CWE-285

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:maven/org.openidentityplatform.openam/openam-core",
          "product": "OpenAM",
          "vendor": "OpenIdentityPlatform",
          "versions": [
            {
              "lessThan": "16.1.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.1.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.1.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "arpitjain099"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "maximthomas"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "tsujiguchitky"
        }
      ],
      "datePublic": "2026-09-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks use the requester\u0027s realm. Authenticated accounts holding the iplanet-am-session-destroy-sessions attribute can supply a target session identifier or handle to forcibly log out users in any realm."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T12:14:44.905Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-hmwh-9r8r-44gw)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-hmwh-9r8r-44gw"
        },
        {
          "name": "VulnCheck Advisory: OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openam-before-16.1.3-improper-authorization-in-delegated-session-destroy-realm-scoping"
        }
      ],
      "title": "OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-105121",
    "datePublished": "2026-10-03T12:14:44.905Z",
    "dateReserved": "2026-10-03T12:04:36.964Z",
    "dateUpdated": "2026-10-03T12:14:44.905Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:maven/org.openidentityplatform.openam/openam-oauth2",
          "product": "OpenAM",
          "vendor": "OpenIdentityPlatform",
          "versions": [
            {
              "lessThan": "16.1.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.1.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.1.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "arpitjain099"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "maximthomas"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "tsujiguchitky"
        }
      ],
      "datePublic": "2026-09-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code, so codes issued through OpenID Connect hybrid flows (code token, code id_token, code token id_token) carry no bound challenge. An attacker who intercepts such a code can redeem it for a public client\u0027s tokens with any non-empty code_verifier."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T12:14:43.643Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-5p2f-7vcr-6vfh)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-5p2f-7vcr-6vfh"
        },
        {
          "name": "VulnCheck Advisory: OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openam-before-16.1.3-pkce-enforcement-bypass-via-oauth-2.0-hybrid-flows"
        }
      ],
      "title": "OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-105119",
    "datePublished": "2026-10-03T12:14:43.643Z",
    "dateReserved": "2026-10-03T12:04:36.964Z",
    "dateUpdated": "2026-10-03T12:14:43.643Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104910",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:48:33.673589Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:52:56.095Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "EventsController (viewRelatedEvents)",
            "Event model (getRelatedEvents)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/EventsController.php",
            "app/Model/Event.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Wenhao Wu"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved related event metadata directly from the correlation table without re-validating the caller\u0027s access rights against each related event.\u003c/p\u003e\u003cp\u003eThe correlation table stores a snapshot of the event\u0027s distribution level and sharing group at the time the correlation was created, and does not carry the published flag. As a result, events that the caller is not permitted to open\u2014because they are unpublished, or because their distribution or sharing group has changed since the correlation was recorded\u2014were still returned with their metadata (title, date, correlating value counts).\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- An authenticated user with access to at least one event in MISP.\u003c/p\u003e\u003cp\u003e- The existence of correlation entries linking that event to other events the user should not be able to view.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Unauthorized disclosure of event metadata (titles, dates, correlation counts) for events the user has no right to access.\u003c/p\u003e\u003cp\u003e- Potential reconnaissance of threat-intelligence event names and timelines across sharing groups.\u003c/p\u003e\u003cp\u003eAffected: MISP versions prior to the fix commit (2ffa97f05).\u003c/p\u003e"
            }
          ],
          "value": "MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved related event metadata directly from the correlation table without re-validating the caller\u0027s access rights against each related event.\n\nThe correlation table stores a snapshot of the event\u0027s distribution level and sharing group at the time the correlation was created, and does not carry the published flag. As a result, events that the caller is not permitted to open\u2014because they are unpublished, or because their distribution or sharing group has changed since the correlation was recorded\u2014were still returned with their metadata (title, date, correlating value counts).\n\nPreconditions:\n\n- An authenticated user with access to at least one event in MISP.\n\n- The existence of correlation entries linking that event to other events the user should not be able to view.\n\nImpact:\n\n- Unauthorized disclosure of event metadata (titles, dates, correlation counts) for events the user has no right to access.\n\n- Potential reconnaissance of threat-intelligence event names and timelines across sharing groups.\n\nAffected: MISP versions prior to the fix commit (2ffa97f05)."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Leverage Trusted Relationship"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-02T15:59:27Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T16:01:32.781Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/2ffa97f05"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix enforces proper per-event authorization on the related events query by applying the user\u0027s full access-control conditions (including published status, distribution level, and sharing group membership) to the event lookup, rather than relying solely on the stale distribution snapshot stored in the correlation table. This ensures that only events the caller is currently permitted to read are returned in the related events list.\u003c/p\u003e"
            }
          ],
          "value": "The fix enforces proper per-event authorization on the related events query by applying the user\u0027s full access-control conditions (including published status, distribution level, and sharing group membership) to the event lookup, rather than relying solely on the stale distribution snapshot stored in the correlation table. This ensures that only events the caller is currently permitted to read are returned in the related events list."
