CVE-2026-107175 (GCVE-0-2026-107175)
Vulnerability from cvelistv5 – Published: 2026-10-07 12:38 – Updated: 2026-10-07 14:40
VLAI
EPSS
VEX
Title
MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes
Summary
MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified.
When a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted.
Security impact:
- Stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure.
- Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing.
Preconditions:
- An authenticated user with write access to at least one MISP event.
- The user modifies the event's distribution or sharing_group_id field.
Affected versions: <2.5.48
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
Supplier · CIRCL (v2.0.3)
Decision recorded 2026-10-07 12:35 UTC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 14:39 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/19a389d19 | patch |
Impacted products
GCVE extensions
AI-generated
Human-reviewed
Confidence: medium
Model
qwen3.8:27b
1 event
advisory
bcp-05-x-01bcp-05-x-02bcp-05-x-03
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-10-07 12:35 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/19a389d19.patch
a23e99457b84… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
19a389d19f65
|
fix: [correlation] fix correlation distribution refresh on | a23e99457b84… |
Fix summary
The fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly.
Patch summary
In app/Model/Event.php, the beforeSave method was modified. Previously, $this->__beforeSaveData was set to the full incoming $this->data['Event'] array. The patch replaces this with: (1) initializing __beforeSaveData to null, (2) checking whether the event has an existing id (i.e., it is an update, not a create), (3) issuing a targeted database query (recursive -1, selecting only Event.distribution and Event.sharing_group_id) to fetch the currently stored values, and (4) storing those fetched values in __beforeSaveData. This ensures the after-save comparison correctly identifies distribution/sharing_group_id changes.
CVSS rationale
AV:N: MISP is a network-accessible web application. AC:L: An authenticated user simply edits an event's sharing group; no race condition or complex setup is needed. AT:N: No manipulation of a separate attack target is required. PR:L: Requires an authenticated user with write access to events. UI:N: The stale correlation persists without further user interaction. VC/VI/VA:N: The vulnerable component (the event save logic) is not directly compromised in confidentiality, integrity, or availability. SC:L: The security impact is on the broader MISP instance: users in a broader sharing group may see correlation data referencing an event that was moved to a more restrictive group, resulting in limited information disclosure. SI/SA:N: No integrity or safety impact on other systems.
Weakness rationale
- CWE-284 The core security impact is that correlation data access boundaries are not enforced when an event's sharing group or distribution changes. Stale correlations can expose event data to users who should no longer have access, constituting an improper access control failure.
- CWE-665 The root cause is that the __beforeSaveData variable was initialized with the incoming (new) data rather than the previously stored data, causing the change-detection logic in afterSave to fail. This is a classic improper initialization of a state variable used for change detection.
Attack pattern rationale
- CAPEC-114 The closest plausible CAPEC is Parameter Tampering: a user modifies the distribution or sharing_group_id parameters of an event, and the application fails to properly enforce the resulting access-control changes on correlated data. The mapping is uncertain because this is not a malicious tamper per se but a legitimate parameter modification that exposes a system defect; however, CAPEC-114 best captures the scenario where parameter changes are not properly reflected in downstream access enforcement. No more specific CAPEC for 'stale derived data after parameter change' exists in the CAPEC catalog.
Assumptions to verify
- The exact fixed version number is not specified in the patch metadata; the tag boundary indicates the fix is 47 commits after v2.5.48, but the release tag containing this commit is unknown.
- The security impact is assessed as limited information disclosure through stale correlations; the patch does not indicate a direct privilege escalation or data corruption vector.
- CAPEC-114 (Parameter Tampering) is the closest available mapping; no CAPEC specifically covers 'stale derived data after a legitimate parameter change' and the mapping is approximate.
- The assumption that the afterSave hook uses __beforeSaveData to compare old vs new distribution/sharing_group_id values is inferred from the commit message and the code change pattern; the afterSave code itself is not included in the patch.
- CVSS UI:N assumes the stale correlation data is accessible via the normal MISP UI/API without additional user interaction beyond the initial event edit.
