CVE-2026-103659

Executive Summary

CVE-2026-103659 is an authorization bypass (CWE-285) in MISP's event flattening feature. When an authenticated user requests an event with the flatten option enabled, the application strips Object containment from the query and promotes object attributes to top-level event attributes without re-applying the parent objects' distribution level and sharing-group access control checks. Any authenticated user who can view a community-distributed event can therefore retrieve attributes belonging to organisation-only objects (distribution level 0) or objects restricted to a specific sharing group that their organisation is not a member of, resulting in unauthorized disclosure of sensitive threat intelligence data.

Technical Analysis

MISP organizes threat intelligence into events, and events contain attributes. Attributes can also be grouped under objects, which carry their own metadata and their own access-control semantics — most importantly a distribution level and, where applicable, a sharing group. When an event is retrieved in normal (nested) form, the Object containment relationship is preserved, and the per-object access control rules are evaluated, so attributes belonging to a restricted object are withheld from users whose organisation is not entitled to see them.

The flatten option changes the shape of the query. Instead of returning objects with nested attributes, the application removes the Object containment from the query and returns object attributes as top-level event attributes. This is intended as a presentation convenience: a flat list of attributes that a consuming tool or analyst can process without walking a nested structure.

The defect is that this transformation is purely structural. The distribution and sharing-group access control check that normally guards the object's attributes is bound to the object context, and once containment is removed, that context is no longer available to the query. The check was consequently not re-applied to the flattened attributes. The authorization decision for those attributes was effectively dropped rather than re-evaluated at the new, flatter level.

The result is a confused-deputy style authorization bypass: the requesting user is legitimately authorized to view the event (its own distribution permits community access), and the request is processed under that legitimate authorization, but attributes whose true authorization domain is narrower — distribution level 0 (organisation-only) or a specific sharing group — are returned anyway. The flaw is not a privilege escalation into new functionality, nor a code-execution primitive; it is a data-disclosure flaw consisting of an authorization check that is silently skipped.

A secondary regression was introduced by the initial remediation attempt. That fix reused the full Object containment conditions — including soft-delete state — as the gate for flattened attributes. Because the soft-delete predicate was now applied as an access condition rather than as a data-filtering condition, an event owner requesting deleted attributes would lose all attributes whose parent object was still live. In other words, the first fix over-restricted, producing attribute loss for legitimate owners. The final fix isolates the distribution access-control condition as the sole gate for flattened attributes, preserving correct access decisions while removing the soft-delete predicate from the authorization path.

Preconditions (from the description):

• An authenticated user with access to a community-distributed event.
• The event contains at least one object whose distribution level or sharing group restricts access beyond the event's own distribution.

Both conditions must hold. If every object in the event shares the event's distribution, there is nothing extra to disclose. The vulnerability's blast radius is thus bounded by how much object-level restriction exists inside events a given user can already see — which, in real MISP deployments, is precisely where the most sensitive organisation-specific indicators tend to live.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. The attack chain below is inferred from the vulnerability class (authorization bypass via omitted access-control re-evaluation on a query transformation) and from the technical mechanism stated in the description. No specific function names, class names, API paths, or parameter names beyond those appearing in the NVD description ("flatten option", "Object containment") are asserted here, because none are provided.

1. Reconnaissance and target identification. The attacker requires authenticated access to the MISP instance. The relevant capability is modest: the account must be able to view at least one event whose distribution is community-level. The attacker enumerates events available to their organisation and identifies those containing objects — objects are visible in the event's normal presentation, and their presence indicates that object-level attributes exist that may carry narrower distribution than the event itself. No special privileges, elevated role, or administrative capability are needed.

2. Triggering the flaw. The attacker requests the identified event with the flatten option enabled. This is a legitimate, documented presentation mode rather than an exploit payload; the request is well-formed and passes ordinary authentication and event-level authorization. The act of flattening is what causes the application to remove Object containment from the query and to return the object attributes as top-level event attributes. At that point, the object-level distribution and sharing-group check is not re-applied.