        }
      ],
      "title": "MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The tag_version_boundary (v2.5.48, 50 commits after fix) is used as an approximate upper bound for affected versions; exact version boundaries are not explicitly stated in the patch metadata.",
                  "PR:L assumes the attacker needs only a basic authenticated MISP account with access to at least one event; higher-privilege roles may be required depending on deployment configuration, but the patch does not specify this.",
                  "VC:L assumes the disclosed metadata (event titles, dates, correlation counts) constitutes a low confidentiality impact; in highly sensitive threat-intelligence environments the impact could be rated higher.",
                  "CAPEC-126 is the closest available mapping; no CAPEC precisely describes authorization bypass via a stale snapshot in a correlation/join table.",
                  "The \u0027published\u0027 flag and distribution/sharing group checks are assumed to be the primary authorization mechanisms in MISP\u0027s event model, based on the commit message and patch context.",
                  "No public exploit or active exploitation is assumed; the patch does not reference any CVE, advisory, or exploitation evidence."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The attacker leverages the trusted correlation relationship stored in the correlation table. The system treated the correlation entry as a sufficient authorization basis, but the snapshot data was stale and incomplete (missing published flag), allowing access to event metadata the caller should not see. This is the closest CAPEC to the pattern of relying on a trusted data source that does not reflect current authorization state. Uncertainty: no CAPEC perfectly describes \u0027stale authorization snapshot in a join table\u0027; CAPEC-126 is the best available match."
                  }
                ],
                "commit": "2ffa97f0526cd6579b91a4dea560f6246ecbe108",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Wenhao Wu"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: An authenticated user simply requests the related events endpoint; no race condition or complex manipulation is needed. AT:N: No attack-target manipulation required. PR:L: Requires a low-privilege authenticated user with access to at least one event. UI:N: No user interaction needed. VC:L: Disclosure is limited to event metadata (title, date, correlation counts), not full event content or attributes. VI:N, VA:N: No integrity or availability impact. SC:N, SI:N, SA:N: No secondary impacts on other systems. The overall score reflects a low-severity information disclosure requiring authentication.",
                "fixSummary": "The fix enforces proper per-event authorization on the related events query by applying the user\u0027s full access-control conditions (including published status, distribution level, and sharing group membership) to the event lookup, rather than relying solely on the stale distribution snapshot stored in the correlation table. This ensures that only events the caller is currently permitted to read are returned in the related events list.",
                "generatedAt": "2026-10-02T15:59:27.212571Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 6,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "c315cbcd2cad3e0a5886680a4c6a903d9ed5f3fe3893670f74786cea77a56eb3",
                "patchSummary": "In EventsController.php (viewRelatedEvents) and Event.php (getRelatedEvents), the query that fetches related event metadata previously used only Event.id IN (relatedEventIds) as the condition. The patch replaces this with a call to createEventConditions($user), which builds the full set of authorization conditions (published flag, distribution, sharing group), and then adds the Event.id filter on top. The stale comment claiming ACL was enforced via the correlation table was removed. Two files changed, 8 insertions, 9 deletions.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "2ffa97f0526cd6579b91a4dea560f6246ecbe108",
                    "date": "Tue, 22 Sep 2026 15:14:32 +0200",
                    "patchSha256": "c315cbcd2cad3e0a5886680a4c6a903d9ed5f3fe3893670f74786cea77a56eb3",
                    "source": "https://github.com/MISP/MISP/commit/2ffa97f05.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/2ffa97f05.patch",
                    "subject": "fix: [security] Scope the related event list to what the"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/2ffa97f05.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-02T15:59:27Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [security] Scope the related event list to what the",
                "tagVersionBoundary": {
                  "commits_after_fix": 50,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The related events query did not apply the caller\u0027s per-event authorization checks (published status, distribution, sharing group). The system relied on a stale snapshot in the correlation table instead of re-validating access, effectively omitting the authorization step for the returned events."
