Quick answers
- Is CVE-2026-104912 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-104912 being exploited in the wild.
- How severe is CVE-2026-104912?
- Informational severity, published 2 October 2026.
- Which products and versions are affected?
- Misp prior to v2.5.48.
- Is there a fix for CVE-2026-104912?
- Yes: fixed in MISP v2.5.48. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-104912 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-104912?
- Check whether you run Misp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: MISP v2.5.48
Technical details
The vulnerability exists in MISP's correlation authorization logic during attribute searches. When correlation lookups are triggered, the system checks access permissions against a stale point-in-time copy of the event distribution stored on the correlation row, rather than the current live event access control list. Since the correlation row lacks a published flag, when an event is subsequently restricted (sharing group changed, unpublished), the outdated distribution snapshot no longer accurately reflects current permissions, allowing authenticated users to access attributes and event details they should not reach.
Affected products
- MISP MISP prior to v2.5.48
Timeline
- 2026-10-02: disclosed