CVE-2026-10863
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
In the over-correlations endpoint of MISP, the order parameter was accepted from user-controlled request parameters, allowing an authenticated attacker to override server-side ordering. This could lead to database query manipulation.
Risk Assessment
An attacker can influence query ordering, potentially enabling unauthorized data access or SQL manipulation.
Recommendation
Apply the patch that removes order from user-controlled parameters and sets server-side ordering.
Other vulnerabilities in MISP
See all- CVE-2026-61474Medium
An improper authorization check in MISP's attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharing_group_id without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly set to 4 — 'sharing group'.
- CVE-2017-14337High
In MISP versions before 2.4.80, when configured with X.509 certificate authentication alongside a non-MISP external user management API, an unauthenticated user can gain access as an arbitrary user if the API returns an empty value.
- CVE-2026-10868Critical
MISP has a mass assignment vulnerability in the user edit functionality (UsersController::edit()). An authenticated attacker can modify the user ID in the request, leading to updates on another user's account.
- CVE-2026-10611Critical
MISP contains an authentication bypass vulnerability when LDAP mixed authentication is enabled with OTP enforcement. An authenticated user can bypass the OTP step and access the application without providing a TOTP, HOTP, or email OTP code.
- CVE-2024-29859Critical
In MISP before version 2.4.187, the add_misp_export function in app/Controller/EventsController.php does not properly check for a valid file upload.
- CVE-2024-25674Critical
An issue was discovered in MISP before version 2.4.184 related to insecure organization logo uploads due to a lack of checks for file extension and MIME type.
- CVE-2023-50918Critical
In app/Controller/AuditLogsController.php in MISP before version 2.4.182, ACLs for audit logs are mishandled.
- CVE-2023-48659Critical
An issue was discovered in MISP before version 2.4.176 related to mishandling parameter parsing in app/Controller/AppController.php.
- CVE-2022-29528Critical
An issue was discovered in MISP before version 2.4.158 related to PHAR deserialization.
- CVE-2021-39302Critical
MISP version 2.4.148, in certain configurations, allows SQL injection via the $conditions['org'] value in the app/Model/Log.php file.
Original NVD description (English source)
A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value was processed by the underlying data access layer, this could allow manipulation of database query ordering and potentially expose the application to unsafe query construction. The patch removes order from the set of request-controlled parameters and instead sets the ordering server-side to occurrence desc after processing allowed user parameters. Affected component: app/Controller/CorrelationsController.php, overCorrelations() Security impact: An authenticated attacker could influence the ordering clause used by the over-correlations query. The direct impact appears limited to query manipulation unless further evidence confirms SQL injection or unauthorized data exposure through the manipulated ordering expression.