                  },
                  {
                    "cweId": "CWE-285",
                    "rationale": "Even though some authorization existed (via the correlation table snapshot), it was based on outdated data and lacked the published flag check, making the authorization decision incorrect for events whose access parameters had changed or that were unpublished."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (2ffa97f0526cd6579b91a4dea560f6246ecbe108): fix: [security] Scope the related event list to what the",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/2ffa97f05.patch"
                    ],
                    "timestamp": "2026-09-22T13:14:32Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20165"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-104910",
    "datePublished": "2026-10-02T16:01:32.781Z",
    "dateReserved": "2026-10-02T16:01:26.599Z",
    "dateUpdated": "2026-10-03T15:52:56.095Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104908",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T16:18:57.561492Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T16:19:17.687Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "DecayingModelController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/DecayingModelController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging exclusively to the importing user\u0027s organisation, with the default flag forced to off.\u003c/p\u003e\u003cp\u003eHowever, the application stripped only the top-level id and uuid fields and pinned org_id and default on the outer array before saving the data flat. A user with decaying-model permissions could supply a nested model key carrying its own primary key, organisation identifier, and default flag, which bypassed those guards during the save operation.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- A user with perm_decaying could overwrite an existing decaying model belonging to another organisation in place, altering its name, formula, parameters, or ownership.\u003c/p\u003e\u003cp\u003e- A user could create or modify a model flagged as the organisation default, affecting scoring behaviour for other users.\u003c/p\u003e\u003cp\u003e- A user could reassign a model\u0027s organisation to an arbitrary value.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- Authenticated user with decaying-model permission (perm_decaying).\u003c/p\u003e\u003cp\u003e- Network access to the MISP instance.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging exclusively to the importing user\u0027s organisation, with the default flag forced to off.\n\nHowever, the application stripped only the top-level id and uuid fields and pinned org_id and default on the outer array before saving the data flat. A user with decaying-model permissions could supply a nested model key carrying its own primary key, organisation identifier, and default flag, which bypassed those guards during the save operation.\n\nImpact:\n\n- A user with perm_decaying could overwrite an existing decaying model belonging to another organisation in place, altering its name, formula, parameters, or ownership.\n\n- A user could create or modify a model flagged as the organisation default, affecting scoring behaviour for other users.\n\n- A user could reassign a model\u0027s organisation to an arbitrary value.\n\nPreconditions:\n\n- Authenticated user with decaying-model permission (perm_decaying).\n\n- Network access to the MISP instance.\n\nAffected: \u003c2.5.48."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-13",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-13 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-02T15:55:12Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-915",
              "description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T15:56:13.969Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/70e319e4b"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe import handler now builds the model record from an explicit allow-list of permitted fields (name, parameters, description, ref, formula, version, enabled, all_orgs) using array_intersect_key, discarding any unlisted keys including nested model objects. The organisation identifier and default flag are set unconditionally after filtering. The save operation is preceded by an explicit create() call and the data is wrapped in the proper model key, preventing the ORM from interpreting attacker-supplied nested keys as separate model attributes.\u003c/p\u003e"
            }
          ],
          "value": "The import handler now builds the model record from an explicit allow-list of permitted fields (name, parameters, description, ref, formula, version, enabled, all_orgs) using array_intersect_key, discarding any unlisted keys including nested model objects. The organisation identifier and default flag are set unconditionally after filtering. The save operation is preceded by an explicit create() call and the data is wrapped in the proper model key, preventing the ORM from interpreting attacker-supplied nested keys as separate model attributes."
        }
      ],
      "title": "MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 21 commits after fix); the patch metadata does not explicitly state a fixed version string, so \u0027\u003c 2.5.48\u0027 is an analyst inference.",
                  "The CAPEC-13 mapping is the closest available pattern; the attack is specifically a mass-assignment bypass via a nested model key rather than a generic parameter tampering, but no CAPEC entry precisely describes ORM-level mass assignment through nested keys.",
                  "CVSS PR:L assumes perm_decaying is a low-privilege role available to many users; if it requires elevated privileges the score would be lower.",
                  "The Co-Authored-By line references an AI assistant (Claude Opus 5); it is recorded as a tool credit, not a human remediation developer.",
                  "No evidence of active exploitation or public PoC was found in the patch; SSVCE exploitation is set to \u0027none\u0027.",
                  "The patch does not specify authentication requirements beyond perm_decaying; it is assumed this is a standard MISP role rather than an admin-level permission."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-13",
                    "rationale": "The attacker tampers with the import request parameters by injecting a nested DecayingModel key containing unauthorized fields (id, org_id, default) that the application\u0027s top-level stripping did not filter. This is a direct form of parameter tampering where extra or modified parameters in the request bypass the intended input validation. The mapping is a close fit because the attack vector is manipulation of request parameters rather than a separate injection or protocol-level attack."
