Vulnerability-Lookup

FKIE_CVE-2026-104912

Vulnerability from fkie_nvd - Published: 2026-10-02 16:16 - Updated: 2026-10-02 16:16

Severity

7.1 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distribution snapshot stored on the correlation row rather than the live event access control list. Because the correlation row's distribution columns are a point-in-time copy that lacks a published flag, the authorization check becomes incorrect when an event is subsequently restricted (for example, its sharing group is changed or it is unpublished). As a result, an authenticated user could retrieve attributes and event details belonging to events they no longer have permission to view. Preconditions: - An authenticated user with at least read access to some events in the instance. - The existence of correlations between events, at least one of which has been restricted after the correlation was created. Impact: - Confidentiality: exposure of attribute values and event metadata that the user is not authorized to access. Affected versions: MISP prior to v2.5.48.

References

	URL	Tags
	5a6e4751-2f3f-4070-9419-94fb35b644e8	https://github.com/MISP/MISP/commit/100235bd9

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "app/Model/Behavior/DefaultCorrelationBehavior.php"
          ],
          "product": "MISP",
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distribution snapshot stored on the correlation row rather than the live event access control list.\n\nBecause the correlation row\u0027s distribution columns are a point-in-time copy that lacks a published flag, the authorization check becomes incorrect when an event is subsequently restricted (for example, its sharing group is changed or it is unpublished). As a result, an authenticated user could retrieve attributes and event details belonging to events they no longer have permission to view.\n\nPreconditions:\n\n- An authenticated user with at least read access to some events in the instance.\n\n- The existence of correlations between events, at least one of which has been restricted after the correlation was created.\n\nImpact:\n\n- Confidentiality: exposure of attribute values and event metadata that the user is not authorized to access.\n\nAffected versions: MISP prior to v2.5.48."
    }
  ],
  "id": "CVE-2026-104912",
  "lastModified": "2026-10-02T16:16:49.163",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "ssvcData": {
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "Supplier",
          "timestamp": "2026-10-02T16:02:40Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-02T16:16:49.047",
  "references": [
    {
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "url": "https://github.com/MISP/MISP/commit/100235bd9"
    }
  ],
  "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "type": "Secondary"
    }
  ]
}

CVE-2026-104912 (GCVE-0-2026-104912)

Vulnerability from cvelistv5 – Published: 2026-10-02 16:04 – Updated: 2026-10-03 15:52

Title

MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data

Summary

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

Supplier · CIRCL (v2.0.3)

Decision recorded 2026-10-02 16:02 UTC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-03 15:48 UTC

CWE

CWE-862 - Missing Authorization
CWE-284 - Improper Access Control

Assigner

CIRCL ENISA root

References

1 reference

URL	Tags
https://github.com/MISP/MISP/commit/100235bd9	patch

Impacted products

1 product

Vendor	Product	Version
MISP	MISP	Affected: 0 , < 2.5.48 (semver) cpe:2.3:a:misp:misp::::::::

Credits

iglocska Claude Opus 5.5 (1M context) elhoim

GCVE extensions

AI-generated Human-reviewed Confidence: medium Model qwen3.8:27b advisory bcp-05-x-01bcp-05-x-02bcp-05-x-03

AI involvement GCVE-BCP-05-X-01

Whole record AI-generated Human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification

Model	Source	Identifier
qwen3.8:27b	ollama	`qwen3.8:27b`

Patch provenance GCVE-BCP-05-X-02

Generator: patch2vuln.py on 2026-10-02 16:02
Model: qwen3.8:27b
Input: https://github.com/MISP/MISP/commit/100235bd9.patch a38b683420d9…
Confidence: medium

Commit	Subject	Patch SHA-256
`100235bd99b9`	fix: [security] Check correlations against the live event ACL	`a38b683420d9…`

Fix summary

The fix ensures that correlation-based lookups are authorized against the live event and attribute access control lists rather than the stale distribution snapshot on the correlation row. A new filtering step validates related event IDs against the current event ACL before returning them, and attribute queries for non-admin users now include the live ACL conditions. Additionally, Event and Object fields are stripped from returned attribute results to prevent incidental metadata leakage.

Patch summary

In DefaultCorrelationBehavior.php: (1) runGetRelatedAttributes now builds query conditions that include the live attribute ACL (buildConditions) for non-site-admin users, and ensures Event and Object are contained in the query for proper filtering; (2) after fetching related attributes, Event and Object sub-objects are unset from each result; (3) fetchRelatedEventIds now passes its results through a new __filterVisibleEventIds method that queries the Event model with createEventConditions to verify each event ID is still visible to the user; (4) the new __filterVisibleEventIds method returns the event IDs unchanged for site admins or empty lists, otherwise filters against the live event ACL.

