CVE-2026-104908 (GCVE-0-2026-104908)
Vulnerability from cvelistv5 – Published: 2026-10-02 15:56 – Updated: 2026-10-02 16:19
VLAI
EPSS
VEX
Title
MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging
Summary
MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging exclusively to the importing user's organisation, with the default flag forced to off.
However, the application stripped only the top-level id and uuid fields and pinned org_id and default on the outer array before saving the data flat. A user with decaying-model permissions could supply a nested model key carrying its own primary key, organisation identifier, and default flag, which bypassed those guards during the save operation.
Impact:
- A user with perm_decaying could overwrite an existing decaying model belonging to another organisation in place, altering its name, formula, parameters, or ownership.
- A user could create or modify a model flagged as the organisation default, affecting scoring behaviour for other users.
- A user could reassign a model's organisation to an arbitrary value.
Preconditions:
- Authenticated user with decaying-model permission (perm_decaying).
- Network access to the MISP instance.
Affected: <2.5.48.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
Supplier · CIRCL (v2.0.3)
Decision recorded 2026-10-02 15:55 UTC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-02 16:18 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/70e319e4b | patch |
Impacted products
GCVE extensions
AI-generated
Human-reviewed
Confidence: high
Model
qwen3.8:27b
1 event
advisory
bcp-05-x-01bcp-05-x-02bcp-05-x-03
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-10-02 15:55 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/70e319e4b.patch
2ea9ae3603b6… - Confidence
- high
| Commit | Subject | Patch SHA-256 |
|---|---|---|
70e319e4b9db
|
fix: [security] Imported decaying models belong to the | 2ea9ae3603b6… |
Fix summary
The import handler now builds the model record from an explicit allow-list of permitted fields (name, parameters, description, ref, formula, version, enabled, all_orgs) using array_intersect_key, discarding any unlisted keys including nested model objects. The organisation identifier and default flag are set unconditionally after filtering. The save operation is preceded by an explicit create() call and the data is wrapped in the proper model key, preventing the ORM from interpreting attacker-supplied nested keys as separate model attributes.
Patch summary
In DecayingModelController::import(), the previous logic of unsetting id/uuid and pinning org_id/default on the flat array was replaced with an allow-list approach: array_intersect_key against a fixed set of importable fields, followed by explicit assignment of org_id from the authenticated user and default=0. A DecayingModel::create() call was added before save, and the save payload is now wrapped as array('DecayingModel' => $model) to bind the data to the correct model context. A regression test (DecayingModelImportOwnership) was added that verifies a nested DecayingModel key with a foreign id, org_id, and default=1 cannot overwrite or reassign an existing model.
CVSS rationale
AV:N - MISP is a network-accessible web application. AC:L - the attack requires only crafting a JSON payload with a nested key; no race condition or complex timing is needed. AT:N - no in-transit tampering required. PR:L - requires an authenticated user with perm_decaying, a low-privilege role. UI:N - no victim interaction needed. VC:N - no confidentiality impact; the attacker does not read data they cannot already access. VI:H - high integrity impact: an existing model belonging to another organisation can be overwritten in place, its ownership reassigned, or its default flag set, altering scoring for other users. VA:N - no availability impact. SC/SI/SA:N - the impact is confined to the MISP instance itself (same component); no secondary component is affected. Scope is not changed because both the vulnerable and impacted components are the MISP application and its data store.
Weakness rationale
- CWE-915 The import endpoint accepted user-supplied data and saved it without restricting which object attributes could be set. A nested model key allowed the attacker to modify the primary key, organisation, and default flag of a record, which are attributes that should be controlled exclusively by the application. This is a classic mass-assignment / improper dynamic attribute modification issue.
- CWE-285 The application failed to enforce that the imported model belongs to the caller's organisation. A user with only perm_decaying could modify records owned by other organisations, indicating an authorization boundary was not enforced on the object being written.
