CVE-2026-107278 (GCVE-0-2026-107278)
Vulnerability from cvelistv5 – Published: 2026-10-07 15:42 – Updated: 2026-10-07 20:28
VLAI
EPSS
VEX
Title
MISP Object Sync Drops Objects and Attributes When Description Is Empty
Summary
MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance's validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data.
Preconditions:
- Two or more MISP instances are configured to synchronize objects.
- A user with object-creation privileges creates an object without supplying a description.
- The object is subsequently synced to a peer instance.
Impact:
- Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline.
- The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology.
Affected: <2.5.48.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
Supplier · CIRCL (v2.0.3)
Decision recorded 2026-10-07 15:41 UTC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 20:28 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/6b1776f07 | patch |
Impacted products
GCVE extensions
AI-generated
Human-reviewed
Confidence: medium
Model
qwen3.8:27b
1 event
advisory
bcp-05-x-01bcp-05-x-02bcp-05-x-03
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-10-07 15:41 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/6b1776f07.patch
17b9854719a4… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
6b1776f072e1
|
fix: [sync] Accept objects without a description | 17b9854719a4… |
Fix summary
The overly strict validation rule that required a non-empty description on MISP Objects during creation was relaxed to permit an empty description. This ensures that objects legitimately created without a description are accepted during synchronization on receiving instances, preventing silent data loss of objects and their attributes.
Patch summary
In app/Model/MispObject.php, the validation rule for the 'description' field (stringNotEmpty, applied on create) was modified by adding the key 'allowEmpty' set to true. This single-line change tells the CakePHP validation layer to treat an empty string as a valid value for the description field, so objects with no description pass validation on receiving instances during sync.
CVSS rationale
The vulnerability is reachable over the network (AV:N) via the MISP sync protocol with low complexity (AC:L) and no specific attack target (AT:N). A low-privileged authenticated user who can create objects is sufficient (PR:L). No user interaction is needed (UI:N). There is no confidentiality impact (VC:N). The integrity impact on the victim is low (VI:L) because valid objects and attributes are silently dropped, corrupting the integrity of the receiving instance's data store. There is no direct availability impact on the victim system itself (VA:N). No secondary impacts are identified (SC:N, SI:N, SA:N). Overall severity is Low.
Weakness rationale
- CWE-20 The validation rule stringNotEmpty was applied without accounting for the legitimate case of an empty description, causing valid input (an object with no description) to be rejected. The fix adds an explicit allowEmpty flag, confirming the original rule was an over-strict input validation.
Attack pattern rationale
- CAPEC-101 This is the closest available CAPEC. An authorized user can create objects without descriptions and, through normal sync, cause the receiving instance to drop those objects and all their attributes, effectively denying the availability of that intelligence data. The mapping is uncertain because the primary effect is data-integrity loss rather than a classic DoS, and no external unauthenticated attacker is required; however, CAPEC-101 best captures the 'valid data is silently discarded, degrading the service's usefulness' pattern.
Assumptions to verify
- The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 36 commits after fix); no explicit 'affected' or 'fixed' version string is provided in the patch.
- The CAPEC-101 mapping is the closest available pattern; the issue is more accurately described as a data-integrity defect during sync rather than a classic DoS, but no CAPEC specifically covers 'over-strict validation causing silent data loss during replication'.
- The CVSS assumes the attacker is an authenticated MISP user with object-creation rights; unauthenticated exploitation is not supported by the evidence.
- The commit message states the issue was 'found during the internal review, not externally reported'; no external finder or reporter is credited.
