CVE-2026-104908

Executive Summary

CVE-2026-104908 is an improper authorization / improper input validation flaw (CWE-285) in the MISP decaying model import functionality. An authenticated user holding the decaying-model permission (perm_decaying) can supply a nested model key that carries its own primary key, organisation identifier, and default flag, bypassing the application's guards so that the save operation targets a model owned by another organisation or sets the organisation default. Successful exploitation permits in-place modification of another organisation's decaying model (name, formula, parameters, or ownership) and manipulation of organisation-wide default scoring behaviour; no public exploit code or Nuclei template is currently available, and the vulnerability is unpatched in tracked sources.

Technical Analysis

MISP (Malware Information Sharing Platform) is an open-source threat intelligence sharing platform. Decaying models define how attribute values lose relevance over time and are used to drive scoring. The import endpoint for decaying models is intended to create a new decaying model belonging exclusively to the importing user's organisation, with the default flag forced to off.

Per the NVD description, the defect is a mass-assignment / input-validation failure: the application stripped only the top-level id and uuid fields and pinned org_id and default at the outer array level before saving the data in a flattened form. Because the guard logic operated only on the top-level array keys and saved the record flat, a nested model key containing its own primary key, organisation identifier, and default flag was not sanitised. When the flattened data was persisted, the attacker-controlled nested values overrode the intended guards.

The mechanism is straightforward and does not require memory corruption or injection of executable code:

• The endpoint accepts a structured representation of a decaying model for import.
• Sanitisation removes only top-level id and uuid and forces org_id / default on the outer array.
• A nested model key preserving id, org_id, and default survives validation.
• The flat save operation writes the attacker-supplied primary key and organisation identifier, causing an update to an existing record (belonging to another organisation) rather than a scoped create.

This is an object-ownership / authorization bypass: the primary key in the payload selects the target row, and the organisation identifier reassigns ownership. Because the default flag is likewise attacker-controlled, the model can be flagged as the organisation default, altering scoring for other users.

Attack surface: the authenticated MISP web application / REST API. Preconditions are (1) an authenticated user with perm_decaying, and (2) network access to the MISP instance. Affected versions are those prior to 2.5.48. No public proof-of-concept is available and none exists in tracked sources; no Nuclei template exists.

Analysis note: The specific HTTP method, route path, parameter names, and code structure are not disclosed in the NVD description and are therefore not enumerated here. The vulnerability class — improper authorization via nested-key mass assignment bypassing top-level sanitisation — is sufficient to characterise the flaw without fabricating implementation details.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred strictly from the vulnerability class (improper authorization / input validation on nested input) and the NVD description.

1. Reconnaissance / target identification The attacker identifies an internet-reachable MISP instance (e.g., via Shodan using an HTTP title/HTML fingerprint for MISP). They obtain valid credentials for an account with the decaying-model permission (perm_decaying), or escalate within an existing legitimate account to that permission. The attacker also identifies a target decaying model belonging to another organisation — for example, the organisation default model — whose identifier is discoverable through normal application data exposure or model references visible to authenticated users.

2. Triggering the flaw Using the decaying model import endpoint, the attacker submits an import payload whose outer structure carries the expected top-level keys (which the application strips/pins) while a nested model key preserves its own primary key (id), organisation identifier (org_id), and default flag. Because the application only sanitises top-level id/uuid and pins org_id/default on the outer array, the nested values are not neutralised and are written during the flat save.

3. Payload / execution method At the vulnerability-class level, the payload is a crafted import document. The nested key's primary key selects the existing target record, and its organisation identifier and default flag override the intended guards. The attacker can then alter the model's name, formula, parameters, or ownership in place. No executable code or injection string is required — the attack is a data-structure/authorization bypass, not memory corruption or command injection.

4. Post-exploitation impact The attacker overwrites an existing decaying model belonging to another organisation, modifies or creates a model flagged as the organisation default, and/or reassigns a model's organisation to an arbitrary value. Manipulation of the organisation default changes scoring behaviour for all users who rely on that model, enabling silent integrity attacks on threat-intelligence scoring (e.g., causing indicators to decay faster or slower than intended, suppressing or inflating alerting driven by decay scores).

Impact Assessment

CWE-285 (Improper Authorization) with an integrity-focused impact. Using the supplied CVSS vector implied by the description: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. Rationale:

• AV:N — the flaw is reachable over the network via the MISP import functionality.
• AC:L — no special conditions; a crafted import payload suffices.
• PR:L — requires an authenticated user with perm_decaying (low privilege is sufficient).
• UI:N — no user interaction beyond the attacker's own request.
• S:U — impact remains within the MISP application scope.
• C:N — the described impact is modification, not data disclosure.
• I:H — the attacker can modify another organisation's model and the organisation default, a high-integrity impact.
• A:N — no availability impact described.