- The Co-Authored-By line for Claude Opus 4.8 is treated as a tool credit, not a human remediation developer.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
6 | 11 | medium | 6 |
- 2026-09-23 07:41 UTC Fix developed Corrective change authored (19a389d19f65e25ba3328e72e6ad23919a39ccd0): fix: [correlation] fix correlation distribution refresh on https://github.com/MISP/MISP/commit/19a389d19.patch
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107175",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T14:39:59.827397Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T14:40:14.998Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"Event model (app/Model/Event.php)",
"Correlation engine"
],
"product": "MISP",
"programFiles": [
"app/Model/Event.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event\u0027s distribution level or sharing group is modified.\u003c/p\u003e\u003cp\u003eWhen a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted.\u003c/p\u003e\u003cp\u003eSecurity impact:\u003c/p\u003e\u003cp\u003e- Stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure.\u003c/p\u003e\u003cp\u003e- Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- An authenticated user with write access to at least one MISP event.\u003c/p\u003e\u003cp\u003e- The user modifies the event\u0027s distribution or sharing_group_id field.\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48\u003c/p\u003e"
}
],
"value": "MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event\u0027s distribution level or sharing group is modified.\n\nWhen a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted.\n\nSecurity impact:\n\n- Stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure.\n\n- Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing.\n\nPreconditions:\n\n- An authenticated user with write access to at least one MISP event.\n\n- The user modifies the event\u0027s distribution or sharing_group_id field.\n\nAffected versions: \u003c2.5.48"
}
],
"impacts": [
{
"capecId": "CAPEC-114",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-114 Parameter Tampering"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-07T12:35:42Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "CWE-665 Improper Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T12:38:44.252Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/19a389d19"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly.\u003c/p\u003e"
}
],
"value": "The fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly."
}
],
"title": "MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The exact fixed version number is not specified in the patch metadata; the tag boundary indicates the fix is 47 commits after v2.5.48, but the release tag containing this commit is unknown.",
"The security impact is assessed as limited information disclosure through stale correlations; the patch does not indicate a direct privilege escalation or data corruption vector.",
"CAPEC-114 (Parameter Tampering) is the closest available mapping; no CAPEC specifically covers \u0027stale derived data after a legitimate parameter change\u0027 and the mapping is approximate.",
"The assumption that the afterSave hook uses __beforeSaveData to compare old vs new distribution/sharing_group_id values is inferred from the commit message and the code change pattern; the afterSave code itself is not included in the patch.",
"CVSS UI:N assumes the stale correlation data is accessible via the normal MISP UI/API without additional user interaction beyond the initial event edit.",
"The Co-Authored-By line for Claude Opus 4.8 is treated as a tool credit, not a human remediation developer."
],
"capecRationale": [
{
"capecId": "CAPEC-114",
"rationale": "The closest plausible CAPEC is Parameter Tampering: a user modifies the distribution or sharing_group_id parameters of an event, and the application fails to properly enforce the resulting access-control changes on correlated data. The mapping is uncertain because this is not a malicious tamper per se but a legitimate parameter modification that exposes a system defect; however, CAPEC-114 best captures the scenario where parameter changes are not properly reflected in downstream access enforcement. No more specific CAPEC for \u0027stale derived data after parameter change\u0027 exists in the CAPEC catalog."
}
],
"commit": "19a389d19f65e25ba3328e72e6ad23919a39ccd0",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
}
],
"cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: An authenticated user simply edits an event\u0027s sharing group; no race condition or complex setup is needed. AT:N: No manipulation of a separate attack target is required. PR:L: Requires an authenticated user with write access to events. UI:N: The stale correlation persists without further user interaction. VC/VI/VA:N: The vulnerable component (the event save logic) is not directly compromised in confidentiality, integrity, or availability. SC:L: The security impact is on the broader MISP instance: users in a broader sharing group may see correlation data referencing an event that was moved to a more restrictive group, resulting in limited information disclosure. SI/SA:N: No integrity or safety impact on other systems.",
"fixSummary": "The fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly.",
"generatedAt": "2026-10-07T12:35:42.209027Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 6,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 6
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "a23e99457b847b37183a6159eec9860f3cc8243bae000bc81cbd3449fa7aa225",
"patchSummary": "In app/Model/Event.php, the beforeSave method was modified. Previously, $this-\u003e__beforeSaveData was set to the full incoming $this-\u003edata[\u0027Event\u0027] array. The patch replaces this with: (1) initializing __beforeSaveData to null, (2) checking whether the event has an existing id (i.e., it is an update, not a create), (3) issuing a targeted database query (recursive -1, selecting only Event.distribution and Event.sharing_group_id) to fetch the currently stored values, and (4) storing those fetched values in __beforeSaveData. This ensures the after-save comparison correctly identifies distribution/sharing_group_id changes.",
"patchTruncated": false,
"patches": [
{
"commit": "19a389d19f65e25ba3328e72e6ad23919a39ccd0",
"date": "Wed, 23 Sep 2026 09:41:31 +0200",
"patchSha256": "a23e99457b847b37183a6159eec9860f3cc8243bae000bc81cbd3449fa7aa225",
"source": "https://github.com/MISP/MISP/commit/19a389d19.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/19a389d19.patch",
"subject": "fix: [correlation] fix correlation distribution refresh on"
}
],
"source": "https://github.com/MISP/MISP/commit/19a389d19.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-07T12:35:42Z",
"version": "2.0.3"
},
"subject": "fix: [correlation] fix correlation distribution refresh on",
"tagVersionBoundary": {
"commits_after_fix": 47,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.48",
"version": "2.5.48",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-284",
"rationale": "The core security impact is that correlation data access boundaries are not enforced when an event\u0027s sharing group or distribution changes. Stale correlations can expose event data to users who should no longer have access, constituting an improper access control failure."
