# CVE-2026-104912: MISP authorization flaw in correlation handling

Source: https://junglewise.ai/threats/cve-2026-104912-misp-contains-an-authorization-flaw-in-its-correlation-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-104912 · Severity: info · Published 2026-10-02

MISP is a threat intelligence platform that helps organizations share and analyze malware and threat data. An authorization flaw in attribute search and correlation handling allows authenticated users to access event details and attributes they no longer have permission to view, even after the event's access restrictions have been changed. This could expose sensitive threat intelligence and event metadata to unauthorized users within the same instance.

Technologies: [Misp](https://junglewise.ai/threats/technologies/misp). Vendors: [Misp](https://junglewise.ai/threats/vendors/misp).

## Quick answers

**Is CVE-2026-104912 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104912 being exploited in the wild.

**How severe is CVE-2026-104912?** Informational severity, published 2 October 2026.

**Which products and versions are affected?** Misp prior to v2.5.48.

**Is there a fix for CVE-2026-104912?** Yes: fixed in MISP v2.5.48. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104912 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-104912?** Check whether you run Misp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in MISP v2.5.48

## Technical details

The vulnerability exists in MISP's correlation authorization logic during attribute searches. When correlation lookups are triggered, the system checks access permissions against a stale point-in-time copy of the event distribution stored on the correlation row, rather than the current live event access control list. Since the correlation row lacks a published flag, when an event is subsequently restricted (sharing group changed, unpublished), the outdated distribution snapshot no longer accurately reflects current permissions, allowing authenticated users to access attributes and event details they should not reach.

## Affected products

- MISP MISP prior to v2.5.48

## Timeline

- 2026-10-02: disclosed

## References

- [https://github.com/MISP/MISP/commit/100235bd9](https://github.com/MISP/MISP/commit/100235bd9)

## Related threats

- [MISP CSS injection in remote event preview](https://junglewise.ai/threats/cve-2026-112183-misp-contains-a-css-injection-vulnerability-in-the-remote-event)
- [MISP access control flaw in proposal visibility logic](https://junglewise.ai/threats/cve-2026-112178-misp-contains-an-access-control-flaw-in-the-proposal-shadow)
- [MISP improper input validation in decaying model import](https://junglewise.ai/threats/cve-2026-104908-misp-contains-an-improper-input-validation-vulnerability-in-the)
- [MISP reflected XSS in taxonomy tag confirmation forms](https://junglewise.ai/threats/cve-2026-103662-misp-contains-a-reflected-cross-site-scripting-xss-vulnerability)
- [MISP TOTP verification code reuse vulnerability](https://junglewise.ai/threats/cve-2026-103655-misp-contains-a-vulnerability-in-its-two-factor-authentication)