundamentally an incomplete cleanup defect rather than a classic state-transition exploit, so the mapping carries uncertainty.",
"The confidentiality impact is assessed as None because the patch does not demonstrate that orphaned records are accessible to unauthorized users; the primary concern is data integrity and retention policy.",
"The commit message states the issue was \u0027found during the internal review, not externally reported,\u0027 so no external finder or reporter is credited.",
"The CVSS assumes the orphaned data is not directly queryable by other users through existing MISP endpoints; if such access paths exist, the confidentiality impact could be higher."
],
"capecRationale": [
{
"capecId": "CAPEC-126",
"rationale": "The event object transitions to a \u0027deleted\u0027 state, but related child objects (report tags, correlations, scan results, ssdeep chunks) do not follow the expected state transition and remain in an active/persisted state. An attacker with delete privileges could exploit this by creating events with sensitive associated data, deleting the event, and then attempting to access the orphaned records through other application endpoints. This is the closest CAPEC to the observed incomplete state propagation; the mapping is uncertain because the primary issue is a maintenance/cleanup defect rather than a directly exploitable state machine flaw."
}
],
"commit": "5f78634af8ad2374a51ed979ffbac3084ae5f9d9",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
}
],
"cvssRationale": "The vulnerability is in a web-based application (AV:N) and requires a straightforward authenticated action (AC:L, AT:N). Deleting events requires elevated privileges (PR:H). No user interaction is needed (UI:N). The primary impact is on the integrity of the vulnerable system\u0027s data store: orphaned records persist that should have been removed (VI:L). There is no direct confidentiality impact on the vulnerable system itself because the data was already accessible to the deleting user, and no evidence shows the orphans are exposed to other users (VC:N). No availability impact is demonstrated (VA:N). No impact on subsequent systems (SC:N, SI:N, SA:N).",
"fixSummary": "The event deletion routine was extended to cascade-remove all associated child records that were previously left behind. Specifically, the fix ensures that event report tags, event graph rows, shadow attribute correlation rows (on both event_id and 1_event_id foreign keys), fuzzy ssdeep chunks, and attachment scan results are all purged within the same transaction as the parent event deletion, eliminating the orphaned-data condition.",
"generatedAt": "2026-10-19T08:55:14.973651Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 5,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 7
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "2a311f89681d303b7c915af1a5dbac4a4b7f2998bd50ce77bb78f1586f72cf95",
"patchSummary": "In app/Model/Event.php, the quickDelete method was modified to: (1) add event_graph and shadow_attribute_correlations (both event_id and 1_event_id) to the relations array used for raw DELETE statements; (2) before executing the raw deletes, query for the IDs of event reports and for attribute/shadow-attribute IDs of type \u0027attachment\u0027 or \u0027malware-sample\u0027; (3) delete EventReportTag rows matching those report IDs; (4) delete AttachmentScan rows matching those attribute IDs; (5) invoke FuzzyCorrelateSsdeep::purge() to remove ssdeep chunks for the event. All operations occur within the existing database transaction.",
"patchTruncated": false,
"patches": [
{
"commit": "5f78634af8ad2374a51ed979ffbac3084ae5f9d9",
"date": "Thu, 24 Sep 2026 16:43:27 +0200",
"patchSha256": "2a311f89681d303b7c915af1a5dbac4a4b7f2998bd50ce77bb78f1586f72cf95",
"source": "https://github.com/MISP/MISP/commit/5f78634af.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/5f78634af.patch",
"subject": "fix: [event] Remove every row belonging to an event when"
}
],
"source": "https://github.com/MISP/MISP/commit/5f78634af.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-19T08:55:14Z",
"version": "2.0.3"
},
"subject": "fix: [event] Remove every row belonging to an event when",
"tagVersionBoundary": {
"commits_after_fix": 33,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.48",
"version": "2.5.48",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-459",
"rationale": "The event deletion logic failed to remove all associated child records (report tags, graphs, correlations, ssdeep chunks, scan results), leaving them as orphans in the database. This is a textbook incomplete cleanup of related resources when a parent object is destroyed."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (5f78634af8ad2374a51ed979ffbac3084ae5f9d9): fix: [event] Remove every row belonging to an event when",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/MISP/MISP/commit/5f78634af.patch"
],
"timestamp": "2026-09-24T14:43:27Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20224"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-112180",
"datePublished": "2026-10-19T09:00:13.049Z",
"dateReserved": "2026-10-19T09:00:11.375Z",
"dateUpdated": "2026-10-19T17:19:56.212Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-112180",
"date": "2026-10-20",
"epss": "0.00331",
"percentile": "0.2481"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"Event model (app/Model/Event.php)"
],
"product": "MISP",
"programFiles": [
"app/Model/Event.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThanOrEqual": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal (shadow attribute) correlations, fuzzy ssdeep correlation chunks, and attachment scan results.\n\nThese orphaned records may contain sensitive threat intelligence data such as correlation mappings, scan results, and report metadata that should have been removed along with the parent event. Their persistence beyond the intended deletion lifecycle creates a risk of unintended data retention and potential information exposure if the records are reachable through other application queries or administrative interfaces.\n\nPreconditions:\n\n- An authenticated user with sufficient privileges to delete events in MISP.\n\n- The event must have associated reports, graphs, correlations, ssdeep chunks, or attachment scan results.\n\nImpact:\n\n- Residual sensitive data persists in the database after the parent event is deleted.\n\n- Accumulation of orphaned records over time may contribute to storage bloat.\n\n- Orphaned records may be inadvertently exposed through other data-access paths that do not validate the existence of the parent event.\n\nAffected versions: \u003c2.5.48"
}
],
"id": "CVE-2026-112180",
"lastModified": "2026-10-19T18:17:03.490",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"ssvcData": {
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-19T08:55:14Z",
"version": "2.0.3"
}
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-112180",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:19:43.619080Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-10-19T09:17:08.660",
"references": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"url": "https://github.com/MISP/MISP/commit/5f78634af"
}
],
"sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-459"
}
],
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112180",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:19:43.619080Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:19:51.098Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"Event model (app/Model/Event.php)"
],
"product": "MISP",
"programFiles": [
"app/Model/Event.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThanOrEqual": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal (shadow attribute) correlations, fuzzy ssdeep correlation chunks, and attachment scan results.\u003c/p\u003e\u003cp\u003eThese orphaned records may contain sensitive threat intelligence data such as correlation mappings, scan results, and report metadata that should have been removed along with the parent event. Their persistence beyond the intended deletion lifecycle creates a risk of unintended data retention and potential information exposure if the records are reachable through other application queries or administrative interfaces.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- An authenticated user with sufficient privileges to delete events in MISP.\u003c/p\u003e\u003cp\u003e- The event must have associated reports, graphs, correlations, ssdeep chunks, or attachment scan results.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Residual sensitive data persists in the database after the parent event is deleted.\u003c/p\u003e\u003cp\u003e- Accumulation of orphaned records over time may contribute to storage bloat.\u003c/p\u003e\u003cp\u003e- Orphaned records may be inadvertently exposed through other data-access paths that do not validate the existence of the parent event.\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48\u003c/p\u003e"
}
],
"value": "MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal (shadow attribute) correlations, fuzzy ssdeep correlation chunks, and attachment scan results.\n\nThese orphaned records may contain sensitive threat intelligence data such as correlation mappings, scan results, and report metadata that should have been removed along with the parent event. Their persistence beyond the intended deletion lifecycle creates a risk of unintended data retention and potential information exposure if the records are reachable through other application queries or administrative interfaces.\n\nPreconditions:\n\n- An authenticated user with sufficient privileges to delete events in MISP.\n\n- The event must have associated reports, graphs, correlations, ssdeep chunks, or attachment scan results.\n\nImpact:\n\n- Residual sensitive data persists in the database after the parent event is deleted.\n\n- Accumulation of orphaned records over time may contribute to storage bloat.\n\n- Orphaned records may be inadvertently exposed through other data-access paths that do not validate the existence of the parent event.\n\nAffected versions: \u003c2.5.48"
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Exploiting Incorrect Object State Transition"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-19T08:55:14Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-459",
"description": "CWE-459 Incomplete Cleanup",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:00:13.049Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/5f78634af"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe event deletion routine was extended to cascade-remove all associated child records that were previously left behind. Specifically, the fix ensures that event report tags, event graph rows, shadow attribute correlation rows (on both event_id and 1_event_id foreign keys), fuzzy ssdeep chunks, and attachment scan results are all purged within the same transaction as the parent event deletion, eliminating the orphaned-data condition.\u003c/p\u003e"
}
],
"value": "The event deletion routine was extended to cascade-remove all associated child records that were previously left behind. Specifically, the fix ensures that event report tags, event graph rows, shadow attribute correlation rows (on both event_id and 1_event_id foreign keys), fuzzy ssdeep chunks, and attachment scan results are all purged within the same transaction as the parent event deletion, eliminating the orphaned-data condition."