Attack pattern rationale
- CAPEC-13 The attacker tampers with the import request parameters by injecting a nested DecayingModel key containing unauthorized fields (id, org_id, default) that the application's top-level stripping did not filter. This is a direct form of parameter tampering where extra or modified parameters in the request bypass the intended input validation. The mapping is a close fit because the attack vector is manipulation of request parameters rather than a separate injection or protocol-level attack.
Assumptions to verify
- The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 21 commits after fix); the patch metadata does not explicitly state a fixed version string, so '< 2.5.48' is an analyst inference.
- The CAPEC-13 mapping is the closest available pattern; the attack is specifically a mass-assignment bypass via a nested model key rather than a generic parameter tampering, but no CAPEC entry precisely describes ORM-level mass assignment through nested keys.
- CVSS PR:L assumes perm_decaying is a low-privilege role available to many users; if it requires elevated privileges the score would be lower.
- The Co-Authored-By line references an AI assistant (Claude Opus 5); it is recorded as a tool credit, not a human remediation developer.
- No evidence of active exploitation or public PoC was found in the patch; SSVCE exploitation is set to 'none'.
- The patch does not specify authentication requirements beyond perm_decaying; it is assumed this is a standard MISP role rather than an admin-level permission.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
7 | 11 | high | 6 |
- 2026-09-25 12:22 UTC Fix developed Corrective change authored (70e319e4b9dbbeca173befce2340eedf9d86f1b0): fix: [security] Imported decaying models belong to the https://github.com/MISP/MISP/commit/70e319e4b.patch
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104908",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-02T16:18:57.561492Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T16:19:17.687Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"DecayingModelController"
],
"product": "MISP",
"programFiles": [
"app/Controller/DecayingModelController.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging exclusively to the importing user\u0027s organisation, with the default flag forced to off.\u003c/p\u003e\u003cp\u003eHowever, the application stripped only the top-level id and uuid fields and pinned org_id and default on the outer array before saving the data flat. A user with decaying-model permissions could supply a nested model key carrying its own primary key, organisation identifier, and default flag, which bypassed those guards during the save operation.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- A user with perm_decaying could overwrite an existing decaying model belonging to another organisation in place, altering its name, formula, parameters, or ownership.\u003c/p\u003e\u003cp\u003e- A user could create or modify a model flagged as the organisation default, affecting scoring behaviour for other users.\u003c/p\u003e\u003cp\u003e- A user could reassign a model\u0027s organisation to an arbitrary value.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- Authenticated user with decaying-model permission (perm_decaying).\u003c/p\u003e\u003cp\u003e- Network access to the MISP instance.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48.\u003c/p\u003e"
}
],
"value": "MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging exclusively to the importing user\u0027s organisation, with the default flag forced to off.\n\nHowever, the application stripped only the top-level id and uuid fields and pinned org_id and default on the outer array before saving the data flat. A user with decaying-model permissions could supply a nested model key carrying its own primary key, organisation identifier, and default flag, which bypassed those guards during the save operation.\n\nImpact:\n\n- A user with perm_decaying could overwrite an existing decaying model belonging to another organisation in place, altering its name, formula, parameters, or ownership.\n\n- A user could create or modify a model flagged as the organisation default, affecting scoring behaviour for other users.\n\n- A user could reassign a model\u0027s organisation to an arbitrary value.\n\nPreconditions:\n\n- Authenticated user with decaying-model permission (perm_decaying).\n\n- Network access to the MISP instance.\n\nAffected: \u003c2.5.48."