- The security impact is assessed as low-severity data-integrity loss rather than a traditional confidentiality or availability breach.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
7 | 11 | medium | 5 |
- 2026-09-24 14:07 UTC Fix developed Corrective change authored (6b1776f072e153a4e2cf3af0c210c7aeadfa0469): fix: [sync] Accept objects without a description https://github.com/MISP/MISP/commit/6b1776f07.patch
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107278",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T20:28:40.258470Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T20:28:50.215Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"app/Model/MispObject.php"
],
"product": "MISP",
"programFiles": [
"app/Model/MispObject.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance\u0027s validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- Two or more MISP instances are configured to synchronize objects.\u003c/p\u003e\u003cp\u003e- A user with object-creation privileges creates an object without supplying a description.\u003c/p\u003e\u003cp\u003e- The object is subsequently synced to a peer instance.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline.\u003c/p\u003e\u003cp\u003e- The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48.\u003c/p\u003e"
}
],
"value": "MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance\u0027s validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data.\n\nPreconditions:\n\n- Two or more MISP instances are configured to synchronize objects.\n\n- A user with object-creation privileges creates an object without supplying a description.\n\n- The object is subsequently synced to a peer instance.\n\nImpact:\n\n- Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline.\n\n- The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology.\n\nAffected: \u003c2.5.48."
}
],
"impacts": [
{
"capecId": "CAPEC-101",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-101 Application Level DoS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-07T15:41:05Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T15:42:42.472Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/6b1776f07"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe overly strict validation rule that required a non-empty description on MISP Objects during creation was relaxed to permit an empty description. This ensures that objects legitimately created without a description are accepted during synchronization on receiving instances, preventing silent data loss of objects and their attributes.\u003c/p\u003e"
}
],
"value": "The overly strict validation rule that required a non-empty description on MISP Objects during creation was relaxed to permit an empty description. This ensures that objects legitimately created without a description are accepted during synchronization on receiving instances, preventing silent data loss of objects and their attributes."
}
],
"title": "MISP Object Sync Drops Objects and Attributes When Description Is Empty",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 36 commits after fix); no explicit \u0027affected\u0027 or \u0027fixed\u0027 version string is provided in the patch.",
"The CAPEC-101 mapping is the closest available pattern; the issue is more accurately described as a data-integrity defect during sync rather than a classic DoS, but no CAPEC specifically covers \u0027over-strict validation causing silent data loss during replication\u0027.",
"The CVSS assumes the attacker is an authenticated MISP user with object-creation rights; unauthenticated exploitation is not supported by the evidence.",
"The commit message states the issue was \u0027found during the internal review, not externally reported\u0027; no external finder or reporter is credited.",
"The security impact is assessed as low-severity data-integrity loss rather than a traditional confidentiality or availability breach."
],
"capecRationale": [
{
"capecId": "CAPEC-101",
"rationale": "This is the closest available CAPEC. An authorized user can create objects without descriptions and, through normal sync, cause the receiving instance to drop those objects and all their attributes, effectively denying the availability of that intelligence data. The mapping is uncertain because the primary effect is data-integrity loss rather than a classic DoS, and no external unauthenticated attacker is required; however, CAPEC-101 best captures the \u0027valid data is silently discarded, degrading the service\u0027s usefulness\u0027 pattern."
}
],
"commit": "6b1776f072e153a4e2cf3af0c210c7aeadfa0469",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
}
],
"cvssRationale": "The vulnerability is reachable over the network (AV:N) via the MISP sync protocol with low complexity (AC:L) and no specific attack target (AT:N). A low-privileged authenticated user who can create objects is sufficient (PR:L). No user interaction is needed (UI:N). There is no confidentiality impact (VC:N). The integrity impact on the victim is low (VI:L) because valid objects and attributes are silently dropped, corrupting the integrity of the receiving instance\u0027s data store. There is no direct availability impact on the victim system itself (VA:N). No secondary impacts are identified (SC:N, SI:N, SA:N). Overall severity is Low.",
"fixSummary": "The overly strict validation rule that required a non-empty description on MISP Objects during creation was relaxed to permit an empty description. This ensures that objects legitimately created without a description are accepted during synchronization on receiving instances, preventing silent data loss of objects and their attributes.",
"generatedAt": "2026-10-07T15:41:05.158252Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 5,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 7
