CVE-2026-104912

Executive Summary

CVE-2026-104912 is an authorization flaw in MISP (Malware Information Sharing Platform) affecting all versions prior to v2.5.48. When an authenticated user performs an attribute search that triggers correlation lookups, the system authorizes access to correlated attributes and events using a stale distribution snapshot stored on the correlation row rather than the live event ACL. As a result, an authenticated low-privilege user can retrieve attribute values and event metadata from events they are no longer permitted to view, resulting in a confidentiality breach of threat intelligence data.

Technical Analysis

MISP is an open-source threat intelligence sharing platform in which "events" contain "attributes" (indicators such as IPs, domains, hashes). MISP automatically builds correlations between attributes that share common values, storing these relationships in correlation rows. Each correlation row caches distribution metadata — a point-in-time copy of the distribution state of the events involved at the moment the correlation was created.

The vulnerability is rooted in how MISP authorizes access during correlation lookups triggered by an attribute search. When a user performs a search that causes the platform to resolve correlated attributes and events, the authorization decision is evaluated against the cached distribution columns on the correlation row rather than the live event access control list (ACL). The cached snapshot omits a published flag and does not reflect subsequent changes to an event's distribution state.

This design creates a time-of-check/time-of-use (TOCTOU) class weakness embedded in the authorization logic. When an event's access restrictions change after the correlation row was written — for example, the event is moved into a different sharing group or is unpublished — the correlation row's cached distribution columns remain stale. The authorization check therefore returns an incorrect "permitted" result, and the user is served attribute values and event details they no longer have the right to see.

The flaw maps to CWE-284 (Improper Access Control). It is a server-side logic defect, not a memory-safety or injection issue, and it is exploitable through normal authenticated application functionality — no special tooling, malformed input, or elevated privilege is required. Key preconditions are: (1) the attacker holds a valid account with read access to at least some events, and (2) correlations exist between events where at least one event has been restricted after the correlation was created. The absence of a published flag in the cached distribution snapshot is specifically called out as the factor that makes the authorization check incorrect during unpublishing transitions.

Affected product versions are MISP prior to v2.5.48. No CVE record supplied here assigns a CVSS score, so severity must be assessed analytically (see Impact Assessment).

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker identifies a MISP instance and obtains an authenticated account with at least read access to some events. This is a low bar — any analyst, partner organization, or sharing-community member typically qualifies. The attacker does not need administrative rights.

2. Triggering the flaw. The attacker issues an attribute search through the normal MISP search functionality. The search is crafted to match an attribute value that is likely to be correlated with attributes in other events. Because correlation lookups are performed as part of resolving search results, this search causes the platform to traverse the correlation rows linking the attacker's accessible events to other events.

3. Authorization bypass at the vulnerable check. During the lookup, MISP authorizes the correlated attributes and events using the stale distribution snapshot cached on the correlation row instead of the live event ACL. If a correlated event has subsequently been restricted (its sharing group changed, or it was unpublished) after the correlation row was created, the cached snapshot still reflects the older, more permissive distribution state. The check passes incorrectly and results in the correlated attribute values and event metadata being returned to the attacker.

4. Data collection. The attacker harvests the leaked attribute values and event details — indicators, and event-level metadata — that belong to restricted events. There is no write, modification, or deletion primitive described; the impact is strictly disclosure of confidentiality-sensitive threat intelligence.

5. Post-exploitation impact. The attacker can enumerate restricted events indirectly by iterating searches over known or guessed indicator values, gradually mapping out intelligence they are not authorized to see. Because the mechanism leverages legitimate search behavior, activity may resemble ordinary analyst usage and blend into normal platform traffic.

No evidence of weaponization, public exploit, or in-the-wild exploitation is available in the supplied data.

Impact Assessment

The vulnerability is a confidentiality-only authorization bypass. The NVD description confirms the impact as exposure of attribute values and event metadata to users who are not authorized to access them. There is no described integrity or availability impact — no data tampering or denial of service.

Applying a standard CVSS 3.1 assessment consistent with the described mechanism (network-reachable, low privilege required, no user interaction, scope unchanged, high confidentiality impact), a representative vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. Note: no CVSS score is provided in the source data and this vector is an analytical estimate, not an authoritative vendor or NVD score.

Blast radius: Any MISP deployment prior to v2.5.48 that hosts correlations between events with mixed or changing sharing restrictions. In threat-sharing communities this is the norm, not the exception — correlations frequently span events owned by different organizations with different sharing groups. The affected data is often the most sensitive: indicators shared under restricted distribution or temporarily unpublished during vetting.

Business impact: For a threat intelligence sharing hub, an authorization bypass that leaks restricted indicators undermines the trust model that the entire platform exists to enforce. Leaked indicators could expose victim organizations, reveal ongoing investigations, disclose attribution, or expose intelligence shared under confidentiality agreements. Regulatory and contractual consequences may follow where MISP is used to exchange sensitive or personal data. Because the attacker only needs a routine authenticated account, the effective attacker population is every user of the instance.

