{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103659", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "state": "PUBLISHED", "assignerShortName": "CIRCL", "dateReserved": "2026-10-01T08:33:03.219Z", "datePublished": "2026-10-01T08:33:05.141Z", "dateUpdated": "2026-10-01T08:33:05.141Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["Event model (app/Model/Event.php)"], "product": "MISP", "programFiles": ["app/Model/Event.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Wenhao Wu"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 4.8"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distribution and sharing-group access control check was not re-applied to those attributes.</p><p>As a result, a user who can view a community-distributed event could retrieve attributes belonging to organisation-only objects (distribution level 0) or objects restricted to a specific sharing group, even though the user's organisation does not have access to those objects. This constitutes an unauthorized disclosure of sensitive threat intelligence data.</p><p>A secondary issue was introduced by the initial remediation: the fix reused the full Object contain conditions (including soft-delete state) as the gate for flattened attributes, causing an event owner requesting deleted attributes to lose all attributes whose parent object was still live. The final fix isolates the distribution ACL condition as the sole gate.</p><p>Preconditions:</p><p>- An authenticated user with access to a community-distributed event</p><p>- The event contains at least one object with a distribution level or sharing group that restricts access beyond the event's own distribution</p><p>Impact:</p><p>- Unauthorized disclosure of attributes belonging to restricted objects</p><p>- Potential exposure of organisation-specific threat intelligence to other organisations</p><p>Affected versions: &lt;2.5.48</p>"}], "value": "MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distribution and sharing-group access control check was not re-applied to those attributes.\n\nAs a result, a user who can view a community-distributed event could retrieve attributes belonging to organisation-only objects (distribution level 0) or objects restricted to a specific sharing group, even though the user's organisation does not have access to those objects. This constitutes an unauthorized disclosure of sensitive threat intelligence data.\n\nA secondary issue was introduced by the initial remediation: the fix reused the full Object contain conditions (including soft-delete state) as the gate for flattened attributes, causing an event owner requesting deleted attributes to lose all attributes whose parent object was still live. The final fix isolates the distribution ACL condition as the sole gate.\n\nPreconditions:\n\n- An authenticated user with access to a community-distributed event\n\n- The event contains at least one object with a distribution level or sharing group that restricts access beyond the event's own distribution\n\nImpact:\n\n- Unauthorized disclosure of attributes belonging to restricted objects\n\n- Potential exposure of organisation-specific threat intelligence to other organisations\n\nAffected versions: <2.5.48"}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Exploiting Incorrectly Adjusted Privileges"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 7.1, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-01T08:10:59Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-285", "description": "CWE-285 Improper Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-10-01T08:33:05.141Z"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/ab08edf92"}, {"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/07f3486d5"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix re-applies the object distribution and sharing-group ACL as a subquery condition on the Attribute.object_id field whenever the flatten option is active. This ensures that attributes belonging to objects the caller is not authorized to see are excluded from the flattened result set. The second commit refines the gate to use only the distribution ACL condition (correlated on Object.id) rather than the entire Object contain, preventing soft-delete state from incorrectly filtering attributes for the event owner.</p>"}], "value": "The fix re-applies the object distribution and sharing-group ACL as a subquery condition on the Attribute.object_id field whenever the flatten option is active. This ensures that attributes belonging to objects the caller is not authorized to see are excluded from the flattened result set. The second commit refines the gate to use only the distribution ACL condition (correlated on Object.id) rather than the entire Object contain, preventing soft-delete state from incorrectly filtering attributes for the event owner."}], "title": "MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The affected version range is unspecified; the patch does not include version tags or release boundaries. All MISP versions prior to the fix commit are assumed affected.", "The CVSS PR:L assumes the attacker needs at minimum a read-access role on the community event; no evidence supports a lower or higher privilege requirement.", "The CAPEC-126 mapping is the closest available pattern; no CAPEC specifically describes a missing per-object ACL in a flattened API response. The mapping is approximate.", "The second commit (soft-delete fix) is treated as part of the same vulnerability remediation per the patch-set assumption, though it addresses a regression introduced by the first fix rather than the original authorization bypass.", "AI co-authors (Claude Opus 4.8, Claude Opus 5) are listed in commit metadata but are not included as advisory credits as they are tooling, not human contributors.", "No evidence of active exploitation, public PoC, or in-the-wild abuse was found in the supplied data."], "capecRationale": [{"capecId": "CAPEC-126", "rationale": "The attacker (a legitimate user with access to a community event) exploits the fact that the application's privilege/access-control enforcement is incorrectly adjusted during the flatten operation. The object-level ACL is not applied, effectively elevating the user's data access beyond their intended scope. This is the closest CAPEC pattern to an authorization bypass where the application fails to enforce a narrower access control in a specific code path. Uncertainty: no CAPEC pattern specifically describes 'missing per-object ACL in a flattened view'; CAPEC-126 is the best available match for privilege/access-control bypass."}], "commit": "07f3486d50f2a5ee0f31ea66c920692664397ddb", "confidence": "medium", "credits": [{"lang": "en", "type": "reporter", "value": "Wenhao Wu"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 4.8"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5"}], "cvssRationale": "AV:N - exploited over the network via the MISP REST API. AC:L - the attack is a simple API request with the flatten parameter; no race conditions or complex setup required. AT:N - no special target-side conditions beyond the existence of a community event with restricted objects. PR:L - requires an authenticated user with at least read access to the community event. UI:N - no user interaction needed; the API call is self-contained. VC:H - sensitive threat-intelligence attributes from organisation-only objects are fully exposed to unauthorized users. VI:N, VA:N - no integrity or availability impact on the vulnerable component. SC:N, SI:N, SA:N - no impact on subsequent components; the data resides within the same application.", "fixSummary": "The fix re-applies the object distribution and sharing-group ACL as a subquery condition on the Attribute.object_id field whenever the flatten option is active. This ensures that attributes belonging to objects the caller is not authorized to see are excluded from the flattened result set. The second commit refines the gate to use only the distribution ACL condition (correlated on Object.id) rather than the entire Object contain, preventing soft-delete state from incorrectly filtering attributes for the event owner.", "generatedAt": "2026-10-01T08:10:59.855811Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 6, "confidence": "medium", "model": "qwen3.8:27b", "score": 6}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "e74b42214be094a3c715d859dd20b9ecd7091d30a187ab4583a7ec0f070c0581", "patchSummary": "In app/Model/Event.php, two code paths were modified. In fetchPaginatedAttributes(), a new subquery is generated against the Object table using the distribution and sharing-group ACL conditions, and an OR condition is added to the attribute query: either Attribute.object_id = 0 (top-level attribute) or the attribute's object passes the ACL. In fetchEvent(), when flatten is true and the user is not a site admin, a similar subquery is injected into the Attribute contain conditions. The second commit refactors the ACL condition into a standalone variable ($objectAclCondition) and uses only that condition (plus Object.id = Attribute.object_id) in the subquery, removing the soft-delete and other contain conditions that were incorrectly included. A regression test class (FlattenedObjectAcl) in tests/testregressions.py verifies: (1) an outsider cannot see organisation-only object attributes via flatten, (2) the owner retains soft-deleted attributes of a live object, and (3) the outsider cannot see another org's soft", "patchTruncated": false, "patches": [{"commit": "ab08edf9256bb3c9c8a382e0778ecd10b9e29c7c", "date": "Wed, 23 Sep 2026 09:25:31 +0200", "patchSha256": "ebc10168f16d00a458d924a62fe76e00277217c8449c694eeb4442d6d3a724a0", "source": "https://github.com/MISP/MISP/commit/ab08edf92.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/ab08edf92.patch", "subject": "fix: [security] Apply the object ACL to flattened attributes"}, {"commit": "07f3486d50f2a5ee0f31ea66c920692664397ddb", "date": "Mon, 28 Sep 2026 13:41:23 +0200", "patchSha256": "18601512c29df510bfdc629de713cffd41af868e7d230374aa346c92829e40de", "source": "https://github.com/MISP/MISP/commit/07f3486d5.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/07f3486d5.patch", "subject": "fix: [event] Gate flattened attributes on the object ACL"}], "source": "patch set (2 sources)", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-01T08:10:59Z", "version": "2.0.3"}, "subject": "fix: [event] Gate flattened attributes on the object ACL", "weaknessRationale": [{"cweId": "CWE-862", "rationale": "The flattening code path removed the Object contain (which enforced distribution and sharing-group ACLs) without re-applying an equivalent authorization check on the resulting top-level attributes. The object-level access control was simply absent from the flattened query, allowing unauthorized data access."}, {"cweId": "CWE-285", "rationale": "The authorization decision for object attributes was based solely on the event-level distribution rather than the object-level distribution and sharing group. This is an improper authorization check that grants broader access than intended."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (ab08edf9256bb3c9c8a382e0778ecd10b9e29c7c): fix: [security] Apply the object ACL to flattened attributes", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/ab08edf92.patch"], "timestamp": "2026-09-23T07:25:31Z", "type": "fix-developed"}, {"description": "Corrective change authored (07f3486d50f2a5ee0f31ea66c920692664397ddb): fix: [event] Gate flattened attributes on the object ACL", "id": "evt-fix-developed-2", "references": ["https://github.com/MISP/MISP/commit/07f3486d5.patch"], "timestamp": "2026-09-28T11:41:23Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20257"}]}}}