CVSS rationale

Network vector: MISP is a web application accessible over the network. Low complexity: the attacker simply performs a normal attribute search that triggers correlations; no race condition or special setup is needed. No attack requirements: the stale correlation row exists naturally after any event restriction. Low privileges: the attacker needs an authenticated account with read access to at least one event. No user interaction: the attacker initiates the search themselves. High vulnerability-component confidentiality impact: full attribute values and event metadata of restricted events are exposed. No integrity or availability impact on the vulnerable or subsequent components.

Weakness rationale

CWE-862 The correlation lookup path failed to enforce the current (live) authorization state of the target events and attributes. Access was granted based on a stale snapshot rather than the actual ACL, effectively missing the authorization check for restricted events.
CWE-284 The access control decision relied on outdated data (the distribution columns copied onto the correlation row) that did not reflect the current published/sharing-group state of the event, leading to improper access control.

Attack pattern rationale

CAPEC-114 The authorization state used for correlation lookups was incorrectly adjusted (stale) relative to the actual event ACL. An attacker with a legitimate account could exploit this misalignment to access data beyond their intended privilege scope. This is the closest CAPEC pattern; the exact mechanism is a stale authorization snapshot rather than a classic privilege-escalation primitive, so the mapping is approximate.

Assumptions to verify

The affected version boundary (< 2.5.48) is inferred from the tag_version_boundary metadata (v2.5.48, 38 commits after fix); the exact first affected version is not stated in the patch.
CVSS PR:L assumes the attacker needs a standard authenticated MISP account with read access to at least one event; no evidence supports a lower or higher privilege requirement.
CAPEC-114 is the closest available pattern; the actual mechanism is a stale authorization snapshot rather than a classic privilege-escalation vector, so the mapping is approximate.
The patch does not specify whether the vulnerability requires the event to have been restricted after correlation creation, or whether other state changes (e.g., sharing group modification) also trigger the issue; the commit message mentions 'restricted' as the primary scenario.
No public exploit or PoC is referenced; exploitation status is assumed to be 'none'.

Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model	Score	Agreement	Confidence	Assumptions
`qwen3.8:27b`	7	11	medium	5

bcp-05-x-03

{
  "x_timeline": {
    "events": [
      {
        "description": "Corrective change authored (100235bd99b9f57a5a09976412d54e2001d2e0c4): fix: [security] Check correlations against the live event ACL",
        "id": "evt-fix-developed-1",
        "references": [
          "https://github.com/MISP/MISP/commit/100235bd9.patch"
        ],
        "timestamp": "2026-09-24T10:12:56Z",
        "type": "fix-developed"
      }
    ]
  }
}