Detection Guidance

Sigma Rule

title: MISP Correlation Authorization Bypass - Restricted Event Attribute Access
id: 7f3c9a21-4e8b-4d6a-9c1f-2b5e8d0a3f47
status: experimental
description: Detects anomalous sequence of MISP attribute searches correlated with access to restricted events
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104912
author: valtersit.com
date: 2026-01-01
logsource:
  product: misp
  service: audit
detection:
  selection_search:
    action:
      - 'search'
      - 'attribute_search'
    model|contains: 'Attribute'
  selection_correl:
    model|contains:
      - 'Correlation'
  timeframe: 5m
  condition: selection_search | near selection_correl
  fields:
    - user_id
    - user_email
    - org_id
    - action
    - model
falsepositives:
  - Legitimate cross-org analysts working with broadly shared events
  - Bulk correlation refresh jobs run by administrators
level: medium
tags:
  - attack.t1213
  - cve.2026.104912

YARA Rule

rule CVE_2026_104912_MISP_Correlation_Authz
{
    meta:
        description = "Detects references to correlation distribution snapshot / stale ACL authorization in MISP source or patches"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104912"
        date = "2026-01-01"
        cve = "CVE-2026-104912"

    strings:
        $s1 = "Correlation" ascii nocase
        $s2 = "distribution" ascii nocase
        $s3 = "sharing_group_id" ascii nocase
        $s4 = "unpublished" ascii nocase

    condition:
        uint32be(0) == 0x3C3F7068 or   // "<?ph"
        filesize < 5MB and
        all of ($s1, $s3) and
        any of ($s2, $s4)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104912 MISP Correlation Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/events/restSearch"; http.request_body; content:"correlation"; nocase; threshold:type both, track by_src, count 10, seconds 300; classtype:attempted-recon; reference:cve,2026-104912; sid:1049120; rev:1;)

Note: /events/restSearch reflects MISP's documented search API surface; adjust the URI content to match the exact search endpoint used by the target deployment. Endpoint strings not present in the NVD description should be validated against the deployed version before enabling this rule.

Elastic Detection

sequence by user.name with maxspan=10m
  [ any where event.category == "web" and url.path : "*restSearch*" and http.request.method == "POST" ]
  [ any where event.category == "web" and url.path : "*Correlation*" ]

Splunk SPL Query

index=misp sourcetype=misp:audit
| search (action="search" OR action="attribute_search" OR model="Correlation")
| stats count values(action) as actions values(model) as models by user_id, org_id
| where mvcount(models) > 1 AND count > 20
| sort -count

Wazuh OSSEC Rule

<group name="misp,cve-2026-104912,">
  <rule id="104912" level="8">
    <decoded_as>json</decoded_as>
    <field name="action">\.+</field>
    <description>CVE-2026-104912: Possible MISP correlation authorization bypass - repeated attribute searches resolving restricted correlations</description>
    <options>no_full_log</options>
  </rule>
  <rule id="104913" level="10" frequency="10" timeframe="300">
    <if_matched_sid>104912</if_matched_sid>
    <same_field>user_id</same_field>
    <description>CVE-2026-104912: High-volume correlation lookups by single MISP user - suspected restricted event enumeration</description>
  </rule>
</group>

Note: Detection rules above are behavioral heuristics. Because the flaw abuses legitimate search functionality, false positives from normal analyst activity are expected — tune thresholds and whitelist known correlation-refresh jobs.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (no patch available):

   • The NVD description references MISP prior to v2.5.48 as affected and implies v2.5.48 as the fixed version. Treat upgrading to v2.5.48 or later as the recommended remediation, but validate release availability directly with the MISP project before relying on it — no patch evidence exists in tracked sources here.
   • Reduce exposure by auditing correlations that link events with differing sharing restrictions. Where possible, restrict or remove correlations between events with inconsistent distribution states.
   • Tighten account provisioning: ensure users hold the minimum event read scope necessary, limiting the reachable correlation graph.
   • Review and re-apply sharing-group distribution on sensitive events so cached correlation snapshots align with intended access.
   • Monitor MISP audit logs for anomalous search and correlation-lookup patterns (see Detection Guidance).
   • Network-restrict MISP instances to trusted analyst ranges to reduce the effective attacker population.

2. Patch / upgrade steps:

   • No vendor-fixed version, commit, or advisory is confirmed in the supplied data. The only version reference is "MISP prior to v2.5.48." Verify against the official MISP release notes and repository for a fix addressing correlation authorization; do not treat v2.5.48 as confirmed until corroborated by a vendor source.
   • When a fix is available, back up the database, apply the upgrade, then re-verify correlation authorization behavior for events with changed distribution.

3. Long-term hardening:

   • Where the platform permits, ensure authorization decisions are always evaluated against the live event ACL rather than cached distribution snapshots — this is a structural lesson for correlation/dependency caching in access-controlled systems.
   • Implement continuous authorization testing (e.g., automated checks that a no-longer-permitted user cannot retrieve restricted events via search or correlation).
   • Adopt least-privilege event sharing and periodic distribution reviews.
   • Log and alert on all correlation-resolved access to sensitive events.

References

• NVD — CVE-2026-104912: https://nvd.nist.gov/vuln/detail/CVE-2026-104912
• MISP Project official release notes / repository: https://github.com/MISP/MISP
• CWE-284 — Improper Access Control: https://cwe.mitre.org/data/definitions/284.html
• MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. No CISA KEV listing, no known threat actor campaign, and no exploit-in-the-wild evidence are associated with CVE-2026-104912 in the supplied data.