CVE-2026-104914

Executive Summary

CVE-2026-104914 is an improper access control vulnerability (CWE-284) in MISP (Malware Information Sharing Platform) affecting versions prior to v2.5.48. The attribute search and paginated attribute view code paths fail to apply the same organization-scoping restrictions that the event detail view enforces, causing soft-deleted attributes belonging to other organizations to be disclosed to any authenticated user with read access to the parent event. The impact is a confidentiality-only breach of threat intelligence the owning organization intended to remove from general visibility.

Technical Analysis

MISP is a threat intelligence sharing platform in which events and their associated attributes (indicators, IOCs, contextual data) are owned by organizations and shared according to distribution and synchronization permissions. Attributes can be "soft-deleted" — logically removed from general visibility without physical deletion of the record.

Per the NVD description, the platform implements two distinct code paths for reading attributes:

1. The event detail view — correctly restricted soft-deleted attribute visibility to the owning organization and to users holding sync permissions.
2. The attribute search endpoint and the paginated attribute view endpoint — lacked that same restriction.

The vulnerability is a classic inconsistency of enforcement across access paths (CWE-284, Improper Access Control). Because the authorization logic is implemented per-view rather than centralized in a single query filter or policy layer, the attribute search and paginated listing paths returned soft-deleted attributes belonging to events owned by other organizations. The exposure condition is not that the attacker gains new event access; rather, the user already has "visibility of the event" (at least read access to an event owned by another organization), and the vulnerable endpoints over-disclose attributes attached to that event that were soft-deleted by the owning organization.

The specific precondition is the use of the deleted-attributes search or the paginated attribute listing with the deleted filter. Only requests that explicitly query for deleted attributes trigger the over-disclosure; normal (non-deleted) attribute retrieval paths are not described as affected.

Note on technical specificity: the NVD text does not name internal function names, class names, controller actions, route paths, or parameter names beyond the concepts "attribute search" and "paginated attribute view" with a "deleted filter" / "deleted-attributes search." This report therefore describes the flaw at the vulnerability-class level and does not fabricate implementation identifiers. No public PoC, exploit code, or Nuclei template exists for this CVE.

The root cause pattern is authorization divergence: a security decision (scope soft-deleted records to the owning org and sync-permission holders) enforced in one presentation path but omitted from query-building logic used by two other paths. This class of defect is common in large PHP applications where listing/filtering logic is duplicated across controllers.

Exploitation Scenarios

Preconditions (from NVD): the actor must be an authenticated MISP user with at least read access to an event owned by another organization, and must issue a query for deleted attributes via either the deleted-attributes search or the paginated attribute view with the deleted filter. No special privileges beyond standard authenticated read access are required; no user interaction on the victim side is required.

1) Reconnaissance / target identification. The actor obtains valid credentials to the MISP instance (legitimate account, low-privilege sharing partner, or a compromised account). The actor enumerates events they can already see, including events owned by other organizations, identifying events of intelligence value. No external scanning is required — the actor operates entirely within authenticated application interfaces. Externally, internet-exposed MISP instances could be located before credential acquisition, but the flaw itself is only reachable post-authentication.

2) Triggering the flaw class. The actor navigates to the attribute search functionality or the paginated attribute listing and supplies the filter that requests deleted attributes (the "deleted filter" / deleted-attributes search). Because the authorization check that the event detail view enforces is absent from these query paths, the resulting response includes soft-deleted attributes that belong to events owned by other organizations.

3) Execution method (vulnerability-class level). This is a broken-access-control / IDOR-style over-disclosure, not a code-execution or injection flaw. The "payload" is a well-formed authenticated query selecting the soft-deleted attribute set. No memory corruption, deserialization, or command injection is involved. Because no public PoC exists, the precise request syntax cannot be stated here; the attack is inferred from the vulnerability class and the description of the affected queries.

4) Post-exploitation impact. The actor harvests the returned soft-deleted attributes — IOCs, indicators, and contextual intelligence — that the owning organization believed it had removed from general visibility. This may reveal indicators the owner deliberately unpublished (e.g., false-positive-prone, sensitive, or operationally restricted data), enabling intelligence advantages, correlation against the owner's internal data, or de-anonymization of the owner's sources. No integrity or availability impact is described; the effect is pure confidentiality loss. The over-disclosure is repeatable and scriptable, allowing bulk collection across all events the actor can see.

Impact Assessment

• Confidentiality: High. Soft-deleted threat intelligence attributes from other organizations are disclosed to unauthorized users. The CVSS vector implied by the NVD impact statement is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (base 6.5, Medium), consistent with a network-reachable, low-complexity, authenticated-only attack with high confidentiality impact and no integrity or availability impact. Note: NVD provides no official CVSS score or vector for this CVE; the above is derived strictly from the described impact and must be treated as provisional. Do not treat it as an assigned NVD score.
• Affected systems: MISP instances running versions prior to v2.5.48, particularly multi-organization or federated deployments where events are shared across organizations with differing ownership.
• Blast radius: Scoped by the "visibility of the event" precondition. The attacker can only over-read deleted attributes on events they can already see, but within those events the exposure is complete for the soft-deleted attribute set. In sharing communities (CSIRTs, ISACs), this can leak sensitive indicators across partner boundaries.
• Business impact: Loss of trust in a sharing platform whose value depends on controlled disclosure; potential contractual or regulatory exposure if shared intelligence contained restricted data; erosion of the "delete" assurance for contributing organizations. No CISA KEV listing, no known in-the-wild exploitation evidence, and no EPSS score (not yet scored by FIRST.org) — current real-world exploitation likelihood is unquantified.