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "17b9854719a40da145be39fc8cf2107bf9d99d02dff2785002fe7a842de88ea1",
"patchSummary": "In app/Model/MispObject.php, the validation rule for the \u0027description\u0027 field (stringNotEmpty, applied on create) was modified by adding the key \u0027allowEmpty\u0027 set to true. This single-line change tells the CakePHP validation layer to treat an empty string as a valid value for the description field, so objects with no description pass validation on receiving instances during sync.",
"patchTruncated": false,
"patches": [
{
"commit": "6b1776f072e153a4e2cf3af0c210c7aeadfa0469",
"date": "Thu, 24 Sep 2026 16:07:34 +0200",
"patchSha256": "17b9854719a40da145be39fc8cf2107bf9d99d02dff2785002fe7a842de88ea1",
"source": "https://github.com/MISP/MISP/commit/6b1776f07.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/6b1776f07.patch",
"subject": "fix: [sync] Accept objects without a description"
}
],
"source": "https://github.com/MISP/MISP/commit/6b1776f07.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-07T15:41:05Z",
"version": "2.0.3"
},
"subject": "fix: [sync] Accept objects without a description",
"tagVersionBoundary": {
"commits_after_fix": 36,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.48",
"version": "2.5.48",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-20",
"rationale": "The validation rule stringNotEmpty was applied without accounting for the legitimate case of an empty description, causing valid input (an object with no description) to be rejected. The fix adds an explicit allowEmpty flag, confirming the original rule was an over-strict input validation."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (6b1776f072e153a4e2cf3af0c210c7aeadfa0469): fix: [sync] Accept objects without a description",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/MISP/MISP/commit/6b1776f07.patch"
],
"timestamp": "2026-09-24T14:07:34Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20215"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-107278",
"datePublished": "2026-10-07T15:42:42.472Z",
"dateReserved": "2026-10-07T15:42:40.660Z",
"dateUpdated": "2026-10-07T20:28:50.215Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"app/Model/MispObject.php"
],
"product": "MISP",
"programFiles": [
"app/Model/MispObject.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance\u0027s validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data.\n\nPreconditions:\n\n- Two or more MISP instances are configured to synchronize objects.\n\n- A user with object-creation privileges creates an object without supplying a description.\n\n- The object is subsequently synced to a peer instance.\n\nImpact:\n\n- Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline.\n\n- The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology.\n\nAffected: \u003c2.5.48."
}
],
"id": "CVE-2026-107278",
"lastModified": "2026-10-07T21:17:15.030",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"ssvcData": {
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-07T15:41:05Z",
"version": "2.0.3"
}
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-107278",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T20:28:40.258470Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-10-07T16:17:47.393",
"references": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"url": "https://github.com/MISP/MISP/commit/6b1776f07"
}
],
"sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107278",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T20:28:40.258470Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T20:28:46.128Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"app/Model/MispObject.php"
],
"product": "MISP",
"programFiles": [
"app/Model/MispObject.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance\u0027s validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- Two or more MISP instances are configured to synchronize objects.\u003c/p\u003e\u003cp\u003e- A user with object-creation privileges creates an object without supplying a description.\u003c/p\u003e\u003cp\u003e- The object is subsequently synced to a peer instance.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline.\u003c/p\u003e\u003cp\u003e- The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48.\u003c/p\u003e"
}
],
"value": "MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance\u0027s validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data.\n\nPreconditions:\n\n- Two or more MISP instances are configured to synchronize objects.\n\n- A user with object-creation privileges creates an object without supplying a description.\n\n- The object is subsequently synced to a peer instance.\n\nImpact:\n\n- Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline.\n\n- The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology.\n\nAffected: \u003c2.5.48."
}
],
"impacts": [
{
"capecId": "CAPEC-101",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-101 Application Level DoS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-07T15:41:05Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T15:42:42.472Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/6b1776f07"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe overly strict validation rule that required a non-empty description on MISP Objects during creation was relaxed to permit an empty description. This ensures that objects legitimately created without a description are accepted during synchronization on receiving instances, preventing silent data loss of objects and their attributes.\u003c/p\u003e"
}
],
"value": "The overly strict validation rule that required a non-empty description on MISP Objects during creation was relaxed to permit an empty description. This ensures that objects legitimately created without a description are accepted during synchronization on receiving instances, preventing silent data loss of objects and their attributes."
