CVE-2026-104910

Executive Summary

CVE-2026-104910 is an authorization bypass (CWE-285) in MISP, the open-source threat intelligence sharing platform, affecting the related events listing functionality. An authenticated user with access to at least one event can retrieve metadata — event titles, dates, and correlating value counts — for related events they are not permitted to view, because the system read correlation data directly from the correlation table without re-validating access rights against each related event. Impact is limited to unauthorized information disclosure and reconnaissance across sharing groups; no code execution, data modification, or denial of service is described.

Technical Analysis

The vulnerability resides in the code path that returns the list of events correlated to a given event. According to the NVD description, when a user requests this list, MISP retrieved related event metadata directly from the correlation table rather than re-evaluating the caller's access rights on each referenced event.

Two design characteristics of the correlation table drive the bypass:

1. Snapshot semantics. The correlation table stores a snapshot of an event's distribution level and sharing group at the time the correlation was created. It does not store the published flag.
2. No re-authorization. Because the listing logic trusted the snapshot instead of the live event record, authorization decisions were effectively frozen at correlation time rather than evaluated at request time.

The consequence is a classic time-of-check/time-of-use (TOCTOU) authorization gap: an event that was legitimately correlatable — and therefore correctly represented in the caller's correlation set — may subsequently become unpublished, or have its distribution or sharing group changed, yet it still appears in the related-events response with its metadata. The published flag absence is particularly relevant: unpublished events are normally withheld from users, but the correlation table carries no field to enforce that check, so unpublished events leak through the listing.

The exposure is metadata-only. The description explicitly enumerates the leaked fields: title, date, and correlating value counts. There is no indication that full event attribute content, raw intelligence, or credentials are returned. The bypass is reachable by any authenticated user who can open at least one event, provided correlation entries link that event to events the user should not see. No special privilege, network position, or user interaction beyond normal authenticated use is required. No public PoC, exploit code, or Nuclei template was identified, and no CISA KEV listing exists; the attack chain below is inferred from the vulnerability class (authorization bypass via missing object-level access control) and the described mechanism.

Exploitation Scenarios

No public PoC is available; the following chain is derived strictly from the described mechanism and vulnerability class.

1. Reconnaissance / target identification. An attacker obtains any authenticated MISP account with access to at least one event. This is a low bar in multi-tenant environments where analysts, partner organizations, or community members are granted accounts scoped to a sharing group. The attacker identifies an event they can legitimately open and which is likely to have many correlations (broadly consumed or frequently referenced intelligence tends to correlate widely).

2. Triggering the flaw. The attacker requests the related events listing for that event — the "related events" functionality. The server resolves the caller's correlation entries for that event and returns the associated metadata. Because the code path reads the correlation table directly and does not re-validate the caller's rights against each referenced event, the authorization check is never applied per-object.

3. Payload / execution method. At the vulnerability-class level, no payload is required. The "exploit" is a single, legitimate-looking authorized request; the flaw is the absence of an access-control evaluation on the returned objects (broken object-level / function-level authorization). The attacker iterates this request across every event they can access, harvesting the union of correlated metadata.

4. Post-exploitation impact. The attacker accumulates titles, dates, and correlation counts for events they were never authorized to view. This permits inference of threat-intelligence subject matter, activity timelines, and the structure (and possibly naming conventions) of sharing groups outside their entitlement. Repeated across a threat-intel platform, the aggregation of leaked titles is itself sensitive — it maps an organization's or community's intelligence coverage without any single returned field constituting "full" data.

Note: the leak is one-directional (read-only metadata), and the attacker cannot pivot to event contents through this path because only the enumerated metadata fields are returned.

Impact Assessment

• Confidentiality (High): Unauthorized disclosure of event titles, dates, and correlation counts across distribution/sharing-group boundaries — including unpublished events. Titles and dates are often the most operationally sensitive single fields in CTI, revealing what is being tracked and when.
• Integrity (None): No write, modification, or corruption path is described.
• Availability (None): No DoS or resource-exhaustion vector is described.
• Privileges required (Low): Requires only an authenticated account with access to one event.
• User interaction (None) / Attack complexity (Low) / Scope (Unchanged): The flaw is deterministic and triggers on ordinary authorized requests.

Business impact centers on intelligence boundary erosion: organizations relying on MISP sharing groups and distribution controls to compartmentalize sensitive reporting may leak the existence, naming, and timelines of that reporting to lower-trust community members, partner analysts, or compromised low-privilege accounts. Blast radius scales with the number of correlation entries reachable from any single accessible event — potentially the majority of a community's event corpus in densely correlated instances. There is no direct financial or RCE impact, but the reconnaissance value to a targeted adversary (mapping a victim's intelligence program) is material.

