CVE-2026-107175

Executive Summary

CVE-2026-107175 is a logic defect in the MISP threat intelligence platform's event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified. An authenticated user with write access to at least one event can trigger the flaw by editing the distribution or sharing_group_id field, causing stale correlations to persist after the change. The primary impact is unintended information disclosure: correlations computed under a broader sharing scope may remain visible after an event is moved to a more restrictive group, exposing threat data to parties who should no longer have access.

Technical Analysis

MISP (Malware Information Sharing Platform) maintains a correlation engine that links related attributes and events to support threat intelligence sharing. When an event is saved, MISP uses before-save and after-save hooks to determine whether the event's distribution or sharing group changed, and if so, whether correlations must be refreshed. CVE-2026-107175 (CWE-284, Improper Access Control) describes a defect in this workflow: during an edit operation, the internal before-save hook stores the incoming (new) data instead of the previously persisted values.

Because the before-save hook captures the new state rather than the old state, the after-save comparison that is meant to detect a change in distribution or sharing_group_id compares the new values against themselves. No difference is detected, so the correlation refresh routine is never triggered. The intended behavior is that a change in distribution scope (for example, moving an event from a broad sharing group to a more restrictive one) invalidates and recomputes correlations; with this defect, the stale correlation set persists unchanged.

The vulnerability class is a state-tracking / logic error in access-control-relevant metadata handling, mapped to CWE-284. It is not a memory-safety issue, injection flaw, or authentication bypass. The attack surface is the event edit/save pathway reachable by authenticated users with write permission to at least one event. Two distinct failure modes result:

1. Over-sharing (information disclosure): After an event is moved to a more restrictive sharing group or distribution level, correlations established under the prior, broader scope may still be exposed to users in the wider group, disclosing event data to parties who should have lost access.
2. Under-sharing (integrity/completeness degradation): After a distribution widening, newly relevant correlations are not generated, so downstream consumers receive an incomplete correlation picture, degrading the completeness of threat intelligence sharing.

Affected versions are those prior to 2.5.48. No public proof-of-concept, exploit code, or Nuclei template is available, and no EPSS score has been assigned by FIRST.org. CISA KEV listing is negative. No patch evidence is available from any tracked source (patch confidence 0/4).

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description. Only the fields and concepts named in the description (distribution, sharing_group_id, before-save/after-save hooks, correlation engine) are used.

1) Reconnaissance / target identification. An attacker or insider identifies a target MISP instance and confirms they hold an authenticated account with write access to at least one event. Because the flaw requires only write access to a single event, this precondition is low. The attacker locates an event whose distribution or sharing_group_id is set to a broad sharing scope (for example, a community or all-org sharing group) and that already carries established correlations.

2) Triggering the flaw. The attacker edits the event and changes its distribution level or sharing_group_id to a narrower scope. During the save, the before-save hook records the incoming (new) values rather than the previously persisted values. The after-save comparison therefore sees no difference and does not request a correlation refresh. The edit succeeds and the event's metadata now reflects the restrictive scope, but the correlation set remains as computed under the old, broader scope.

3) Access-control consequence (vulnerability-class level). Because correlations are not recalculated, the stale correlation links persist. Users who belonged to the broader sharing group — but who are no longer entitled to the event after the restriction — may still be able to observe correlations that reference the event. This is the information-disclosure path. In the inverse case, an attacker (or any user) widening distribution does not cause new correlations to be generated, so relevant links remain absent; this is an availability/completeness degradation rather than a disclosure.

4) Post-exploitation impact. The stale correlation state can persist indefinitely until a subsequent event save eventually triggers a refresh through some other change, or until an administrator manually rebuilds correlations. The attacker can deliberately move sensitive events into narrower groups while relying on stale correlations to leak linkage, or can repeatedly manipulate distribution to keep inference channels open. No payload delivery, code execution, or privilege escalation is involved in any step.

Impact Assessment

The CVSS score is N/A (not assigned in the supplied data). Applying the vector stated in METADATA (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) yields a subscore profile of: Network attack vector, Low attack complexity, Low privileges required, No user interaction, Unchanged scope, High confidentiality impact, No integrity impact, No availability impact. This aligns with the vulnerability being remotely reachable over the MISP web interface by an authenticated low-privilege user with event write access, requiring no victim interaction.

Confidentiality: The dominant impact. Stale correlations after a distribution restriction can expose event data to users in a sharing group that should no longer have visibility, an unintended information-disclosure condition in a platform whose entire purpose is controlled sharing of sensitive threat intelligence.

Integrity: The correlation data set is inconsistent with the event's current metadata; correlations are effectively stale/incorrect with respect to the declared sharing scope. This is scored as no integrity impact in the metadata vector but is a real logical inconsistency in the platform's derived data.

Availability: No availability impact. The MISP instance continues to operate; the degradation is in the completeness of correlation output after a distribution widening.

Blast radius. Any MISP deployment running versions prior to 2.5.48 that permits authenticated users with event write access. The impact is confined to the MISP instance and its configured sharing communities/peers; there is no lateral movement or host compromise. The severity of disclosure scales with the sensitivity of the events and the breadth of the original sharing group. Given that MISP hosts indicators and intelligence shared among trusted parties, inadvertent disclosure can be operationally and reputationally significant.

Detection Guidance

The detection content below targets anomalous MISP event-edit activity and correlation-refresh behavior. Because no PoC exists, rules are heuristic and focus on the edit-save pathway and distribution/sharing-group changes. Field and parameter names referenced (distribution, sharing_group_id) are those named in the NVD description.