}
],
"impacts": [
{
"capecId": "CAPEC-13",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-13 Parameter Tampering"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-02T15:55:12Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T15:56:13.969Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/70e319e4b"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe import handler now builds the model record from an explicit allow-list of permitted fields (name, parameters, description, ref, formula, version, enabled, all_orgs) using array_intersect_key, discarding any unlisted keys including nested model objects. The organisation identifier and default flag are set unconditionally after filtering. The save operation is preceded by an explicit create() call and the data is wrapped in the proper model key, preventing the ORM from interpreting attacker-supplied nested keys as separate model attributes.\u003c/p\u003e"
}
],
"value": "The import handler now builds the model record from an explicit allow-list of permitted fields (name, parameters, description, ref, formula, version, enabled, all_orgs) using array_intersect_key, discarding any unlisted keys including nested model objects. The organisation identifier and default flag are set unconditionally after filtering. The save operation is preceded by an explicit create() call and the data is wrapped in the proper model key, preventing the ORM from interpreting attacker-supplied nested keys as separate model attributes."
}
],
"title": "MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 21 commits after fix); the patch metadata does not explicitly state a fixed version string, so \u0027\u003c 2.5.48\u0027 is an analyst inference.",
"The CAPEC-13 mapping is the closest available pattern; the attack is specifically a mass-assignment bypass via a nested model key rather than a generic parameter tampering, but no CAPEC entry precisely describes ORM-level mass assignment through nested keys.",
"CVSS PR:L assumes perm_decaying is a low-privilege role available to many users; if it requires elevated privileges the score would be lower.",
"The Co-Authored-By line references an AI assistant (Claude Opus 5); it is recorded as a tool credit, not a human remediation developer.",
"No evidence of active exploitation or public PoC was found in the patch; SSVCE exploitation is set to \u0027none\u0027.",
"The patch does not specify authentication requirements beyond perm_decaying; it is assumed this is a standard MISP role rather than an admin-level permission."
],
"capecRationale": [
{
"capecId": "CAPEC-13",
"rationale": "The attacker tampers with the import request parameters by injecting a nested DecayingModel key containing unauthorized fields (id, org_id, default) that the application\u0027s top-level stripping did not filter. This is a direct form of parameter tampering where extra or modified parameters in the request bypass the intended input validation. The mapping is a close fit because the attack vector is manipulation of request parameters rather than a separate injection or protocol-level attack."
}
],
"commit": "70e319e4b9dbbeca173befce2340eedf9d86f1b0",
"confidence": "high",
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5"
}
],
"cvssRationale": "AV:N - MISP is a network-accessible web application. AC:L - the attack requires only crafting a JSON payload with a nested key; no race condition or complex timing is needed. AT:N - no in-transit tampering required. PR:L - requires an authenticated user with perm_decaying, a low-privilege role. UI:N - no victim interaction needed. VC:N - no confidentiality impact; the attacker does not read data they cannot already access. VI:H - high integrity impact: an existing model belonging to another organisation can be overwritten in place, its ownership reassigned, or its default flag set, altering scoring for other users. VA:N - no availability impact. SC/SI/SA:N - the impact is confined to the MISP instance itself (same component); no secondary component is affected. Scope is not changed because both the vulnerable and impacted components are the MISP application and its data store.",
"fixSummary": "The import handler now builds the model record from an explicit allow-list of permitted fields (name, parameters, description, ref, formula, version, enabled, all_orgs) using array_intersect_key, discarding any unlisted keys including nested model objects. The organisation identifier and default flag are set unconditionally after filtering. The save operation is preceded by an explicit create() call and the data is wrapped in the proper model key, preventing the ORM from interpreting attacker-supplied nested keys as separate model attributes.",
"generatedAt": "2026-10-02T15:55:12.256144Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 6,
"confidence": "high",
"model": "qwen3.8:27b",
"score": 7
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "2ea9ae3603b60db40cddef05bf41462c4b235652ccd53d6e8a5596006232e59d",
"patchSummary": "In DecayingModelController::import(), the previous logic of unsetting id/uuid and pinning org_id/default on the flat array was replaced with an allow-list approach: array_intersect_key against a fixed set of importable fields, followed by explicit assignment of org_id from the authenticated user and default=0. A DecayingModel::create() call was added before save, and the save payload is now wrapped as array(\u0027DecayingModel\u0027 =\u003e $model) to bind the data to the correct model context. A regression test (DecayingModelImportOwnership) was added that verifies a nested DecayingModel key with a foreign id, org_id, and default=1 cannot overwrite or reassign an existing model.",
"patchTruncated": false,
"patches": [
{
"commit": "70e319e4b9dbbeca173befce2340eedf9d86f1b0",
"date": "Fri, 25 Sep 2026 14:22:03 +0200",
"patchSha256": "2ea9ae3603b60db40cddef05bf41462c4b235652ccd53d6e8a5596006232e59d",
"source": "https://github.com/MISP/MISP/commit/70e319e4b.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/70e319e4b.patch",
"subject": "fix: [security] Imported decaying models belong to the"
}
],
"source": "https://github.com/MISP/MISP/commit/70e319e4b.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-02T15:55:12Z",
"version": "2.0.3"
},
"subject": "fix: [security] Imported decaying models belong to the",
"tagVersionBoundary": {
"commits_after_fix": 21,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.48",
"version": "2.5.48",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-915",
"rationale": "The import endpoint accepted user-supplied data and saved it without restricting which object attributes could be set. A nested model key allowed the attacker to modify the primary key, organisation, and default flag of a record, which are attributes that should be controlled exclusively by the application. This is a classic mass-assignment / improper dynamic attribute modification issue."
},
{
"cweId": "CWE-285",
"rationale": "The application failed to enforce that the imported model belongs to the caller\u0027s organisation. A user with only perm_decaying could modify records owned by other organisations, indicating an authorization boundary was not enforced on the object being written."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (70e319e4b9dbbeca173befce2340eedf9d86f1b0): fix: [security] Imported decaying models belong to the",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/MISP/MISP/commit/70e319e4b.patch"
],
"timestamp": "2026-09-25T12:22:03Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20189"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-104908",
"datePublished": "2026-10-02T15:56:13.969Z",
"dateReserved": "2026-10-02T15:56:12.330Z",
"dateUpdated": "2026-10-02T16:19:17.687Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"DecayingModelController"
],
"product": "MISP",
"programFiles": [
"app/Controller/DecayingModelController.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging exclusively to the importing user\u0027s organisation, with the default flag forced to off.\n\nHowever, the application stripped only the top-level id and uuid fields and pinned org_id and default on the outer array before saving the data flat. A user with decaying-model permissions could supply a nested model key carrying its own primary key, organisation identifier, and default flag, which bypassed those guards during the save operation.\n\nImpact:\n\n- A user with perm_decaying could overwrite an existing decaying model belonging to another organisation in place, altering its name, formula, parameters, or ownership.\n\n- A user could create or modify a model flagged as the organisation default, affecting scoring behaviour for other users.\n\n- A user could reassign a model\u0027s organisation to an arbitrary value.\n\nPreconditions:\n\n- Authenticated user with decaying-model permission (perm_decaying).\n\n- Network access to the MISP instance.\n\nAffected: \u003c2.5.48."
}
],
"id": "CVE-2026-104908",
"lastModified": "2026-10-02T17:17:05.017",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"ssvcData": {
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-02T15:55:12Z",
"version": "2.0.3"
}
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-104908",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-02T16:18:57.561492Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-10-02T16:16:48.580",
"references": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"url": "https://github.com/MISP/MISP/commit/70e319e4b"
}
],
"sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-285"
},
{
"lang": "en",
"value": "CWE-915"
}
],
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104908",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-02T16:18:57.561492Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T16:19:08.415Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"DecayingModelController"
],
"product": "MISP",
"programFiles": [
"app/Controller/DecayingModelController.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging exclusively to the importing user\u0027s organisation, with the default flag forced to off.\u003c/p\u003e\u003cp\u003eHowever, the application stripped only the top-level id and uuid fields and pinned org_id and default on the outer array before saving the data flat. A user with decaying-model permissions could supply a nested model key carrying its own primary key, organisation identifier, and default flag, which bypassed those guards during the save operation.\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- A user with perm_decaying could overwrite an existing decaying model belonging to another organisation in place, altering its name, formula, parameters, or ownership.\u003c/p\u003e\u003cp\u003e- A user could create or modify a model flagged as the organisation default, affecting scoring behaviour for other users.\u003c/p\u003e\u003cp\u003e- A user could reassign a model\u0027s organisation to an arbitrary value.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- Authenticated user with decaying-model permission (perm_decaying).\u003c/p\u003e\u003cp\u003e- Network access to the MISP instance.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48.\u003c/p\u003e"
}
],
"value": "MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging exclusively to the importing user\u0027s organisation, with the default flag forced to off.\n\nHowever, the application stripped only the top-level id and uuid fields and pinned org_id and default on the outer array before saving the data flat. A user with decaying-model permissions could supply a nested model key carrying its own primary key, organisation identifier, and default flag, which bypassed those guards during the save operation.\n\nImpact:\n\n- A user with perm_decaying could overwrite an existing decaying model belonging to another organisation in place, altering its name, formula, parameters, or ownership.\n\n- A user could create or modify a model flagged as the organisation default, affecting scoring behaviour for other users.\n\n- A user could reassign a model\u0027s organisation to an arbitrary value.\n\nPreconditions:\n\n- Authenticated user with decaying-model permission (perm_decaying).\n\n- Network access to the MISP instance.\n\nAffected: \u003c2.5.48."
}
],
"impacts": [
{
"capecId": "CAPEC-13",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-13 Parameter Tampering"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-02T15:55:12Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T15:56:13.969Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/70e319e4b"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe import handler now builds the model record from an explicit allow-list of permitted fields (name, parameters, description, ref, formula, version, enabled, all_orgs) using array_intersect_key, discarding any unlisted keys including nested model objects. The organisation identifier and default flag are set unconditionally after filtering. The save operation is preceded by an explicit create() call and the data is wrapped in the proper model key, preventing the ORM from interpreting attacker-supplied nested keys as separate model attributes.\u003c/p\u003e"
}
],
"value": "The import handler now builds the model record from an explicit allow-list of permitted fields (name, parameters, description, ref, formula, version, enabled, all_orgs) using array_intersect_key, discarding any unlisted keys including nested model objects. The organisation identifier and default flag are set unconditionally after filtering. The save operation is preceded by an explicit create() call and the data is wrapped in the proper model key, preventing the ORM from interpreting attacker-supplied nested keys as separate model attributes."
}
],
"title": "MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 21 commits after fix); the patch metadata does not explicitly state a fixed version string, so \u0027\u003c 2.5.48\u0027 is an analyst inference.",
"The CAPEC-13 mapping is the closest available pattern; the attack is specifically a mass-assignment bypass via a nested model key rather than a generic parameter tampering, but no CAPEC entry precisely describes ORM-level mass assignment through nested keys.",
"CVSS PR:L assumes perm_decaying is a low-privilege role available to many users; if it requires elevated privileges the score would be lower.",
"The Co-Authored-By line references an AI assistant (Claude Opus 5); it is recorded as a tool credit, not a human remediation developer.",
"No evidence of active exploitation or public PoC was found in the patch; SSVCE exploitation is set to \u0027none\u0027.",
"The patch does not specify authentication requirements beyond perm_decaying; it is assumed this is a standard MISP role rather than an admin-level permission."
],
"capecRationale": [
{
"capecId": "CAPEC-13",
"rationale": "The attacker tampers with the import request parameters by injecting a nested DecayingModel key containing unauthorized fields (id, org_id, default) that the application\u0027s top-level stripping did not filter. This is a direct form of parameter tampering where extra or modified parameters in the request bypass the intended input validation. The mapping is a close fit because the attack vector is manipulation of request parameters rather than a separate injection or protocol-level attack."
}
],
"commit": "70e319e4b9dbbeca173befce2340eedf9d86f1b0",
"confidence": "high",
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5"
}
],
"cvssRationale": "AV:N - MISP is a network-accessible web application. AC:L - the attack requires only crafting a JSON payload with a nested key; no race condition or complex timing is needed. AT:N - no in-transit tampering required. PR:L - requires an authenticated user with perm_decaying, a low-privilege role. UI:N - no victim interaction needed. VC:N - no confidentiality impact; the attacker does not read data they cannot already access. VI:H - high integrity impact: an existing model belonging to another organisation can be overwritten in place, its ownership reassigned, or its default flag set, altering scoring for other users. VA:N - no availability impact. SC/SI/SA:N - the impact is confined to the MISP instance itself (same component); no secondary component is affected. Scope is not changed because both the vulnerable and impacted components are the MISP application and its data store.",
"fixSummary": "The import handler now builds the model record from an explicit allow-list of permitted fields (name, parameters, description, ref, formula, version, enabled, all_orgs) using array_intersect_key, discarding any unlisted keys including nested model objects. The organisation identifier and default flag are set unconditionally after filtering. The save operation is preceded by an explicit create() call and the data is wrapped in the proper model key, preventing the ORM from interpreting attacker-supplied nested keys as separate model attributes.",
"generatedAt": "2026-10-02T15:55:12.256144Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 6,
"confidence": "high",
"model": "qwen3.8:27b",
"score": 7
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "2ea9ae3603b60db40cddef05bf41462c4b235652ccd53d6e8a5596006232e59d",
"patchSummary": "In DecayingModelController::import(), the previous logic of unsetting id/uuid and pinning org_id/default on the flat array was replaced with an allow-list approach: array_intersect_key against a fixed set of importable fields, followed by explicit assignment of org_id from the authenticated user and default=0. A DecayingModel::create() call was added before save, and the save payload is now wrapped as array(\u0027DecayingModel\u0027 =\u003e $model) to bind the data to the correct model context. A regression test (DecayingModelImportOwnership) was added that verifies a nested DecayingModel key with a foreign id, org_id, and default=1 cannot overwrite or reassign an existing model.",
"patchTruncated": false,
"patches": [
{
"commit": "70e319e4b9dbbeca173befce2340eedf9d86f1b0",
"date": "Fri, 25 Sep 2026 14:22:03 +0200",
"patchSha256": "2ea9ae3603b60db40cddef05bf41462c4b235652ccd53d6e8a5596006232e59d",
"source": "https://github.com/MISP/MISP/commit/70e319e4b.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/70e319e4b.patch",
"subject": "fix: [security] Imported decaying models belong to the"
}
],
"source": "https://github.com/MISP/MISP/commit/70e319e4b.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-02T15:55:12Z",
"version": "2.0.3"
},
"subject": "fix: [security] Imported decaying models belong to the",
"tagVersionBoundary": {
"commits_after_fix": 21,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.48",
"version": "2.5.48",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-915",
"rationale": "The import endpoint accepted user-supplied data and saved it without restricting which object attributes could be set. A nested model key allowed the attacker to modify the primary key, organisation, and default flag of a record, which are attributes that should be controlled exclusively by the application. This is a classic mass-assignment / improper dynamic attribute modification issue."
},
{
"cweId": "CWE-285",
"rationale": "The application failed to enforce that the imported model belongs to the caller\u0027s organisation. A user with only perm_decaying could modify records owned by other organisations, indicating an authorization boundary was not enforced on the object being written."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (70e319e4b9dbbeca173befce2340eedf9d86f1b0): fix: [security] Imported decaying models belong to the",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/MISP/MISP/commit/70e319e4b.patch"
],
"timestamp": "2026-09-25T12:22:03Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20189"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-104908",
"datePublished": "2026-10-02T15:56:13.969Z",
"dateReserved": "2026-10-02T15:56:12.330Z",
"dateUpdated": "2026-10-02T16:19:17.687Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…