3. Retrieval of restricted attributes. The response contains attributes that, in the object's own context, are restricted to distribution level 0 (organisation-only) or to a sharing group the attacker's organisation does not belong to. The attacker does not need to alter the response, guess identifiers, or craft injection syntax — the attributes are simply present in a response the attacker was entitled to receive, which is characteristic of this vulnerability class and also why the disclosure is easy to overlook. Repeating the request across many community-distributed events allows methodical harvesting.

4. Post-exploitation impact. The disclosed attributes constitute sensitive threat intelligence: organisation-specific indicators and context that the producing organisation deliberately did not share with the attacker's community. The attacker can use this for competitive or operational advantage, to infer the producing organisation's visibility into specific threats, to attribute intelligence sources, or to enrich their own detection and targeting. There is no code execution, persistence, or lateral movement in this chain — the impact is confidentiality loss of data the attacker was never authorized to read.

Note on the regression: an event owner requesting deleted attributes under the initial, flawed remediation would lose attributes whose parent object was still live. This is a correctness/availability side effect affecting legitimate users, not an attacker capability, and is documented here because it affects how an interim fix should be evaluated if one has been deployed.

Impact Assessment

The primary impact is unauthorized disclosure of sensitive threat intelligence data — CWE-285 (Improper Authorization). NVD has not published a CVSS score or vector for this CVE, so no official base, temporal, or environmental subscores are available; no score should be inferred or fabricated. Qualitatively, the confidentiality impact is the dominant concern, while integrity and availability are unaffected in the exploit path itself. The secondary regression caused by the initial remediation introduces a limited availability/correctness impact for event owners, not for attackers.

Affected systems are MISP instances. Because MISP is commonly deployed as a shared, community or sectoral platform, a single authenticated low-privilege account is sufficient to reach data contributed by many organisations. The blast radius is therefore not limited to the attacker's own organisation: every event visible to that account which contains at least one object with distribution level 0 or a restrictive sharing group is a potential disclosure source. The more granular and restrictive an organisation's object-level sharing posture — that is, the more carefully it compartmentalises intelligence — the more it stands to lose from this flaw, since the vulnerability specifically defeats that compartmentalisation.

Business impact includes loss of trust between sharing-community members, potential contractual or regulatory consequences where threat intelligence sharing agreements specify handling restrictions, and the strategic disadvantage of exposing an organisation's private indicators and source visibility. Detection is difficult because the requests are legitimate, authenticated, and low-volume in a single instance; the anomalous signal is the pattern of repeated flatten-mode retrievals across many events, not any malformed input.

Detection Guidance

Sigma Rule

title: MISP Event Flatten Authorization Bypass - Repeated Flatten Retrievals
id: 8c1f2a94-3b7e-4d5a-9f21-misp103659
status: experimental
description: Detects authenticated requests retrieving MISP events with the flatten option enabled, a pattern abused by CVE-2026-103659 to bypass object-level distribution and sharing-group ACLs.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103659
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: misp
detection:
  selection_request:
    cs-method: 'GET'
    cs-uri-query|contains:
      - 'flatten'
  selection_event_path:
    cs-uri-stem|contains:
      - '/events/view'
  condition: selection_request and selection_event_path
falsepositives:
  - Legitimate analysts using flatten mode for tooling integration
  - Automated export pipelines configured to flatten events
level: medium
tags:
  - attack.t1213
  - cve.2026.103659

YARA Rule

rule CVE_2026_103659_MISP_Flatten_ACL_Bypass
{
    meta:
        description = "Detects MISP flatten-option request handling associated with CVE-2026-103659 object-level ACL bypass"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103659"
        date = "2026-01-01"

    strings:
        $flatten = "flatten" ascii wide nocase
        $contain = "contain" ascii wide nocase
        $distro  = "distribution" ascii wide nocase
        $sharing = "sharing_group" ascii wide nocase
        $object  = "Object" ascii wide

    condition:
        filesize < 2MB and
        $flatten and
        $object and
        ($distro or $sharing) and
        $contain
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103659 MISP Event Flatten Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/events/view"; http.uri; content:"flatten"; nocase; classtype:attempted-recon; reference:cve,2026-103659; metadata:affected_product MISP, attack_target Web_Server, deployment Perimeter, signature_severity Minor; sid:2026103659; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=10m
  [http where http.request.method == "GET" and
     http.request.uri : "/events/view" and
     http.request.uri : "flatten" and
     user.name != null] with runs=5