}
],
"title": "MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48 with 33 commits after fix); the exact fixed release version is not specified in the patch.",
"The CAPEC-126 mapping is the closest available match; the vulnerability is fundamentally an incomplete cleanup defect rather than a classic state-transition exploit, so the mapping carries uncertainty.",
"The confidentiality impact is assessed as None because the patch does not demonstrate that orphaned records are accessible to unauthorized users; the primary concern is data integrity and retention policy.",
"The commit message states the issue was \u0027found during the internal review, not externally reported,\u0027 so no external finder or reporter is credited.",
"The CVSS assumes the orphaned data is not directly queryable by other users through existing MISP endpoints; if such access paths exist, the confidentiality impact could be higher."
],
"capecRationale": [
{
"capecId": "CAPEC-126",
"rationale": "The event object transitions to a \u0027deleted\u0027 state, but related child objects (report tags, correlations, scan results, ssdeep chunks) do not follow the expected state transition and remain in an active/persisted state. An attacker with delete privileges could exploit this by creating events with sensitive associated data, deleting the event, and then attempting to access the orphaned records through other application endpoints. This is the closest CAPEC to the observed incomplete state propagation; the mapping is uncertain because the primary issue is a maintenance/cleanup defect rather than a directly exploitable state machine flaw."
}
],
"commit": "5f78634af8ad2374a51ed979ffbac3084ae5f9d9",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
}
],
"cvssRationale": "The vulnerability is in a web-based application (AV:N) and requires a straightforward authenticated action (AC:L, AT:N). Deleting events requires elevated privileges (PR:H). No user interaction is needed (UI:N). The primary impact is on the integrity of the vulnerable system\u0027s data store: orphaned records persist that should have been removed (VI:L). There is no direct confidentiality impact on the vulnerable system itself because the data was already accessible to the deleting user, and no evidence shows the orphans are exposed to other users (VC:N). No availability impact is demonstrated (VA:N). No impact on subsequent systems (SC:N, SI:N, SA:N).",
"fixSummary": "The event deletion routine was extended to cascade-remove all associated child records that were previously left behind. Specifically, the fix ensures that event report tags, event graph rows, shadow attribute correlation rows (on both event_id and 1_event_id foreign keys), fuzzy ssdeep chunks, and attachment scan results are all purged within the same transaction as the parent event deletion, eliminating the orphaned-data condition.",
"generatedAt": "2026-10-19T08:55:14.973651Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 5,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 7
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "2a311f89681d303b7c915af1a5dbac4a4b7f2998bd50ce77bb78f1586f72cf95",
"patchSummary": "In app/Model/Event.php, the quickDelete method was modified to: (1) add event_graph and shadow_attribute_correlations (both event_id and 1_event_id) to the relations array used for raw DELETE statements; (2) before executing the raw deletes, query for the IDs of event reports and for attribute/shadow-attribute IDs of type \u0027attachment\u0027 or \u0027malware-sample\u0027; (3) delete EventReportTag rows matching those report IDs; (4) delete AttachmentScan rows matching those attribute IDs; (5) invoke FuzzyCorrelateSsdeep::purge() to remove ssdeep chunks for the event. All operations occur within the existing database transaction.",
"patchTruncated": false,
"patches": [
{
"commit": "5f78634af8ad2374a51ed979ffbac3084ae5f9d9",
"date": "Thu, 24 Sep 2026 16:43:27 +0200",
"patchSha256": "2a311f89681d303b7c915af1a5dbac4a4b7f2998bd50ce77bb78f1586f72cf95",
"source": "https://github.com/MISP/MISP/commit/5f78634af.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/5f78634af.patch",
"subject": "fix: [event] Remove every row belonging to an event when"
}
],
"source": "https://github.com/MISP/MISP/commit/5f78634af.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-19T08:55:14Z",
"version": "2.0.3"
},
"subject": "fix: [event] Remove every row belonging to an event when",
"tagVersionBoundary": {
"commits_after_fix": 33,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.48",
"version": "2.5.48",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-459",
"rationale": "The event deletion logic failed to remove all associated child records (report tags, graphs, correlations, ssdeep chunks, scan results), leaving them as orphans in the database. This is a textbook incomplete cleanup of related resources when a parent object is destroyed."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (5f78634af8ad2374a51ed979ffbac3084ae5f9d9): fix: [event] Remove every row belonging to an event when",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/MISP/MISP/commit/5f78634af.patch"
],
"timestamp": "2026-09-24T14:43:27Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20224"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-112180",
"datePublished": "2026-10-19T09:00:13.049Z",
"dateReserved": "2026-10-19T09:00:11.375Z",
"dateUpdated": "2026-10-19T17:19:56.212Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.