                  }
                ],
                "commit": "70e319e4b9dbbeca173befce2340eedf9d86f1b0",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5"
                  }
                ],
                "cvssRationale": "AV:N - MISP is a network-accessible web application. AC:L - the attack requires only crafting a JSON payload with a nested key; no race condition or complex timing is needed. AT:N - no in-transit tampering required. PR:L - requires an authenticated user with perm_decaying, a low-privilege role. UI:N - no victim interaction needed. VC:N - no confidentiality impact; the attacker does not read data they cannot already access. VI:H - high integrity impact: an existing model belonging to another organisation can be overwritten in place, its ownership reassigned, or its default flag set, altering scoring for other users. VA:N - no availability impact. SC/SI/SA:N - the impact is confined to the MISP instance itself (same component); no secondary component is affected. Scope is not changed because both the vulnerable and impacted components are the MISP application and its data store.",
                "fixSummary": "The import handler now builds the model record from an explicit allow-list of permitted fields (name, parameters, description, ref, formula, version, enabled, all_orgs) using array_intersect_key, discarding any unlisted keys including nested model objects. The organisation identifier and default flag are set unconditionally after filtering. The save operation is preceded by an explicit create() call and the data is wrapped in the proper model key, preventing the ORM from interpreting attacker-supplied nested keys as separate model attributes.",
                "generatedAt": "2026-10-02T15:55:12.256144Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 6,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "2ea9ae3603b60db40cddef05bf41462c4b235652ccd53d6e8a5596006232e59d",
                "patchSummary": "In DecayingModelController::import(), the previous logic of unsetting id/uuid and pinning org_id/default on the flat array was replaced with an allow-list approach: array_intersect_key against a fixed set of importable fields, followed by explicit assignment of org_id from the authenticated user and default=0. A DecayingModel::create() call was added before save, and the save payload is now wrapped as array(\u0027DecayingModel\u0027 =\u003e $model) to bind the data to the correct model context. A regression test (DecayingModelImportOwnership) was added that verifies a nested DecayingModel key with a foreign id, org_id, and default=1 cannot overwrite or reassign an existing model.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "70e319e4b9dbbeca173befce2340eedf9d86f1b0",
                    "date": "Fri, 25 Sep 2026 14:22:03 +0200",
                    "patchSha256": "2ea9ae3603b60db40cddef05bf41462c4b235652ccd53d6e8a5596006232e59d",
                    "source": "https://github.com/MISP/MISP/commit/70e319e4b.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/70e319e4b.patch",
                    "subject": "fix: [security] Imported decaying models belong to the"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/70e319e4b.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-02T15:55:12Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [security] Imported decaying models belong to the",
                "tagVersionBoundary": {
                  "commits_after_fix": 21,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-915",
                    "rationale": "The import endpoint accepted user-supplied data and saved it without restricting which object attributes could be set. A nested model key allowed the attacker to modify the primary key, organisation, and default flag of a record, which are attributes that should be controlled exclusively by the application. This is a classic mass-assignment / improper dynamic attribute modification issue."
                  },
                  {
                    "cweId": "CWE-285",
                    "rationale": "The application failed to enforce that the imported model belongs to the caller\u0027s organisation. A user with only perm_decaying could modify records owned by other organisations, indicating an authorization boundary was not enforced on the object being written."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (70e319e4b9dbbeca173befce2340eedf9d86f1b0): fix: [security] Imported decaying models belong to the",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/70e319e4b.patch"
                    ],
                    "timestamp": "2026-09-25T12:22:03Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20189"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-104908",
    "datePublished": "2026-10-02T15:56:13.969Z",
    "dateReserved": "2026-10-02T15:56:12.330Z",
    "dateUpdated": "2026-10-02T16:19:17.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-103858",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-01T15:00:37.761849Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-01T15:00:57.587Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "PostsController (discussion/thread posting)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/PostsController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "unspecified",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Bastien Bossiroy and C\u00e9lien Desteucq of NCIA"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization (org-only distribution). It did not enforce the full thread access control list, including sharing-group membership and event-level visibility.\u003c/p\u003e\u003cp\u003eAs a result, an authenticated user who is outside the relevant sharing group or who does not have visibility on the associated event could:\u003c/p\u003e\u003cp\u003e- Read the thread title and the content of the quoted post\u003c/p\u003e\u003cp\u003e- Submit a new post into the discussion thread\u003c/p\u003e\u003cp\u003eThis constitutes both an information disclosure (reading restricted thread and post content) and an integrity issue (injecting content into a thread the user is not authorized to participate in).\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48\u003c/p\u003e"
            }
          ],
          "value": "MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization (org-only distribution). It did not enforce the full thread access control list, including sharing-group membership and event-level visibility.\n\nAs a result, an authenticated user who is outside the relevant sharing group or who does not have visibility on the associated event could:\n\n- Read the thread title and the content of the quoted post\n\n- Submit a new post into the discussion thread\n\nThis constitutes both an information disclosure (reading restricted thread and post content) and an integrity issue (injecting content into a thread the user is not authorized to participate in).\n\nAffected: \u003c2.5.48"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-10",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-10 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-01T11:16:47Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T11:31:32.840Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/79fbd4c75"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix replaces the limited org-only distribution check with a call to the thread\u0027s full authorization method (checkIfAuthorised), which enforces the complete access control list including sharing groups and event-level visibility. The thread is only read after successful authorization, preventing disclosure of the title and content to unauthorized users. An additional null-check on the post\u0027s thread_id was added to prevent referencing posts without a valid thread association.\u003c/p\u003e"
            }
          ],
          "value": "The fix replaces the limited org-only distribution check with a call to the thread\u0027s full authorization method (checkIfAuthorised), which enforces the complete access control list including sharing groups and event-level visibility. The thread is only read after successful authorization, preventing disclosure of the title and content to unauthorized users. An additional null-check on the post\u0027s thread_id was added to prevent referencing posts without a valid thread association."
        }
      ],
      "title": "MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact affected version range is uncertain; the tag boundary v2.5.48 with 42 commits after the fix suggests the fix landed around or before v2.5.48, but the precise first-affected and first-fixed versions are not stated in the patch.",
                  "The checkIfAuthorised() method is assumed to enforce the full thread ACL including sharing groups and event visibility, based on the commit message description; the method\u0027s implementation is not included in the patch.",
                  "CAPEC-10 (Parameter Tampering) is the closest available CAPEC mapping; no CAPEC specifically covers \u0027incomplete authorization check on a direct object reference\u0027 was identified in the catalog.",
                  "The CVSS assumes the attacker already possesses a valid MISP account (PR:L); unauthenticated access is not indicated by the patch.",
                  "The AI co-author (Claude Opus 5.5) is credited as a tool rather than a person, per the Co-Authored-By line."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-10",
                    "rationale": "The attacker manipulates the target_id parameter (thread_id or post_id) in the posts/add request to reference a thread or post they do not have full access to. The incomplete server-side authorization check then permits the operation. CAPEC-10 is the closest available pattern for exploiting a server\u0027s failure to properly validate the authorization context of a user-supplied resource identifier. Uncertainty: no CAPEC specifically named \u0027Insecure Direct Object Reference\u0027 or \u0027Broken Access Control via Incomplete ACL\u0027 exists in the CAPEC catalog, so Parameter Tampering is the best available match."
                  }
                ],
                "commit": "79fbd4c7580adc0518581351c3d8c3d5b3ac7c97",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Bastien Bossiroy and C\u00e9lien Desteucq of NCIA"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: web application accessible over network. AC:L: attacker only needs a valid thread_id or post_id, no race conditions or special timing. AT:N: no special attack prerequisites beyond authentication. PR:L: requires an authenticated MISP user account. UI:N: no victim interaction needed; the attacker directly issues the request. VC:L: attacker can read thread titles and quoted post content they should not see. VI:L: attacker can inject posts into unauthorized threads. VA:N: no availability impact. SC/SI/SA:N: no impact on subsequent components. The impact is bounded to the MISP instance\u0027s data and does not compromise the server or other systems.",
                "fixSummary": "The fix replaces the limited org-only distribution check with a call to the thread\u0027s full authorization method (checkIfAuthorised), which enforces the complete access control list including sharing groups and event-level visibility. The thread is only read after successful authorization, preventing disclosure of the title and content to unauthorized users. An additional null-check on the post\u0027s thread_id was added to prevent referencing posts without a valid thread association.",
                "generatedAt": "2026-10-01T11:16:47.016611Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "04551eba9b017a1a2ccf05a79c21466f3fd7095a42750bd2704d57b2e3730938",
                "patchSummary": "In PostsController.php add() method: (1) For the \u0027thread\u0027 target case, replaced the inline distribution==0 and org_id comparison with a call to Thread-\u003echeckIfAuthorised() before reading the thread; removed the separate _isSiteAdmin() bypass. (2) For the \u0027post\u0027 target case, added a check that the post has a non-empty thread_id, replaced the same limited distribution/org check with Thread-\u003echeckIfAuthorised(), and reordered the thread read to occur after the authorization check. Net: 8 insertions, 12 deletions in one file.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "79fbd4c7580adc0518581351c3d8c3d5b3ac7c97",
                    "date": "Wed, 23 Sep 2026 15:27:08 +0200",
                    "patchSha256": "04551eba9b017a1a2ccf05a79c21466f3fd7095a42750bd2704d57b2e3730938",
                    "source": "https://github.com/MISP/MISP/commit/79fbd4c75.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/79fbd4c75.patch",
                    "subject": "fix: [security] Apply the thread ACL when posting to a"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/79fbd4c75.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-01T11:16:47Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [security] Apply the thread ACL when posting to a",
                "tagVersionBoundary": {
                  "commits_after_fix": 42,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-285",
                    "rationale": "The authorization check was present but incomplete: it only verified org-level distribution (distribution==0) and org_id match, failing to enforce sharing-group membership and event-level ACL. This is a classic case of insufficient authorization logic rather than a completely missing check, making CWE-285 more precise than CWE-862."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (79fbd4c7580adc0518581351c3d8c3d5b3ac7c97): fix: [security] Apply the thread ACL when posting to a",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/79fbd4c75.patch"
                    ],
                    "timestamp": "2026-09-23T13:27:08Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20244"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-103858",
    "datePublished": "2026-10-01T11:31:32.840Z",
    "dateReserved": "2026-10-01T11:31:31.101Z",
