Read the docs
TI-2026-66153 Aliases CVE-2026-104914GHSA-mw5r-825j-vg45

MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View

Priority LOW 23CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted attributes (e.g., via the deleted-attributes search or the paginated attribute listing), the application returned soft-deleted attributes belonging to events owned by other organizations to any authenticated user who had visibility of the event. The event detail view correctly restricted soft-deleted attribute visibility to the owning organization and sync-permission users, but the attribute search and paginated view code paths lacked this restriction. Preconditions: - An authenticated MISP user with at least read access to an event owned by another organization. - The user issues a query for deleted attributes (search or paginated view with the deleted filter). Impact: - Confidentiality: Soft-deleted threat intelligence attributes (e.g., IOCs, indicators, context) from other organizations are disclosed to unauthorized users. This may expose sensitive intelligence that the owning organization intended to remove from general visibility. Affected versions: MISP versions prior to v2.5.48.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00215 11th percentileScored 2026-11-07
Fix Fixed MISP (MISP): 2.5.48

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MISPMISPbefore 2.5.482.5.48Patch availableCNA
  • MISP VendorMISP Affected before 2.5.48 Fixed in 2.5.48 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*——MISP
  • cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* Versions — — ·MISP

Remediation

  • Fix · CNA MISP (MISP) Fixed in 2.5.48

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    MISP 2.5.48

    8 records Highest priority Priority LOW 8 LOW

    Other records, highest priority first

    • TI-2026-66152 MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute DataPriority LOW 31
    • TI-2026-66150 MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default FlaggingPriority LOW 31
    • TI-2026-66148 MISP TAXII Object Viewer Stored XSS via Unescaped JSON OutputPriority LOW 28
    Show all 8 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-104914
  2. 2026-10-03 Alias added: GHSA-mw5r-825j-vg45
  3. 2026-10-06 CISA SSVC decision points changed

References

Patch 1

Other 1

  • TI-2025-41517 In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. CVSS 3.1CRITICAL 9.0
  • TI-2026-65744 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period CVSS 4.0CRITICAL 9.3
  • TI-2026-54145 Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library CVSS 4.0HIGH 8.8
  • TI-2020-10250 MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case. CVSS 3.1CRITICAL 9.8
  • TI-2026-59159 MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding CVSS 4.0HIGH 8.7
  • TI-2026-58541 MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials CVSS 4.0CRITICAL 9.5
See all 182 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences