CVE-2026-103239 (GCVE-0-2026-103239)

Vulnerability from cvelistv5 – Published: 2026-09-30 10:16 – Updated: 2026-09-30 16:50
VLAI
Title
MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection
Summary
MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any associated model data present in the payload. A user holding the tag editor permission could craft a request that includes additional model data (such as User or Organisation records) alongside the tag collection fields. Because the save operation processed all associated models indiscriminately, the injected sibling records were written to the database, enabling the attacker to modify or create privileged accounts and escalate to site administrator. Preconditions: - An authenticated account with the tag editor permission (perm_tag_editor) - Network access to the MISP instance Impact: - Unauthorized creation or modification of User and Organisation records - Privilege escalation from tag editor to site administrator Affected versions: < 2.5.48
Severity
8.6 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 16:49 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
MISP MISP Affected: 0 , < 2.5.48 (semver)
    cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Jeroen Pinoy iglocska Claude Opus 4.8
GCVE extensions
AI involvement GCVE-BCP-05-X-01
Whole record AI-generated Human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
Patch provenance GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-09-30 09:58
Model
qwen3.8:27b
Input
https://github.com/MISP/MISP/commit/96f735e7b.patch 67f9b5741b88…
Confidence
high
Commit Subject Patch SHA-256
96f735e7b5d9 fix: [security] Tag collection saves no longer write sibling 67f9b5741b88…
Fix summary

The fix replaces the bulk-association save call with an explicit two-step process: first, only the TagCollection data is extracted from the request and saved via a plain save() operation that does not write belongsTo siblings; second, tag association rows are persisted individually in a controlled loop. This ensures that any User, Organisation, or other sibling model data present in the request payload is silently discarded and never reaches the database, eliminating the privilege escalation path.

Patch summary

In TagCollectionsController.php, both addWithTags() and editWithTags() were modified. The full $this->request->data is no longer passed to saveAssociated(). Instead, only the TagCollection key is extracted from the request. The saveAssociated() call is replaced with a plain save() for the collection, followed by an explicit loop that creates and saves each TagCollectionTag row individually. In editWithTags(), the tag rewrite logic is restructured to delete existing tag associations and re-insert them after the collection save. REST success/failure response handling is added to both methods.

CVSS rationale

The vulnerability is exploitable over the network (AV:N) with low complexity (AC:L) by simply adding extra fields to a legitimate tag collection request. No special attack conditions are required (AT:N). The attacker needs an authenticated account with the tag editor permission (PR:L). No user interaction is needed (UI:N). The primary impact is on integrity (VI:H) because the attacker can create or modify User and Organisation records to escalate to site admin. Modifications can be made so data can be see (VC:H) but no availability impact (VA:N). No subsequent component is affected (SC:N, SI:N, SA:N).

Weakness rationale
  • CWE-284 A user with only tag editor permissions was able to write to User and Organisation records through the bulk-association save, bypassing the intended access control boundaries. The authorization model did not restrict which associated models could be persisted.
  • CWE-862 The saveAssociated() call did not enforce per-model authorization checks, allowing any associated model data in the payload to be written regardless of the caller's permissions for those models.
Attack pattern rationale
  • CAPEC-126 The attacker tampers with the HTTP request by injecting additional model fields (User, Organisation) into the tag collection payload. The application's bulk-save logic processes these unexpected parameters without filtering, leading to unauthorized record creation or modification. This is the closest CAPEC to the observed attack: adding extra parameters to a legitimate request to trigger unintended side effects.
  • CAPEC-1 The application accepted the entire request body without validating or restricting which model keys were present before passing it to the persistence layer. This is a secondary mapping; CAPEC-126 is more specific to the parameter-injection attack vector observed here.
Assumptions to verify
  • The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48 with 24 commits after fix), suggesting the fix is included in v2.5.48. No explicit version range is stated in the patch itself.
  • The privilege level required is assumed to be 'perm_tag_editor' based on the commit message; the exact permission model and whether other roles are affected is not fully verifiable from the patch alone.
  • CAPEC-126 (Parameter Tampering) is selected as the closest match; the attack is more precisely a mass-assignment / sibling-model injection via an ORM bulk-save, for which no exact CAPEC exists. CAPEC-126 is the best available approximation.
  • The CVSS assumes the attacker can reach the MISP web interface over the network and holds a valid session with tag editor permissions. No multi-step or race-condition requirements are evident.
  • The Co-Authored-By line references an AI assistant (Claude Opus 4.8); it is credited as a tool rather than a human remediation developer.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 6 9 high 5
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-103239",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T16:49:52.252773Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T16:50:57.400Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "TagCollectionsController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/TagCollectionsController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.48",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any associated model data present in the payload.\u003c/p\u003e\u003cp\u003eA user holding the tag editor permission could craft a request that includes additional model data (such as User or Organisation records) alongside the tag collection fields. Because the save operation processed all associated models indiscriminately, the injected sibling records were written to the database, enabling the attacker to modify or create privileged accounts and escalate to site administrator.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- An authenticated account with the tag editor permission (perm_tag_editor)\u003c/p\u003e\u003cp\u003e- Network access to the MISP instance\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Unauthorized creation or modification of User and Organisation records\u003c/p\u003e\u003cp\u003e- Privilege escalation from tag editor to site administrator\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt; 2.5.48\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any associated model data present in the payload.\n\nA user holding the tag editor permission could craft a request that includes additional model data (such as User or Organisation records) alongside the tag collection fields. Because the save operation processed all associated models indiscriminately, the injected sibling records were written to the database, enabling the attacker to modify or create privileged accounts and escalate to site administrator.\n\nPreconditions:\n\n- An authenticated account with the tag editor permission (perm_tag_editor)\n\n- Network access to the MISP instance\n\nImpact:\n\n- Unauthorized creation or modification of User and Organisation records\n\n- Privilege escalation from tag editor to site administrator\n\nAffected versions: \u003c 2.5.48"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Parameter Tampering"
            }
          ]
        },
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Improper Input Validation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T10:16:18.835Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/96f735e7b"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix replaces the bulk-association save call with an explicit two-step process: first, only the TagCollection data is extracted from the request and saved via a plain save() operation that does not write belongsTo siblings; second, tag association rows are persisted individually in a controlled loop. This ensures that any User, Organisation, or other sibling model data present in the request payload is silently discarded and never reaches the database, eliminating the privilege escalation path.\u003c/p\u003e"
            }
          ],
          "value": "The fix replaces the bulk-association save call with an explicit two-step process: first, only the TagCollection data is extracted from the request and saved via a plain save() operation that does not write belongsTo siblings; second, tag association rows are persisted individually in a controlled loop. This ensures that any User, Organisation, or other sibling model data present in the request payload is silently discarded and never reaches the database, eliminating the privilege escalation path."
        }
      ],
      "title": "MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48 with 24 commits after fix), suggesting the fix is included in v2.5.48. No explicit version range is stated in the patch itself.",
                  "The privilege level required is assumed to be \u0027perm_tag_editor\u0027 based on the commit message; the exact permission model and whether other roles are affected is not fully verifiable from the patch alone.",
                  "CAPEC-126 (Parameter Tampering) is selected as the closest match; the attack is more precisely a mass-assignment / sibling-model injection via an ORM bulk-save, for which no exact CAPEC exists. CAPEC-126 is the best available approximation.",
                  "The CVSS assumes the attacker can reach the MISP web interface over the network and holds a valid session with tag editor permissions. No multi-step or race-condition requirements are evident.",
                  "The Co-Authored-By line references an AI assistant (Claude Opus 4.8); it is credited as a tool rather than a human remediation developer."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The attacker tampers with the HTTP request by injecting additional model fields (User, Organisation) into the tag collection payload. The application\u0027s bulk-save logic processes these unexpected parameters without filtering, leading to unauthorized record creation or modification. This is the closest CAPEC to the observed attack: adding extra parameters to a legitimate request to trigger unintended side effects."
                  },
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "The application accepted the entire request body without validating or restricting which model keys were present before passing it to the persistence layer. This is a secondary mapping; CAPEC-126 is more specific to the parameter-injection attack vector observed here."
                  }
                ],
                "commit": "96f735e7b5d9e28ea2eaf3d8a02ab800bad5c9ed",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  }
                ],
                "cvssRationale": "The vulnerability is exploitable over the network (AV:N) with low complexity (AC:L) by simply adding extra fields to a legitimate tag collection request. No special attack conditions are required (AT:N). The attacker needs an authenticated account with the tag editor permission (PR:L). No user interaction is needed (UI:N). The primary impact is on integrity (VI:H) because the attacker can create or modify User and Organisation records to escalate to site admin. Modifications can be made so data can be see (VC:H) but no availability impact (VA:N). No subsequent component is affected (SC:N, SI:N, SA:N).",
                "fixSummary": "The fix replaces the bulk-association save call with an explicit two-step process: first, only the TagCollection data is extracted from the request and saved via a plain save() operation that does not write belongsTo siblings; second, tag association rows are persisted individually in a controlled loop. This ensures that any User, Organisation, or other sibling model data present in the request payload is silently discarded and never reaches the database, eliminating the privilege escalation path.",
                "generatedAt": "2026-09-30T09:58:24.508004Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "67f9b5741b88384cd891423b2a8b9f5c8e071b5895b93eb337a16c7f780ee88c",
                "patchSummary": "In TagCollectionsController.php, both addWithTags() and editWithTags() were modified. The full $this-\u003erequest-\u003edata is no longer passed to saveAssociated(). Instead, only the TagCollection key is extracted from the request. The saveAssociated() call is replaced with a plain save() for the collection, followed by an explicit loop that creates and saves each TagCollectionTag row individually. In editWithTags(), the tag rewrite logic is restructured to delete existing tag associations and re-insert them after the collection save. REST success/failure response handling is added to both methods.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "96f735e7b5d9e28ea2eaf3d8a02ab800bad5c9ed",
                    "patchSha256": "67f9b5741b88384cd891423b2a8b9f5c8e071b5895b93eb337a16c7f780ee88c",
                    "source": "https://github.com/MISP/MISP/commit/96f735e7b.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/96f735e7b.patch",
                    "subject": "fix: [security] Tag collection saves no longer write sibling"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/96f735e7b.patch",
                "subject": "fix: [security] Tag collection saves no longer write sibling",
                "tagVersionBoundary": {
                  "commits_after_fix": 24,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.48",
                  "version": "2.5.48",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-284",
                    "rationale": "A user with only tag editor permissions was able to write to User and Organisation records through the bulk-association save, bypassing the intended access control boundaries. The authorization model did not restrict which associated models could be persisted."
                  },
                  {
                    "cweId": "CWE-862",
                    "rationale": "The saveAssociated() call did not enforce per-model authorization checks, allowing any associated model data in the payload to be written regardless of the caller\u0027s permissions for those models."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20019"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-103239",
    "datePublished": "2026-09-30T10:16:18.835Z",
    "dateReserved": "2026-09-30T10:16:15.941Z",
    "dateUpdated": "2026-09-30T16:50:57.400Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
                ],
                "modules": [
                  "TagCollectionsController"
                ],
                "product": "MISP",
                "programFiles": [
                  "app/Controller/TagCollectionsController.php"
                ],
                "repo": "https://github.com/MISP/MISP",
                "vendor": "MISP",
                "versions": [
                  {
                    "lessThan": "2.5.48",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any associated model data present in the payload.\n\nA user holding the tag editor permission could craft a request that includes additional model data (such as User or Organisation records) alongside the tag collection fields. Because the save operation processed all associated models indiscriminately, the injected sibling records were written to the database, enabling the attacker to modify or create privileged accounts and escalate to site administrator.\n\nPreconditions:\n\n- An authenticated account with the tag editor permission (perm_tag_editor)\n\n- Network access to the MISP instance\n\nImpact:\n\n- Unauthorized creation or modification of User and Organisation records\n\n- Privilege escalation from tag editor to site administrator\n\nAffected versions: \u003c 2.5.48"
          }
        ],
        "id": "CVE-2026-103239",
        "lastModified": "2026-09-30T17:16:42.360",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-103239",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T16:49:52.252773Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-30T11:16:43.527",
        "references": [
          {
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "url": "https://github.com/MISP/MISP/commit/96f735e7b"
          }
        ],
        "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-284"
              },
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.