    "dateUpdated": "2026-10-01T15:00:57.587Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-103659",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-01T15:24:35.363182Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-01T15:24:42.585Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Event model (app/Model/Event.php)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/Event.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Wenhao Wu"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distribution and sharing-group access control check was not re-applied to those attributes.\u003c/p\u003e\u003cp\u003eAs a result, a user who can view a community-distributed event could retrieve attributes belonging to organisation-only objects (distribution level 0) or objects restricted to a specific sharing group, even though the user\u0027s organisation does not have access to those objects. This constitutes an unauthorized disclosure of sensitive threat intelligence data.\u003c/p\u003e\u003cp\u003eA secondary issue was introduced by the initial remediation: the fix reused the full Object contain conditions (including soft-delete state) as the gate for flattened attributes, causing an event owner requesting deleted attributes to lose all attributes whose parent object was still live. The final fix isolates the distribution ACL condition as the sole gate.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- An authenticated user with access to a community-distributed event\u003c/p\u003e\u003cp\u003e- The event contains at least one object with a distribution level or sharing group that restricts access beyond the event\u0027s own distribution\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Unauthorized disclosure of attributes belonging to restricted objects\u003c/p\u003e\u003cp\u003e- Potential exposure of organisation-specific threat intelligence to other organisations\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48\u003c/p\u003e"
            }
          ],
          "value": "MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distribution and sharing-group access control check was not re-applied to those attributes.\n\nAs a result, a user who can view a community-distributed event could retrieve attributes belonging to organisation-only objects (distribution level 0) or objects restricted to a specific sharing group, even though the user\u0027s organisation does not have access to those objects. This constitutes an unauthorized disclosure of sensitive threat intelligence data.\n\nA secondary issue was introduced by the initial remediation: the fix reused the full Object contain conditions (including soft-delete state) as the gate for flattened attributes, causing an event owner requesting deleted attributes to lose all attributes whose parent object was still live. The final fix isolates the distribution ACL condition as the sole gate.\n\nPreconditions:\n\n- An authenticated user with access to a community-distributed event\n\n- The event contains at least one object with a distribution level or sharing group that restricts access beyond the event\u0027s own distribution\n\nImpact:\n\n- Unauthorized disclosure of attributes belonging to restricted objects\n\n- Potential exposure of organisation-specific threat intelligence to other organisations\n\nAffected versions: \u003c2.5.48"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Exploiting Incorrectly Adjusted Privileges"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-01T08:10:59Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T08:33:05.141Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/ab08edf92"
        },
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/07f3486d5"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix re-applies the object distribution and sharing-group ACL as a subquery condition on the Attribute.object_id field whenever the flatten option is active. This ensures that attributes belonging to objects the caller is not authorized to see are excluded from the flattened result set. The second commit refines the gate to use only the distribution ACL condition (correlated on Object.id) rather than the entire Object contain, preventing soft-delete state from incorrectly filtering attributes for the event owner.\u003c/p\u003e"
            }
          ],
          "value": "The fix re-applies the object distribution and sharing-group ACL as a subquery condition on the Attribute.object_id field whenever the flatten option is active. This ensures that attributes belonging to objects the caller is not authorized to see are excluded from the flattened result set. The second commit refines the gate to use only the distribution ACL condition (correlated on Object.id) rather than the entire Object contain, preventing soft-delete state from incorrectly filtering attributes for the event owner."
        }
      ],
      "title": "MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is unspecified; the patch does not include version tags or release boundaries. All MISP versions prior to the fix commit are assumed affected.",
                  "The CVSS PR:L assumes the attacker needs at minimum a read-access role on the community event; no evidence supports a lower or higher privilege requirement.",
                  "The CAPEC-126 mapping is the closest available pattern; no CAPEC specifically describes a missing per-object ACL in a flattened API response. The mapping is approximate.",
                  "The second commit (soft-delete fix) is treated as part of the same vulnerability remediation per the patch-set assumption, though it addresses a regression introduced by the first fix rather than the original authorization bypass.",
                  "AI co-authors (Claude Opus 4.8, Claude Opus 5) are listed in commit metadata but are not included as advisory credits as they are tooling, not human contributors.",
                  "No evidence of active exploitation, public PoC, or in-the-wild abuse was found in the supplied data."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The attacker (a legitimate user with access to a community event) exploits the fact that the application\u0027s privilege/access-control enforcement is incorrectly adjusted during the flatten operation. The object-level ACL is not applied, effectively elevating the user\u0027s data access beyond their intended scope. This is the closest CAPEC pattern to an authorization bypass where the application fails to enforce a narrower access control in a specific code path. Uncertainty: no CAPEC pattern specifically describes \u0027missing per-object ACL in a flattened view\u0027; CAPEC-126 is the best available match for privilege/access-control bypass."