Detection Guidance

Sigma Rule

title: MISP Related Events Metadata Access - Potential Authorization Bypass (CVE-2026-104910)
id: 8f2c1a44-5b7e-4d3a-9c1e-6a0d2f7b1e93
status: experimental
description: Detects repeated access to the MISP related events listing endpoint from a single authenticated user, consistent with enumeration of event metadata the caller may not be authorized to view.
references:
  - CVE-2026-104910
author: Valters IT Threat Intelligence
logsource:
  category: webserver
  product: misp
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/events/viewGraph'
      - '/events/relatedEvents'
      - '/events/getRelatedEvents'
  selection_method:
    cs-method: 'GET'
  timeframe: 5m
  condition: selection_path and selection_method | count() by c-ip > 30
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Automated correlation dashboards or legitimate high-volume analyst browsing
  - SIEM/BI integrations that poll related events at scale
level: medium
tags:
  - attack.t1213
  - cve.2026-104910

YARA Rule

rule CVE_2026_104910_MISP_RelatedEvents_AuthzBypass
{
    meta:
        description = "Detects MISP related events listing logic that reads correlation table metadata without per-event access re-validation (CVE-2026-104910)"
        author = "Valters IT Threat Intelligence"
        reference = "CVE-2026-104910"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $related = "relatedEvents" ascii nocase
        $correlate = "correlation" ascii nocase
        $dist = "distribution" ascii nocase
        $shgroup = "sharing_group" ascii nocase
        $published = "published" ascii nocase

    condition:
        filesize < 2MB and
        ( $related and $correlate ) and
        not ( $published ) and
        ( $dist or $shgroup )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-104910 MISP Related Events Metadata Enumeration Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/events/"; pcre:"/\/events\/(relatedEvents|viewGraph|getRelatedEvents)/Ui"; threshold:type both, track by_src, count 30, seconds 300; classtype:attempted-recon; reference:cve,2026-104910; sid:2026104910; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [http where http.request.method == "GET" and
    wildcard(http.request.uri.path, "/events/*") and
    (wildcard(http.request.uri.path, "*relatedEvents*") or
     wildcard(http.request.uri.path, "*viewGraph*") or
     wildcard(http.request.uri.path, "*getRelatedEvents*"))] with runs=25

Splunk SPL Query

index=web sourcetype=misp_access
| search uri_path="/events/*" (uri_path="*relatedEvents*" OR uri_path="*viewGraph*" OR uri_path="*getRelatedEvents*")
| stats count AS req_count, dc(uri_path) AS distinct_paths, values(user) AS users, earliest(_time) AS first_seen, latest(_time) AS last_seen by src_ip
| where req_count > 30
| eval duration_min = round((last_seen - first_seen)/60, 1)
| table src_ip, users, req_count, distinct_paths, first_seen, last_seen, duration_min
| sort - req_count

Wazuh OSSEC Rule

<group name="misp,web,cve_2026_104910,">
  <rule id="2026104910" level="8">
    <if_sid>31100</if_sid>
    <url>/events/</url>
    <description>CVE-2026-104910: MISP related-events listing access from $(srcip) - possible authorization bypass / metadata enumeration.</description>
    <options>no_full_log</options>
    <group>access_control,recon,</group>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
  <rule id="2026104911" level="10" frequency="30" timeframe="300">
    <if_matched_sid>2026104910</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-104910: High-volume MISP related-events enumeration from $(srcip) - likely exploitation of authorization bypass.</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description references fix commit 2ffa97f05 as the upstream remediation, but no vendor advisory, release, OSV entry, or tracked patch source is available. Treat as unpatched until verified against upstream.

1. Immediate mitigations.

   • Restrict the related-events listing functionality to trusted roles only until the fix commit is deployed; if the platform supports role-level ACLs, disable the correlation listing view for low-trust/partner accounts.
   • Reduce the reachable correlation surface: audit which accounts can open events with high correlation counts, and tighten account provisioning so external/partner users see only narrowly scoped events.
   • Monitor access logs for repeated hits on the related-events endpoint (see Detection Guidance) and alert on high-volume enumeration by a single principal.
   • Where feasible, avoid creating correlations between events of differing distribution/sharing-group classifications, limiting what the frozen snapshot can expose.

2. Patch / upgrade steps.

   • Apply the upstream fix corresponding to commit 2ffa97f05. Because patch confidence is 0/4, independently verify the commit fixes the described behavior (per-event authorization re-validation on the related-events path) before relying on it.
   • Track the official MISP repository and release notes for a tagged version incorporating 2ffa97f05; upgrade to that version or later.
   • After upgrade, regression-test that unpublished events and events whose distribution/sharing group changed since correlation are correctly withheld from the related-events listing.

3. Long-term hardening.

   • Enforce object-level (per-object) authorization on every data path that returns event-derived data — never trust denormalized/snapshot tables for access decisions.
   • Store or re-derive access-relevant state (distribution, sharing group, published flag) at read time rather than at correlation time; if snapshots are retained for performance, cross-check against the live event before emitting metadata.
   • Adopt a deny-by-default response builder that filters returned metadata through the caller's current entitlements.
   • Periodically audit sharing-group boundaries and correlation density to detect cases where cross-boundary correlation could leak metadata.

References

• NVD — CVE-2026-104910: https://nvd.nist.gov/vuln/detail/CVE-2026-104910
• MISP project repository (verify fix commit 2ffa97f05): https://github.com/MISP/MISP
• CWE-285 — Improper Authorization: https://cwe.mitre.org/data/definitions/285.html
• MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
• CISA Known Exploited Vulnerabilities Catalog (not listed; monitor): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit-in-the-wild evidence, threat-actor campaign, or CISA KEV association was identified for this CVE at the time of writing.