Business impact: cross-organisation integrity of threat-intelligence scoring is compromised. Because MISP is a sharing platform, modifications to decaying models affect how indicators are prioritised across an organisation and, where models are shared or referenced, can propagate incorrect scoring decisions. Blast radius is scoped to deployments with authenticated users holding perm_decaying and network exposure of the MISP import endpoint. No CVSS score is provided (N/A); EPSS is not yet scored by FIRST.org; not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: MISP Decaying Model Import with Nested Override Keys
id: 4f1c9b2e-1a77-4e5c-9b3a-misp-decay-imp
status: experimental
description: Detects MISP decaying model import requests containing nested model keys bearing id/org_id/default that bypass top-level sanitisation (CVE-2026-104908).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104908
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026-104908
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_path:
    cs-uri-stem|contains: 'decaying'   # adjust to observed MISP import route
  selection_body:
    cs-uri-query|contains:
      - '"id":'
      - '"uuid":'
      - '"org_id":'
      - '"default":'
  condition: selection_method and selection_path and selection_body
falsepositives:
  - Legitimate administrator imports that include model metadata
level: high

YARA Rule

rule CVE_2026_104908_MISP_Decaying_Import
{
    meta:
        author = "valtersit.com"
        description = "Detects MISP decaying model import payloads carrying nested id/org_id/default override keys (CVE-2026-104908)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104908"
        date = "2026-01-01"
    strings:
        $a = "\"decaying\"" nocase
        $b = "\"org_id\"" nocase
        $c = "\"default\"" nocase
        $d = "\"uuid\"" nocase
        $e = "\"formula\"" nocase
        $f = "\"parameters\"" nocase
    condition:
        (uint32(0) == 0x7b) and 3 of ($a,$b,$c,$d,$e,$f)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-104908 MISP decaying model import with nested org_id/default override"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"decaying"; nocase; http.request_body; content:"org_id"; nocase; content:"default"; nocase; within:200; reference:cve,2026-104908; classtype:attempted-user; sid:2026104908; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where http.request.method == "POST" and
      http.request.body.text : ("decaying" and "org_id" and "default") and
      http.request.body.text : "\"id\"" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access
| eval body = coalesce(http_request_body, request_body, "")
| where method="POST" AND match(uri, "(?i)decaying") AND match(body, "(?i)\"?org_id\"?") AND match(body, "(?i)\"?default\"?")
| stats count values(uri) AS uris by src_ip, user_agent
| where count > 0

Wazuh OSSEC Rule

<group name="misp,web,cve-2026-104908">
  <rule id="100908" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.method">POST</field>
    <field name="http.url" type="pcre2">(?i)decaying</field>
    <field name="http.body" type="pcre2">(?i)(org_id|default).*\\"id\\"|\\"id\\".*(org_id|default)</field>
    <description>CVE-2026-104908: Possible MISP decaying model import with nested id/org_id/default override</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Vendor fix: N/A. Workarounds: N/A. Affected versions reported as < 2.5.48.

1. Immediate mitigations

• Restrict the decaying model import functionality to a minimal set of trusted users; audit all accounts holding perm_decaying and remove it where not strictly required.
• Limit network exposure of the MISP instance: place it behind authentication and network controls; if not required publicly, do not expose it to the internet.
• Enable detailed request-body logging for the import endpoint and monitor for nested id/org_id/default keys using the detection rules above.
• Monitor decaying models for unexpected changes to name, formula, parameters, ownership, or default status; snapshot/compare model definitions over time.

2. Patch/upgrade steps

• No vendor patch is currently identified in tracked sources. Users must monitor the MISP project's release/advisory channels for a fixed version (versions at or above 2.5.48 are reported as a threshold) and upgrade as soon as a fix is published.
• Until a fix exists, apply compensating controls from (1). Treat this CVE as unpatched.

3. Long-term hardening

• Enforce server-side allow-listing of writable fields on import rather than stripping a fixed subset of top-level keys; recursively validate nested structures and reject any nested key carrying a primary key, organisation identifier, or default flag.
• Enforce ownership checks at the persistence layer so that saves cannot target records outside the caller's organisation, independent of request-shape sanitisation.
• Adopt least-privilege for permission grants such as perm_decaying, and perform periodic reviews.
• Maintain egress-limited, internet-restricted deployment of MISP instances and continuous monitoring for mass-assignment and authorization-bypass patterns.

References

• NVD — CVE-2026-104908: https://nvd.nist.gov/vuln/detail/CVE-2026-104908
• MISP Project (vendor) — main site and release/advisory channels: https://www.misp-project.org/
• MISP GitHub repository (monitor releases patching the decaying model import): https://github.com/MISP/MISP
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CWE-285 — Improper Authorization: https://cwe.mitre.org/data/definitions/285.html

Exploit-in-the-wild: No public exploit code, PoC, or Nuclei template is available in tracked sources; CVE-2026-104908 is not listed in CISA KEV. EPSS has not yet been scored by FIRST.org. No known threat-actor campaign is associated with this CVE at the time of writing.