Splunk SPL Query

index=web sourcetype=misp OR sourcetype=access_combined
| search uri_path="*/events/view*" uri_query="*flatten*"
| rex field=uri_query "flatten[=:]?(?<flatten_val>\w+)?"
| stats count AS flatten_requests, values(uri_query) AS queries, dc(uri_path) AS distinct_paths
    by src_ip, user
| where flatten_requests > 10
| sort - flatten_requests
| table src_ip, user, flatten_requests, distinct_paths, queries

Tune the flatten_requests > 10 threshold to the environment; the objective is to surface accounts issuing abnormally high volumes of flatten-mode event retrievals relative to their baseline.

Wazuh OSSEC Rule

<group name="misp,web,cve-2026-103659,">
  <rule id="103659" level="6">
    <decoded_as>json</decoded_as>
    <field name="uri">\/events\/view</field>
    <field name="query">flatten</field>
    <description>CVE-2026-103659: MISP event retrieved with flatten option (potential object-level ACL bypass)</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>cve_2026_103659,</group>
  </rule>

  <rule id="103660" level="10" frequency="10" timeframe="300">
    <if_matched_sid>103659</if_matched_sid>
    <same_field>srcip</same_field>
    <description>CVE-2026-103659: high volume of MISP flatten-mode retrievals from same source (possible systematic harvesting)</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version range is available in the provided intelligence. The steps below are general hardening measures appropriate to an authorization bypass in a threat-sharing platform; they are not a substitute for a vendor fix and none of them should be treated as confirming that a fix exists.

1. Immediate mitigations (while unpatched):

• Treat flatten-mode event retrieval as a sensitive operation. Where the platform layer permits, restrict or disable the flatten presentation mode for accounts that do not require it, prioritizing restrictions on accounts that can view community-distributed events containing object-restricted data.
• Reduce exposure of the vulnerable path by limiting the number of accounts with broad community-event visibility. Apply least privilege: only analysts with a genuine need should hold accounts capable of viewing events that aggregate many contributing organisations.

2. Patch/upgrade steps:

• Monitor the vendor's advisories and release notes for a MISP release that addresses this CVE, and track the CVE record at NVD for an updated CNA/NVD description, fixed version, and any published CVSS vector. No fixed version can be named at this time because none has been provided.
• When a fix is released, validate that the final remediation isolates the distribution access-control condition as the sole gate for flattened attributes. The description states that an initial remediation attempt reused the full Object containment conditions — including soft-delete state — as the flatten gate, which caused event owners requesting deleted attributes to lose attributes whose parent object remained live. Confirm that the deployed fix does not carry that regression.

3. Long-term hardening:

• Audit object-level distribution and sharing-group configuration wherever sensitive intelligence is stored. The vulnerability's impact is directly proportional to how much data is compartmentalised at the object level rather than at the event level; excessive reliance on object-level restrictions for compartmentalisation increases the value of a bypass like this.
• Enforce logging and review of flatten-mode retrievals, and baseline each analyst account's normal retrieval patterns so that systematic harvesting across many events stands out.
• Apply structured access-control review to any query transformation that removes a containment relationship (flattening, denormalisation, export reshaping), ensuring that per-container authorization conditions are explicitly re-evaluated at the flattened level rather than silently discarded.

References

• NVD — CVE-2026-103659: https://nvd.nist.gov/vuln/detail/CVE-2026-103659
• CWE-285 — Improper Authorization: https://cwe.mitre.org/data/definitions/285.html
• MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (this CVE is not listed in KEV)
• EPSS by FIRST.org: https://www.first.org/epss (this CVE is not yet scored by FIRST.org)

No threat actor campaigns and no exploit-in-the-wild evidence are associated with this CVE in the provided intelligence. No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-103659.