{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107175", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "state": "PUBLISHED", "assignerShortName": "CIRCL", "dateReserved": "2026-10-07T12:38:41.839Z", "datePublished": "2026-10-07T12:38:44.252Z", "dateUpdated": "2026-10-07T14:40:14.998Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["Event model (app/Model/Event.php)", "Correlation engine"], "product": "MISP", "programFiles": ["app/Model/Event.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 4.8"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified.</p><p>When a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted.</p><p>Security impact:</p><p>- Stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure.</p><p>- Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing.</p><p>Preconditions:</p><p>- An authenticated user with write access to at least one MISP event.</p><p>- The user modifies the event's distribution or sharing_group_id field.</p><p>Affected versions: &lt;2.5.48</p>"}], "value": "MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified.\n\nWhen a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted.\n\nSecurity impact:\n\n- Stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure.\n\n- Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing.\n\nPreconditions:\n\n- An authenticated user with write access to at least one MISP event.\n\n- The user modifies the event's distribution or sharing_group_id field.\n\nAffected versions: <2.5.48"}], "impacts": [{"capecId": "CAPEC-114", "descriptions": [{"lang": "en", "value": "CAPEC-114 Parameter Tampering"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-07T12:35:42Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-665", "description": "CWE-665 Improper Initialization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-10-07T12:38:44.252Z"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/19a389d19"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly.</p>"}], "value": "The fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly."}], "title": "MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The exact fixed version number is not specified in the patch metadata; the tag boundary indicates the fix is 47 commits after v2.5.48, but the release tag containing this commit is unknown.", "The security impact is assessed as limited information disclosure through stale correlations; the patch does not indicate a direct privilege escalation or data corruption vector.", "CAPEC-114 (Parameter Tampering) is the closest available mapping; no CAPEC specifically covers 'stale derived data after a legitimate parameter change' and the mapping is approximate.", "The assumption that the afterSave hook uses __beforeSaveData to compare old vs new distribution/sharing_group_id values is inferred from the commit message and the code change pattern; the afterSave code itself is not included in the patch.", "CVSS UI:N assumes the stale correlation data is accessible via the normal MISP UI/API without additional user interaction beyond the initial event edit.", "The Co-Authored-By line for Claude Opus 4.8 is treated as a tool credit, not a human remediation developer."], "capecRationale": [{"capecId": "CAPEC-114", "rationale": "The closest plausible CAPEC is Parameter Tampering: a user modifies the distribution or sharing_group_id parameters of an event, and the application fails to properly enforce the resulting access-control changes on correlated data. The mapping is uncertain because this is not a malicious tamper per se but a legitimate parameter modification that exposes a system defect; however, CAPEC-114 best captures the scenario where parameter changes are not properly reflected in downstream access enforcement. No more specific CAPEC for 'stale derived data after parameter change' exists in the CAPEC catalog."}], "commit": "19a389d19f65e25ba3328e72e6ad23919a39ccd0", "confidence": "medium", "credits": [{"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 4.8"}], "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: An authenticated user simply edits an event's sharing group; no race condition or complex setup is needed. AT:N: No manipulation of a separate attack target is required. PR:L: Requires an authenticated user with write access to events. UI:N: The stale correlation persists without further user interaction. VC/VI/VA:N: The vulnerable component (the event save logic) is not directly compromised in confidentiality, integrity, or availability. SC:L: The security impact is on the broader MISP instance: users in a broader sharing group may see correlation data referencing an event that was moved to a more restrictive group, resulting in limited information disclosure. SI/SA:N: No integrity or safety impact on other systems.", "fixSummary": "The fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly.", "generatedAt": "2026-10-07T12:35:42.209027Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 6, "confidence": "medium", "model": "qwen3.8:27b", "score": 6}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "a23e99457b847b37183a6159eec9860f3cc8243bae000bc81cbd3449fa7aa225", "patchSummary": "In app/Model/Event.php, the beforeSave method was modified. Previously, $this->__beforeSaveData was set to the full incoming $this->data['Event'] array. The patch replaces this with: (1) initializing __beforeSaveData to null, (2) checking whether the event has an existing id (i.e., it is an update, not a create), (3) issuing a targeted database query (recursive -1, selecting only Event.distribution and Event.sharing_group_id) to fetch the currently stored values, and (4) storing those fetched values in __beforeSaveData. This ensures the after-save comparison correctly identifies distribution/sharing_group_id changes.", "patchTruncated": false, "patches": [{"commit": "19a389d19f65e25ba3328e72e6ad23919a39ccd0", "date": "Wed, 23 Sep 2026 09:41:31 +0200", "patchSha256": "a23e99457b847b37183a6159eec9860f3cc8243bae000bc81cbd3449fa7aa225", "source": "https://github.com/MISP/MISP/commit/19a389d19.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/19a389d19.patch", "subject": "fix: [correlation] fix correlation distribution refresh on"}], "source": "https://github.com/MISP/MISP/commit/19a389d19.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-07T12:35:42Z", "version": "2.0.3"}, "subject": "fix: [correlation] fix correlation distribution refresh on", "tagVersionBoundary": {"commits_after_fix": 47, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-284", "rationale": "The core security impact is that correlation data access boundaries are not enforced when an event's sharing group or distribution changes. Stale correlations can expose event data to users who should no longer have access, constituting an improper access control failure."}, {"cweId": "CWE-665", "rationale": "The root cause is that the __beforeSaveData variable was initialized with the incoming (new) data rather than the previously stored data, causing the change-detection logic in afterSave to fail. This is a classic improper initialization of a state variable used for change detection."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (19a389d19f65e25ba3328e72e6ad23919a39ccd0): fix: [correlation] fix correlation distribution refresh on", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/19a389d19.patch"], "timestamp": "2026-09-23T07:41:31Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20264"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-07T14:39:59.827397Z", "id": "CVE-2026-107175", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T14:40:14.998Z"}}]}}

{}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["Event model (app/Model/Event.php)", "Correlation engine"], "product": "MISP", "programFiles": ["app/Model/Event.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified.\n\nWhen a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted.\n\nSecurity impact:\n\n- Stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure.\n\n- Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing.\n\nPreconditions:\n\n- An authenticated user with write access to at least one MISP event.\n\n- The user modifies the event's distribution or sharing_group_id field.\n\nAffected versions: <2.5.48"}], "id": "CVE-2026-107175", "lastModified": "2026-10-07T13:17:20.703", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}], "ssvcV203": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "ssvcData": {"options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "Supplier", "timestamp": "2026-10-07T12:35:42Z", "version": "2.0.3"}}]}, "published": "2026-10-07T13:17:20.563", "references": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "url": "https://github.com/MISP/MISP/commit/19a389d19"}], "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-665"}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}]}

{}

{}