Detection Guidance

Detection should focus on authenticated requests that query deleted attributes and on responses returning large volumes of soft-deleted attribute records. Because no PoC or exploit signature exists, the rules below target the behavioral pattern described in the NVD text and should be tuned to the local MISP deployment.

Sigma Rule

title: MISP Soft-Deleted Attribute Disclosure Attempt (CVE-2026-104914)
id: 8f2c1a44-misp-softdel-104914
status: experimental
description: Detects authenticated MISP requests that query soft-deleted attributes via attribute search or paginated attribute view, the abuse pattern for CVE-2026-104914.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104914
author: valtersit.com
logsource:
  category: webserver
  product: misp
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/attributes'
      - '/attributes/index'
      - '/attributes/search'
  selection_deleted_filter:
    cs-uri-query|contains:
      - 'deleted'
      - 'deleted=1'
      - 'deleted=both'
  condition: selection_path and selection_deleted_filter
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate administrators auditing soft-deleted attributes within their own organization
level: medium

YARA Rule

rule CVE_2026_104914_MISP_SoftDeleted_Attribute_Disclosure
{
    meta:
        description = "Detects MISP web/application logs referencing soft-deleted attribute search or paginated attribute view queries consistent with CVE-2026-104914"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104914"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $a1 = "attributes" nocase
        $a2 = "deleted" nocase
        $b1 = "deleted-attributes" nocase
        $b2 = "soft-deleted" nocase

    condition:
        (uint16(0) == 0x3C3F or uint32(0) == 0x3C21444F) and
        $a1 and $a2 and 1 of ($b*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-104914 MISP soft-deleted attribute disclosure attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/attributes"; http.uri; content:"deleted"; http.uri; pcre:"/\/attributes[^\s]*deleted/i"; classtype:attempted-recon; sid:2026104914; rev:1; metadata:cve CVE-2026-104914, vendor MISP;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ network where url.path : ("/attributes", "/attributes/index", "/attributes/search") ]
  [ network where url.path :("/attributes", "/attributes/index", "/attributes/search") and
      url.query :("deleted", "deleted=1", "deleted=both") ]

Splunk SPL Query

index=web sourcetype=misp:access OR sourcetype=access_combined
| search uri_path IN ("/attributes","/attributes/index","/attributes/search") AND (uri_query="*deleted*")
| stats count values(uri_query) AS queries dc(uri_path) AS paths by src_ip, user
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="misp,web,access_control,">
  <rule id="104914" level="10">
    <parent>104900</parent>
    <match>attributes</match>
    <regex>deleted</regex>
    <description>CVE-2026-104914: MISP request for soft-deleted attributes via search or paginated view - possible improper access control abuse.</description>
    <group>access_control,pci_dss_10.2.4,gdpr_IV_35.7.d,</group>
  </rule>
</group>

Deployment note: parent rule 104900 and the web-log decoder must be defined in the local ruleset/decoder; adjust rule IDs to the local allocation. These detections cannot distinguish legitimate administrator auditing of deleted attributes from malicious enumeration, so correlate with the requesting user's organization membership relative to event ownership.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations.

• Restrict access to MISP instances: do not expose the instance to untrusted networks; require VPN or IP allowlisting so external actors cannot reach the authenticated endpoints described.
• Reduce the number of accounts with broad read visibility over other organizations' events; enforce least privilege in sharing-group and organization configuration.
• Monitor/log all queries selecting deleted attributes and alert (see Detection Guidance) on users retrieving soft-deleted records for events they do not own.
• If operationally feasible, temporarily restrict or disable cross-organization sharing until an upgrade is applied, prioritizing deployments with sensitive or tightly controlled intelligence.
• Review whether the "deleted" filter can be disabled/blocked at a reverse-proxy or WAF layer for non-privileged users while the fix is unavailable; validate that this does not break legitimate workflows.

2) Patch/upgrade steps.

• Upgrade MISP to v2.5.48 or later, the version in which the NVD description states the flaw is fixed. Back up the database and instance configuration before upgrading, and validate the fix by confirming that attribute search and paginated listing no longer return soft-deleted attributes from other organizations to non-owner, non-sync-permission users.
• Since no vendor advisory, commit hash, or bulletin is available from tracked sources, obtain the fix through the official MISP release channel and verify release integrity before deployment.

3) Long-term hardening.

• Centralize authorization for soft-deleted record visibility in a single query/policy layer so that all read paths (detail view, search, paginated listing, API) apply identical org- and sync-permission scoping. This prevents the enforcement-divergence defect class that caused this CVE.
• Add regression tests and code review checkpoints that assert every attribute-returning endpoint enforces ownership and sync-permission scoping for soft-deleted records.
• Adopt audit logging of deleted-attribute access with periodic anomaly review.
• Track MISP security releases and maintain a documented upgrade cadence; monitor NVD/CVE feeds for this and related MISP access-control issues.

References

• NVD — CVE-2026-104914: https://nvd.nist.gov/vuln/detail/CVE-2026-104914 (primary source; contains the vendor-description text summarized above)
• MISP project official site / releases (obtain and verify the v2.5.48 release): https://www.misp-project.org/
• MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
• CWE-284 — Improper Access Control: https://cwe.mitre.org/data/definitions/284.html
• CISA KEV catalog (for confirmation / status tracking): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild status: No known threat actor campaigns and no exploit-in-the-wild evidence are attributable to CVE-2026-104914 from the provided data. CISA KEV status: NOT listed. EPSS: not yet scored by FIRST.org. No public PoC, exploit code, or Nuclei template is available; the attack chain described is inferred from the vulnerability class and the NVD description.