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104912",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:48:11.201423Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:52:55.841Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "app/Model/Behavior/DefaultCorrelationBehavior.php"
          ],
          "product": "MISP",
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "elhoim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distribution snapshot stored on the correlation row rather than the live event access control list.\u003c/p\u003e\u003cp\u003eBecause the correlation row\u0027s distribution columns are a point-in-time copy that lacks a published flag, the authorization check becomes incorrect when an event is subsequently restricted (for example, its sharing group is changed or it is unpublished). As a result, an authenticated user could retrieve attributes and event details belonging to events they no longer have permission to view.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- An authenticated user with at least read access to some events in the instance.\u003c/p\u003e\u003cp\u003e- The existence of correlations between events, at least one of which has been restricted after the correlation was created.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Confidentiality: exposure of attribute values and event metadata that the user is not authorized to access.\u003c/p\u003e\u003cp\u003eAffected versions: MISP prior to v2.5.48.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distribution snapshot stored on the correlation row rather than the live event access control list.\n\nBecause the correlation row\u0027s distribution columns are a point-in-time copy that lacks a published flag, the authorization check becomes incorrect when an event is subsequently restricted (for example, its sharing group is changed or it is unpublished). As a result, an authenticated user could retrieve attributes and event details belonging to events they no longer have permission to view.\n\nPreconditions:\n\n- An authenticated user with at least read access to some events in the instance.\n\n- The existence of correlations between events, at least one of which has been restricted after the correlation was created.\n\nImpact:\n\n- Confidentiality: exposure of attribute values and event metadata that the user is not authorized to access.\n\nAffected versions: MISP prior to v2.5.48."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-114 Exploiting Incorrectly Adjusted Privileges"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-02T16:02:40Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T16:04:50.580Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/100235bd9"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix ensures that correlation-based lookups are authorized against the live event and attribute access control lists rather than the stale distribution snapshot on the correlation row. A new filtering step validates related event IDs against the current event ACL before returning them, and attribute queries for non-admin users now include the live ACL conditions. Additionally, Event and Object fields are stripped from returned attribute results to prevent incidental metadata leakage.\u003c/p\u003e"
            }
          ],
          "value": "The fix ensures that correlation-based lookups are authorized against the live event and attribute access control lists rather than the stale distribution snapshot on the correlation row. A new filtering step validates related event IDs against the current event ACL before returning them, and attribute queries for non-admin users now include the live ACL conditions. Additionally, Event and Object fields are stripped from returned attribute results to prevent incidental metadata leakage."
        }
      ],
      "title": "MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary (\u003c 2.5.48) is inferred from the tag_version_boundary metadata (v2.5.48, 38 commits after fix); the exact first affected version is not stated in the patch.",
                  "CVSS PR:L assumes the attacker needs a standard authenticated MISP account with read access to at least one event; no evidence supports a lower or higher privilege requirement.",
                  "CAPEC-114 is the closest available pattern; the actual mechanism is a stale authorization snapshot rather than a classic privilege-escalation vector, so the mapping is approximate.",
                  "The patch does not specify whether the vulnerability requires the event to have been restricted after correlation creation, or whether other state changes (e.g., sharing group modification) also trigger the issue; the commit message mentions \u0027restricted\u0027 as the primary scenario.",
                  "No public exploit or PoC is referenced; exploitation status is assumed to be \u0027none\u0027."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-114",
                    "rationale": "The authorization state used for correlation lookups was incorrectly adjusted (stale) relative to the actual event ACL. An attacker with a legitimate account could exploit this misalignment to access data beyond their intended privilege scope. This is the closest CAPEC pattern; the exact mechanism is a stale authorization snapshot rather than a classic privilege-escalation primitive, so the mapping is approximate."
                  }
                ],
                "commit": "100235bd99b9f57a5a09976412d54e2001d2e0c4",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  },
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "elhoim"
                  }
                ],
                "cvssRationale": "Network vector: MISP is a web application accessible over the network. Low complexity: the attacker simply performs a normal attribute search that triggers correlations; no race condition or special setup is needed. No attack requirements: the stale correlation row exists naturally after any event restriction. Low privileges: the attacker needs an authenticated account with read access to at least one event. No user interaction: the attacker initiates the search themselves. High vulnerability-component confidentiality impact: full attribute values and event metadata of restricted events are exposed. No integrity or availability impact on the vulnerable or subsequent components.",
                "fixSummary": "The fix ensures that correlation-based lookups are authorized against the live event and attribute access control lists rather than the stale distribution snapshot on the correlation row. A new filtering step validates related event IDs against the current event ACL before returning them, and attribute queries for non-admin users now include the live ACL conditions. Additionally, Event and Object fields are stripped from returned attribute results to prevent incidental metadata leakage.",
                "generatedAt": "2026-10-02T16:02:40.166976Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "a38b683420d93ff26d461badf81e0524bbd9618dd3dd6f187a994f5c5b47f23d",
                "patchSummary": "In DefaultCorrelationBehavior.php: (1) runGetRelatedAttributes now builds query conditions that include the live attribute ACL (buildConditions) for non-site-admin users, and ensures Event and Object are contained in the query for proper filtering; (2) after fetching related attributes, Event and Object sub-objects are unset from each result; (3) fetchRelatedEventIds now passes its results through a new __filterVisibleEventIds method that queries the Event model with createEventConditions to verify each event ID is still visible to the user; (4) the new __filterVisibleEventIds method returns the event IDs unchanged for site admins or empty lists, otherwise filters against the live event ACL.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "100235bd99b9f57a5a09976412d54e2001d2e0c4",
                    "date": "Thu, 24 Sep 2026 12:12:56 +0200",
                    "patchSha256": "a38b683420d93ff26d461badf81e0524bbd9618dd3dd6f187a994f5c5b47f23d",
                    "source": "https://github.com/MISP/MISP/commit/100235bd9.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/100235bd9.patch",
                    "subject": "fix: [security] Check correlations against the live event ACL"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/100235bd9.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-02T16:02:40Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [security] Check correlations against the live event ACL",
                "tagVersionBoundary": {
                  "commits_after_fix": 38,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The correlation lookup path failed to enforce the current (live) authorization state of the target events and attributes. Access was granted based on a stale snapshot rather than the actual ACL, effectively missing the authorization check for restricted events."
                  },
                  {
                    "cweId": "CWE-284",
                    "rationale": "The access control decision relied on outdated data (the distribution columns copied onto the correlation row) that did not reflect the current published/sharing-group state of the event, leading to improper access control."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (100235bd99b9f57a5a09976412d54e2001d2e0c4): fix: [security] Check correlations against the live event ACL",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/MISP/commit/100235bd9.patch"
                    ],
                    "timestamp": "2026-09-24T10:12:56Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20312"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-104912",
    "datePublished": "2026-10-02T16:04:50.580Z",
    "dateReserved": "2026-10-02T16:04:47.753Z",
    "dateUpdated": "2026-10-03T15:52:55.841Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted