CVE-2026-104914 MISP 访问控制不当漏洞
影响已认证用户可越权查看其他组织的软删除威胁情报属性
MISP 的属性搜索与分页属性视图接口存在访问控制不当问题。当用户查询软删除属性时，应用会将属于其他组织事件的软删除属性返回给任何对该事件有可见性的已认证用户。事件详情视图正确限制了软删除属性的可见范围，但属性搜索和分页视图代码路径缺少该限制。
影响范围
漏洞详情
漏洞类型为访问控制不当（越权信息泄露）。成因是属性搜索与分页属性列表接口在返回软删除属性时，未像事件详情视图那样校验属性所属组织及同步权限。攻击者只需以已认证用户身份，对可见的他人事件发起带 deleted 过滤条件的搜索或分页查询，即可获取本应仅限所属组织可见的软删除属性。
利用条件与风险
利用前提是攻击者拥有至少对他人组织事件的读取权限，并能发起软删除属性查询。实战中可导致其他组织已撤回的 IOC、指标及上下文等敏感威胁情报泄露。
修复建议
官方已在 MISP v2.5.48 中修复，建议升级至该版本或更高版本。临时缓解措施暂无公开信息。
MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints.
When a user queries for soft-deleted attributes (e.g., via the deleted-attributes search or the paginated attribute listing), the application returned soft-deleted attributes belonging to events owned by other organizations to any authenticated user who had visibility of the event. The event detail view correctly restricted soft-deleted attribute visibility to the owning organization and sync-permission users, but the attribute search and paginated view code paths lacked this restriction.
Preconditions:
– An authenticated MISP user with at least read access to an event owned by another organization.
– The user issues a query for deleted attributes (search or paginated view with the deleted filter).
Impact:
– Confidentiality: Soft-deleted threat intelligence attributes (e.g., IOCs, indicators, context) from other organizations are disclosed to unauthorized users. This may expose sensitive intelligence that the owning organization intended to remove from general visibility.
Affected versions: MISP versions prior to v2.5.48.