},
{
"cweId": "CWE-665",
"rationale": "The root cause is that the __beforeSaveData variable was initialized with the incoming (new) data rather than the previously stored data, causing the change-detection logic in afterSave to fail. This is a classic improper initialization of a state variable used for change detection."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (19a389d19f65e25ba3328e72e6ad23919a39ccd0): fix: [correlation] fix correlation distribution refresh on",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/MISP/MISP/commit/19a389d19.patch"
],
"timestamp": "2026-09-23T07:41:31Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20264"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-107175",
"datePublished": "2026-10-07T12:38:44.252Z",
"dateReserved": "2026-10-07T12:38:41.839Z",
"dateUpdated": "2026-10-07T14:40:14.998Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"Event model (app/Model/Event.php)",
"Correlation engine"
],
"product": "MISP",
"programFiles": [
"app/Model/Event.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event\u0027s distribution level or sharing group is modified.\n\nWhen a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted.\n\nSecurity impact:\n\n- Stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure.\n\n- Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing.\n\nPreconditions:\n\n- An authenticated user with write access to at least one MISP event.\n\n- The user modifies the event\u0027s distribution or sharing_group_id field.\n\nAffected versions: \u003c2.5.48"
}
],
"id": "CVE-2026-107175",
"lastModified": "2026-10-07T15:17:19.377",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"ssvcData": {
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-07T12:35:42Z",
"version": "2.0.3"
}
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-107175",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T14:39:59.827397Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-10-07T13:17:20.563",
"references": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"url": "https://github.com/MISP/MISP/commit/19a389d19"
}
],
"sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-284"
},
{
"lang": "en",
"value": "CWE-665"
}
],
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107175",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T14:39:59.827397Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T14:40:10.583Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"Event model (app/Model/Event.php)",
"Correlation engine"
],
"product": "MISP",
"programFiles": [
"app/Model/Event.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event\u0027s distribution level or sharing group is modified.\u003c/p\u003e\u003cp\u003eWhen a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted.\u003c/p\u003e\u003cp\u003eSecurity impact:\u003c/p\u003e\u003cp\u003e- Stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure.\u003c/p\u003e\u003cp\u003e- Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- An authenticated user with write access to at least one MISP event.\u003c/p\u003e\u003cp\u003e- The user modifies the event\u0027s distribution or sharing_group_id field.\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48\u003c/p\u003e"
}
],
"value": "MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event\u0027s distribution level or sharing group is modified.\n\nWhen a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted.\n\nSecurity impact:\n\n- Stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure.\n\n- Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing.\n\nPreconditions:\n\n- An authenticated user with write access to at least one MISP event.\n\n- The user modifies the event\u0027s distribution or sharing_group_id field.\n\nAffected versions: \u003c2.5.48"
}
],
"impacts": [
{
"capecId": "CAPEC-114",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-114 Parameter Tampering"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-07T12:35:42Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "CWE-665 Improper Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T12:38:44.252Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/19a389d19"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly.\u003c/p\u003e"
}
],
"value": "The fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly."