                  }
                ],
                "commit": "07f3486d50f2a5ee0f31ea66c920692664397ddb",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Wenhao Wu"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5"
                  }
                ],
                "cvssRationale": "AV:N - exploited over the network via the MISP REST API. AC:L - the attack is a simple API request with the flatten parameter; no race conditions or complex setup required. AT:N - no special target-side conditions beyond the existence of a community event with restricted objects. PR:L - requires an authenticated user with at least read access to the community event. UI:N - no user interaction needed; the API call is self-contained. VC:H - sensitive threat-intelligence attributes from organisation-only objects are fully exposed to unauthorized users. VI:N, VA:N - no integrity or availability impact on the vulnerable component. SC:N, SI:N, SA:N - no impact on subsequent components; the data resides within the same application.",
                "fixSummary": "The fix re-applies the object distribution and sharing-group ACL as a subquery condition on the Attribute.object_id field whenever the flatten option is active. This ensures that attributes belonging to objects the caller is not authorized to see are excluded from the flattened result set. The second commit refines the gate to use only the distribution ACL condition (correlated on Object.id) rather than the entire Object contain, preventing soft-delete state from incorrectly filtering attributes for the event owner.",
                "generatedAt": "2026-10-01T08:10:59.855811Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 6,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "e74b42214be094a3c715d859dd20b9ecd7091d30a187ab4583a7ec0f070c0581",
                "patchSummary": "In app/Model/Event.php, two code paths were modified. In fetchPaginatedAttributes(), a new subquery is generated against the Object table using the distribution and sharing-group ACL conditions, and an OR condition is added to the attribute query: either Attribute.object_id = 0 (top-level attribute) or the attribute\u0027s object passes the ACL. In fetchEvent(), when flatten is true and the user is not a site admin, a similar subquery is injected into the Attribute contain conditions. The second commit refactors the ACL condition into a standalone variable ($objectAclCondition) and uses only that condition (plus Object.id = Attribute.object_id) in the subquery, removing the soft-delete and other contain conditions that were incorrectly included. A regression test class (FlattenedObjectAcl) in tests/testregressions.py verifies: (1) an outsider cannot see organisation-only object attributes via flatten, (2) the owner retains soft-deleted attributes of a live object, and (3) the outsider cannot see another org\u0027s soft",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "ab08edf9256bb3c9c8a382e0778ecd10b9e29c7c",
                    "date": "Wed, 23 Sep 2026 09:25:31 +0200",
                    "patchSha256": "ebc10168f16d00a458d924a62fe76e00277217c8449c694eeb4442d6d3a724a0",
                    "source": "https://github.com/MISP/MISP/commit/ab08edf92.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/ab08edf92.patch",
                    "subject": "fix: [security] Apply the object ACL to flattened attributes"
                  },
                  {
                    "commit": "07f3486d50f2a5ee0f31ea66c920692664397ddb",
                    "date": "Mon, 28 Sep 2026 13:41:23 +0200",
                    "patchSha256": "18601512c29df510bfdc629de713cffd41af868e7d230374aa346c92829e40de",
                    "source": "https://github.com/MISP/MISP/commit/07f3486d5.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/07f3486d5.patch",
                    "subject": "fix: [event] Gate flattened attributes on the object ACL"
                  }
                ],
                "source": "patch set (2 sources)",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-01T08:10:59Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [event] Gate flattened attributes on the object ACL",
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The flattening code path removed the Object contain (which enforced distribution and sharing-group ACLs) without re-applying an equivalent authorization check on the resulting top-level attributes. The object-level access control was simply absent from the flattened query, allowing unauthorized data access."
                  },
                  {
                    "cweId": "CWE-285",
                    "rationale": "The authorization decision for object attributes was based solely on the event-level distribution rather than the object-level distribution and sharing group. This is an improper authorization check that grants broader access than intended."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (ab08edf9256bb3c9c8a382e0778ecd10b9e29c7c): fix: [security] Apply the object ACL to flattened attributes",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/ab08edf92.patch"
                    ],
                    "timestamp": "2026-09-23T07:25:31Z",
                    "type": "fix-developed"
                  },
                  {
                    "description": "Corrective change authored (07f3486d50f2a5ee0f31ea66c920692664397ddb): fix: [event] Gate flattened attributes on the object ACL",
                    "id": "evt-fix-developed-2",
                    "references": [
                      "https://github.com/MISP/MISP/commit/07f3486d5.patch"
                    ],
                    "timestamp": "2026-09-28T11:41:23Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20257"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-103659",
    "datePublished": "2026-10-01T08:33:05.141Z",
    "dateReserved": "2026-10-01T08:33:03.219Z",
    "dateUpdated": "2026-10-01T15:24:42.585Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-103532",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-01T18:58:15.324035Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-01T18:58:33.513Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/immich-app/immich/issues/29599"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:immich:immich:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Shared Link Preview Handler"
          ],
          "product": "Immich",
          "vendor": "immich-app",
          "versions": [
            {
              "status": "affected",
              "version": "2.7.0"
            },
            {
              "status": "affected",
              "version": "2.7.1"
            },
            {
              "status": "affected",
              "version": "2.7.2"
            },
            {
              "status": "affected",
              "version": "2.7.3"
            },
            {
              "status": "affected",
              "version": "2.7.4"
            },
            {
              "status": "affected",
              "version": "2.7.5"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "geochen (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be initiated remotely. The reported GitHub issue was closed with the label \"duplicate\"."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:ND/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "Incorrect Privilege Assignment",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T01:15:17.384Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-412344 | immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/412344"
        },
        {
          "name": "VDB-412344 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/412344/cti"
        },
        {
          "name": "CVE-2026-103532 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-103532"