}
],
"title": "MISP Object Sync Drops Objects and Attributes When Description Is Empty",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 36 commits after fix); no explicit \u0027affected\u0027 or \u0027fixed\u0027 version string is provided in the patch.",
"The CAPEC-101 mapping is the closest available pattern; the issue is more accurately described as a data-integrity defect during sync rather than a classic DoS, but no CAPEC specifically covers \u0027over-strict validation causing silent data loss during replication\u0027.",
"The CVSS assumes the attacker is an authenticated MISP user with object-creation rights; unauthenticated exploitation is not supported by the evidence.",
"The commit message states the issue was \u0027found during the internal review, not externally reported\u0027; no external finder or reporter is credited.",
"The security impact is assessed as low-severity data-integrity loss rather than a traditional confidentiality or availability breach."
],
"capecRationale": [
{
"capecId": "CAPEC-101",
"rationale": "This is the closest available CAPEC. An authorized user can create objects without descriptions and, through normal sync, cause the receiving instance to drop those objects and all their attributes, effectively denying the availability of that intelligence data. The mapping is uncertain because the primary effect is data-integrity loss rather than a classic DoS, and no external unauthenticated attacker is required; however, CAPEC-101 best captures the \u0027valid data is silently discarded, degrading the service\u0027s usefulness\u0027 pattern."
}
],
"commit": "6b1776f072e153a4e2cf3af0c210c7aeadfa0469",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
}
],
"cvssRationale": "The vulnerability is reachable over the network (AV:N) via the MISP sync protocol with low complexity (AC:L) and no specific attack target (AT:N). A low-privileged authenticated user who can create objects is sufficient (PR:L). No user interaction is needed (UI:N). There is no confidentiality impact (VC:N). The integrity impact on the victim is low (VI:L) because valid objects and attributes are silently dropped, corrupting the integrity of the receiving instance\u0027s data store. There is no direct availability impact on the victim system itself (VA:N). No secondary impacts are identified (SC:N, SI:N, SA:N). Overall severity is Low.",
"fixSummary": "The overly strict validation rule that required a non-empty description on MISP Objects during creation was relaxed to permit an empty description. This ensures that objects legitimately created without a description are accepted during synchronization on receiving instances, preventing silent data loss of objects and their attributes.",
"generatedAt": "2026-10-07T15:41:05.158252Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 5,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 7
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "17b9854719a40da145be39fc8cf2107bf9d99d02dff2785002fe7a842de88ea1",
"patchSummary": "In app/Model/MispObject.php, the validation rule for the \u0027description\u0027 field (stringNotEmpty, applied on create) was modified by adding the key \u0027allowEmpty\u0027 set to true. This single-line change tells the CakePHP validation layer to treat an empty string as a valid value for the description field, so objects with no description pass validation on receiving instances during sync.",
"patchTruncated": false,
"patches": [
{
"commit": "6b1776f072e153a4e2cf3af0c210c7aeadfa0469",
"date": "Thu, 24 Sep 2026 16:07:34 +0200",
"patchSha256": "17b9854719a40da145be39fc8cf2107bf9d99d02dff2785002fe7a842de88ea1",
"source": "https://github.com/MISP/MISP/commit/6b1776f07.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/6b1776f07.patch",
"subject": "fix: [sync] Accept objects without a description"
}
],
"source": "https://github.com/MISP/MISP/commit/6b1776f07.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-07T15:41:05Z",
"version": "2.0.3"
},
"subject": "fix: [sync] Accept objects without a description",
"tagVersionBoundary": {
"commits_after_fix": 36,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.48",
"version": "2.5.48",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-20",
"rationale": "The validation rule stringNotEmpty was applied without accounting for the legitimate case of an empty description, causing valid input (an object with no description) to be rejected. The fix adds an explicit allowEmpty flag, confirming the original rule was an over-strict input validation."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (6b1776f072e153a4e2cf3af0c210c7aeadfa0469): fix: [sync] Accept objects without a description",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/MISP/MISP/commit/6b1776f07.patch"
],
"timestamp": "2026-09-24T14:07:34Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20215"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-107278",
"datePublished": "2026-10-07T15:42:42.472Z",
"dateReserved": "2026-10-07T15:42:40.660Z",
"dateUpdated": "2026-10-07T20:28:50.215Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…