Sigma Rule

title: MISP Event Distribution or Sharing Group Modification Without Correlation Refresh
id: 8f3a1c92-0d47-4b6a-9e21-7c5d9a0b1f33
status: experimental
description: Detects authenticated MISP users modifying an event's distribution or sharing_group_id, the trigger for CVE-2026-107175 stale-correlation condition.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107175
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1213
logsource:
  product: misp
  service: audit
detection:
  selection_action:
    action|contains:
      - 'edit'
      - 'save'
      - 'update'
  selection_object:
    model|contains: 'Event'
  selection_field:
    changed_field|contains:
      - 'distribution'
      - 'sharing_group_id'
  condition: selection_action and selection_object and selection_field
falsepositives:
  - Legitimate analysts adjusting event distribution during normal triage.
level: medium

YARA Rule

rule MISP_CVE_2026_107175_EventSave_Distribution
{
    meta:
        description = "Detects MISP event save payloads that modify distribution or sharing_group_id, associated with CVE-2026-107175 stale correlation logic defect"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107175"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $dist = "distribution" ascii nocase
        $sg   = "sharing_group_id" ascii nocase
        $evt  = "Event" ascii
        $a1   = "/events/edit" ascii
        $a2   = "/events/save" ascii
        $a3   = "/events/edit/" ascii

    condition:
        (uint16(0) == 0x3C3F or true) and
        ($evt) and
        (any of ($a*)) and
        (any of ($dist, $sg))
}

Suricata IDS Rule

alert http any any -> any any (msg:"valtersit.com - MISP Event Edit Modifying Distribution or Sharing Group (CVE-2026-107175)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"events"; nocase; http.uri; content:"edit"|"save"; nocase; http.request_body; content:"distribution"; nocase; http.request_body; content:"sharing_group_id"; nocase; classtype:policy-violation; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-107175; sid:2026107175; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ http where http.request.method == "POST"
      and stringContains(http.request.path, "events")
      and stringContains(toLower(http.request.body), "distribution") ]
  [ http where http.request.method == "POST"
      and stringContains(http.request.path, "events")
      and stringContains(toLower(http.request.body), "sharing_group_id") ]

Splunk SPL Query

index=misp sourcetype=misp:audit
| search (action IN ("edit","save","update") OR uri="*events*")
| eval dist_change=if(match(_raw,"(?i)distribution"),1,0)
| eval sg_change=if(match(_raw,"(?i)sharing_group_id"),1,0)
| where dist_change=1 OR sg_change=1
| stats count min(_time) as first_seen max(_time) as last_seen by user, event_id, dist_change, sg_change
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="misp,web,access_control,">
  <rule id="2026107" level="8">
    <decoded_as>json</decoded_as>
    <field name="action">edit|save|update</field>
    <field name="model">Event</field>
    <description>MISP event edit detected - possible distribution/sharing_group_id modification (CVE-2026-107175)</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
  <rule id="2026108" level="10">
    <if_sid>2026107</if_sid>
    <regex>distribution|sharing_group_id</regex>
    <description>MISP event distribution or sharing_group_id changed without guaranteed correlation refresh (CVE-2026-107175)</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Affected versions are those before 2.5.48 per the NVD description; no vendor fix file, commit, or advisory is available from tracked sources.

1) Immediate mitigations

• Restrict write access to MISP events to the minimum necessary user set; the precondition is any authenticated user with write access to a single event, so tightening RBAC directly reduces the attack surface.
• Where feasible, treat correlation results as untrusted after a distribution or sharing_group_id change, and validate that no restricted event remains correlated to a broader group.
• Manually force correlation recalculation (for example, via any administrative correlation-rebuild function provided by the deployment) after editing distribution or sharing-group fields on sensitive events, since the automated refresh may not fire.
• Audit recent event-edit activity for modifications of distribution or sharing_group_id and review whether affected events were moved to more restrictive scopes, then manually verify correlation state.

2) Patch/upgrade steps

• Upgrade to a version >= 2.5.48 if and when a fixed release is published and verified; the affected range stated in the supplied data is <2.5.48. Confirm the fix against the vendor's release notes before relying on it, as no patch source is currently tracked.
• Monitor the MISP project's release channels and vulnerability advisories for a confirmed fix; at time of writing no patch evidence exists.

3) Long-term hardening

• Enforce least-privilege event write permissions and periodic review of sharing-group memberships.
• Implement monitoring (see Detection Guidance) for distribution/sharing-group edits and alert on edits that narrow a previously broad scope.
• Periodically reconcile correlation data against current event distribution and sharing-group configuration through scheduled validation jobs.
• Log and retain event-save audit trails to support post-incident investigation of disclosure caused by stale correlations.

References

• NVD — CVE-2026-107175: https://nvd.nist.gov/vuln/detail/CVE-2026-107175
• MISP Project (vendor) releases and security advisories: https://www.misp-project.org/ (release notes/commits for version 2.5.48 and later)
• CWE-284: Improper Access Control — https://cwe.mitre.org/data/definitions/284.html
• MITRE ATT&CK T1213: Data from Information Repositories — https://attack.mitre.org/techniques/T1213/
• CISA Known Exploited Vulnerabilities Catalog: NOT LISTED (no exploit-in-the-wild evidence). No known threat actor campaigns associated with this CVE as of the supplied intelligence.