        },
        {
          "name": "Submit #957120 | https://github.com/immich-app immich v2.7.5 Missing Authorization",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/957120"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/immich-app/immich/issues/29599"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/immich-app/immich/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-30T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-30T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-30T21:12:03.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-103532",
    "datePublished": "2026-10-01T01:15:17.384Z",
    "dateReserved": "2026-09-30T19:06:55.475Z",
    "dateUpdated": "2026-10-01T18:58:33.513Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-103233",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T19:28:04.699556Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T19:28:22.821Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:adithyayelloju:restaurant-management-system:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Admin Area"
          ],
          "product": "Restaurant-Management-System",
          "vendor": "AdithyaYelloju",
          "versions": [
            {
              "status": "affected",
              "version": "7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "100001001X (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been detected in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This impacts an unknown function of the file /admin/ of the component Admin Area. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T16:30:09.762Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-411927 | AdithyaYelloju Restaurant-Management-System Admin Area admin authorization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/411927"
        },
        {
          "name": "VDB-411927 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/411927/cti"
        },
        {
          "name": "CVE-2026-103233 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-103233"
        },
        {
          "name": "Submit #955096 | AdithyaYelloju Restaurant-Management-System 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Authorization Bypass Through User-Controlled SQL Primary Key",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/955096"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/9"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/AdithyaYelloju/Restaurant-Management-System/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-30T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-30T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-30T10:14:45.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "AdithyaYelloju Restaurant-Management-System Admin Area admin authorization",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-103233",
    "datePublished": "2026-09-30T16:30:09.762Z",
    "dateReserved": "2026-09-30T08:09:24.003Z",
    "dateUpdated": "2026-09-30T19:28:22.821Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102846",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T12:49:17.079478Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T12:49:29.941Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:gedelumbung:hospitalmanagement:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Configuration Handler"
          ],
          "product": "HospitalManagement",
          "vendor": "gedelumbung",
          "versions": [
            {
              "status": "affected",
              "version": "c2d45543789a3887067d3915f69d44cfc2cf76a8"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Chenshiyi (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Configuration Handler. The manipulation of the argument tipe/title/content_setting results in improper authorization. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5.8,
            "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "Incorrect Privilege Assignment",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T01:45:20.309Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-411505 | gedelumbung HospitalManagement Configuration sistem.php simpan improper authorization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/411505"
        },
        {
          "name": "VDB-411505 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/411505/cti"
        },
        {
          "name": "CVE-2026-102846 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-102846"
        },
        {
          "name": "Submit #946242 | gedelumbung HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8 Improper Authorization",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/946242"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/gedelumbung/HospitalManagement/issues/12"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/gedelumbung/HospitalManagement/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-29T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-29T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-29T19:31:19.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "gedelumbung HospitalManagement Configuration sistem.php simpan improper authorization",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-102846",
    "datePublished": "2026-09-30T01:45:20.309Z",
    "dateReserved": "2026-09-29T17:25:54.418Z",
    "dateUpdated": "2026-10-02T12:49:29.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102844",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T17:12:04.100432Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T17:12:17.534Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:gedelumbung:hospitalmanagement:*:*:*:*:*:*:*:*"
          ],
          "product": "HospitalManagement",
          "vendor": "gedelumbung",
          "versions": [
            {
              "status": "affected",
              "version": "c2d45543789a3887067d3915f69d44cfc2cf76a8"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Chenshiyi (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects the function detail of the file application/modules/admin/controllers/laporan_data_pasien.php. Executing a manipulation of the argument id_param can lead to authorization bypass. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 3.3,
            "vectorString": "AV:N/AC:L/Au:M/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T01:15:07.489Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-411503 | gedelumbung HospitalManagement laporan_data_pasien.php detail authorization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/411503"
        },
        {
          "name": "VDB-411503 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/411503/cti"
        },
        {
          "name": "CVE-2026-102844 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-102844"
        },
        {
          "name": "Submit #946240 | gedelumbung HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8 Authorization Bypass Through User-Controlled SQL Primary Key",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/946240"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/gedelumbung/HospitalManagement/issues/10"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/gedelumbung/HospitalManagement/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-29T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-29T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-29T19:31:12.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "gedelumbung HospitalManagement laporan_data_pasien.php detail authorization",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-102844",
    "datePublished": "2026-09-30T01:15:07.489Z",
    "dateReserved": "2026-09-29T17:25:47.987Z",
    "dateUpdated": "2026-09-30T17:12:17.534Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}