CVE-2026-103659

Estado: AplazadaAlta (7.1)—

MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distribution and sharing-group access control check was not re-applied to those attributes.

As a result, a user who can view a community-distributed event could retrieve attributes belonging to organisation-only objects (distribution level 0) or objects restricted to a specific sharing group, even though the user's organisation does not have access to those objects. This constitutes an unauthorized disclosure of sensitive threat intelligence data.

Leer descripción completaMostrar menos

A secondary issue was introduced by the initial remediation: the fix reused the full Object contain conditions (including soft-delete state) as the gate for flattened attributes, causing an event owner requesting deleted attributes to lose all attributes whose parent object was still live. The final fix isolates the distribution ACL condition as the sole gate.

Preconditions:

- An authenticated user with access to a community-distributed event

- The event contains at least one object with a distribution level or sharing group that restricts access beyond the event's own distribution

Impact:

- Unauthorized disclosure of attributes belonging to restricted objects

- Potential exposure of organisation-specific threat intelligence to other organisations

Affected versions: <2.5.48

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 7.1

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.23%
Percentil entre todas las CVEs puntuadas: 12
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement75 %
Impacto principalT1552.001 Credentials In Filescredential access85 %
Impacto secundarioT1078.001 Default Accountsstealth · persistence · privilege escalation · initial access70 %

Explotación de servicio remoto (MISP API) requiriendo autenticación previa (PR:L). Impacto: acceso no autorizado a datos sensibles mediante bypass de control de acceso en objetos restringidos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Password Policies Vulnerability Scanning User Training Threat Intelligence Program Restrict File and Directory Permissions Privileged Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Misp — Misp^AI

CWE

CWE-285, CWE-862

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-103659",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "ssvcData": {
          "role": "Supplier",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-01T08:10:59Z"
        }
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-103659",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-01T15:24:35.363182Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 7.1,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "modules": [
            "Event model (app/Model/Event.php)"
          ],
          "product": "MISP",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.5.48",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "app/Model/Event.php"
          ]
        }
      ]
    }
  ],
  "published": "2026-10-01T09:17:08.213",
  "references": [
    {
      "url": "https://github.com/MISP/MISP/commit/07f3486d5",
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
    },
    {
      "url": "https://github.com/MISP/MISP/commit/ab08edf92",
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distribution and sharing-group access control check was not re-applied to those attributes.\n\nAs a result, a user who can view a community-distributed event could retrieve attributes belonging to organisation-only objects (distribution level 0) or objects restricted to a specific sharing group, even though the user's organisation does not have access to those objects. This constitutes an unauthorized disclosure of sensitive threat intelligence data.\n\nA secondary issue was introduced by the initial remediation: the fix reused the full Object contain conditions (including soft-delete state) as the gate for flattened attributes, causing an event owner requesting deleted attributes to lose all attributes whose parent object was still live. The final fix isolates the distribution ACL condition as the sole gate.\n\nPreconditions:\n\n- An authenticated user with access to a community-distributed event\n\n- The event contains at least one object with a distribution level or sharing group that restricts access beyond the event's own distribution\n\nImpact:\n\n- Unauthorized disclosure of attributes belonging to restricted objects\n\n- Potential exposure of organisation-specific threat intelligence to other organisations\n\nAffected versions: <2.5.48"
    }
  ],
  "lastModified": "2026-10-01T16:17:37.713",
  "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
}