}
],
"title": "MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The exact fixed version number is not specified in the patch metadata; the tag boundary indicates the fix is 47 commits after v2.5.48, but the release tag containing this commit is unknown.",
"The security impact is assessed as limited information disclosure through stale correlations; the patch does not indicate a direct privilege escalation or data corruption vector.",
"CAPEC-114 (Parameter Tampering) is the closest available mapping; no CAPEC specifically covers \u0027stale derived data after a legitimate parameter change\u0027 and the mapping is approximate.",
"The assumption that the afterSave hook uses __beforeSaveData to compare old vs new distribution/sharing_group_id values is inferred from the commit message and the code change pattern; the afterSave code itself is not included in the patch.",
"CVSS UI:N assumes the stale correlation data is accessible via the normal MISP UI/API without additional user interaction beyond the initial event edit.",
"The Co-Authored-By line for Claude Opus 4.8 is treated as a tool credit, not a human remediation developer."
],
"capecRationale": [
{
"capecId": "CAPEC-114",
"rationale": "The closest plausible CAPEC is Parameter Tampering: a user modifies the distribution or sharing_group_id parameters of an event, and the application fails to properly enforce the resulting access-control changes on correlated data. The mapping is uncertain because this is not a malicious tamper per se but a legitimate parameter modification that exposes a system defect; however, CAPEC-114 best captures the scenario where parameter changes are not properly reflected in downstream access enforcement. No more specific CAPEC for \u0027stale derived data after parameter change\u0027 exists in the CAPEC catalog."
}
],
"commit": "19a389d19f65e25ba3328e72e6ad23919a39ccd0",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
}
],
"cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: An authenticated user simply edits an event\u0027s sharing group; no race condition or complex setup is needed. AT:N: No manipulation of a separate attack target is required. PR:L: Requires an authenticated user with write access to events. UI:N: The stale correlation persists without further user interaction. VC/VI/VA:N: The vulnerable component (the event save logic) is not directly compromised in confidentiality, integrity, or availability. SC:L: The security impact is on the broader MISP instance: users in a broader sharing group may see correlation data referencing an event that was moved to a more restrictive group, resulting in limited information disclosure. SI/SA:N: No integrity or safety impact on other systems.",
"fixSummary": "The fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly.",
"generatedAt": "2026-10-07T12:35:42.209027Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 6,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 6
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "a23e99457b847b37183a6159eec9860f3cc8243bae000bc81cbd3449fa7aa225",
"patchSummary": "In app/Model/Event.php, the beforeSave method was modified. Previously, $this-\u003e__beforeSaveData was set to the full incoming $this-\u003edata[\u0027Event\u0027] array. The patch replaces this with: (1) initializing __beforeSaveData to null, (2) checking whether the event has an existing id (i.e., it is an update, not a create), (3) issuing a targeted database query (recursive -1, selecting only Event.distribution and Event.sharing_group_id) to fetch the currently stored values, and (4) storing those fetched values in __beforeSaveData. This ensures the after-save comparison correctly identifies distribution/sharing_group_id changes.",
"patchTruncated": false,
"patches": [
{
"commit": "19a389d19f65e25ba3328e72e6ad23919a39ccd0",
"date": "Wed, 23 Sep 2026 09:41:31 +0200",
"patchSha256": "a23e99457b847b37183a6159eec9860f3cc8243bae000bc81cbd3449fa7aa225",
"source": "https://github.com/MISP/MISP/commit/19a389d19.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/19a389d19.patch",
"subject": "fix: [correlation] fix correlation distribution refresh on"
}
],
"source": "https://github.com/MISP/MISP/commit/19a389d19.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-07T12:35:42Z",
"version": "2.0.3"
},
"subject": "fix: [correlation] fix correlation distribution refresh on",
"tagVersionBoundary": {
"commits_after_fix": 47,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.48",
"version": "2.5.48",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-284",
"rationale": "The core security impact is that correlation data access boundaries are not enforced when an event\u0027s sharing group or distribution changes. Stale correlations can expose event data to users who should no longer have access, constituting an improper access control failure."
},
{
"cweId": "CWE-665",
"rationale": "The root cause is that the __beforeSaveData variable was initialized with the incoming (new) data rather than the previously stored data, causing the change-detection logic in afterSave to fail. This is a classic improper initialization of a state variable used for change detection."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (19a389d19f65e25ba3328e72e6ad23919a39ccd0): fix: [correlation] fix correlation distribution refresh on",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/MISP/MISP/commit/19a389d19.patch"
],
"timestamp": "2026-09-23T07:41:31Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20264"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-107175",
"datePublished": "2026-10-07T12:38:44.252Z",
"dateReserved": "2026-10-07T12:38:41.839Z",
"dateUpdated": "2026-10-07T14:40:14.998Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…