{}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["Event model (app/Model/Event.php)"], "product": "MISP", "programFiles": ["app/Model/Event.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distribution and sharing-group access control check was not re-applied to those attributes.\n\nAs a result, a user who can view a community-distributed event could retrieve attributes belonging to organisation-only objects (distribution level 0) or objects restricted to a specific sharing group, even though the user's organisation does not have access to those objects. This constitutes an unauthorized disclosure of sensitive threat intelligence data.\n\nA secondary issue was introduced by the initial remediation: the fix reused the full Object contain conditions (including soft-delete state) as the gate for flattened attributes, causing an event owner requesting deleted attributes to lose all attributes whose parent object was still live. The final fix isolates the distribution ACL condition as the sole gate.\n\nPreconditions:\n\n- An authenticated user with access to a community-distributed event\n\n- The event contains at least one object with a distribution level or sharing group that restricts access beyond the event's own distribution\n\nImpact:\n\n- Unauthorized disclosure of attributes belonging to restricted objects\n\n- Potential exposure of organisation-specific threat intelligence to other organisations\n\nAffected versions: <2.5.48"}], "id": "CVE-2026-103659", "lastModified": "2026-10-01T09:17:08.327", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}], "ssvcV203": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "ssvcData": {"options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "Supplier", "timestamp": "2026-10-01T08:10:59Z", "version": "2.0.3"}}]}, "published": "2026-10-01T09:17:08.213", "references": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "url": "https://github.com/MISP/MISP/commit/07f3486d5"}, {"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "url": "https://github.com/MISP/MISP/commit/ab08edf92"}], "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-862"}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}]}

{}

{"created": "2026-10-01T11:15:05.767382+00:00", "updated": "2026-10-01T11:15:05.767393+00:00", "vendors": []}