CVE-2026-103235— MISP事件委托批量赋值导致重定向漏洞
一分钟漏洞结论
影响对象
MISP MISP
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
MISP 的事件委派（event delegation）功能中存在一个批量赋值（mass assignment）漏洞。当拥有委派权限的用户提交委派请求时，应用程序虽然会根据 URL 中指定的事件对用户进行授权检查，但随后却持久化了整个提交的记录，包括由调用方提供的字段（如主键和 event_id）。 经过身份验证的攻击者可以在委派请求的有效载荷中注入特定的主键或 event_id，从而将现有的委派记录重新指向实例中的任意事件。由于委派记录会授予请求方组织对所引用事件的读取权限，这实际上使得攻击者能够获取属于其他组织
可能的 ATT&CK 技术 1 AI
T1078 · Valid Accounts
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-103235 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events
来源: CVE Program / CVE List V5
Vulnerability Description
MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submitted record, including caller-supplied fields such as the primary key and event_id.
An authenticated attacker could inject a primary key or event_id into the delegation payload to retarget an existing delegation record to any event on the instance. Because a delegation row grants the requesting organisation read access to the event it references, this effectively granted read access to arbitrary events belonging to other organisations. If the target organisation subsequently accepted the delegation, ownership of the event was transferred and the original record was deleted.
Preconditions:
- An authenticated user with the delegation permission (perm_delegate)
- The MISP.delegation server setting must be enabled
Impact:
- Confidentiality: read access to any event on the instance
- Integrity: overwriting existing delegation records and transferring event ownership
Affected versions: MISP < 2.5.48
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
CWE-915
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-103235 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-103235 的情报信息
请登录查看更多情报信息。
CVE-2026-103235 其他参考 (1)
同批安全公告 · MISP · 2026-09-30 · 共 4 条
| CVE-2026-103239 | 8.6 HIGH | MISP 标签保存权限提升漏洞 |
| CVE-2026-103237 | 8.3 HIGH | MISP 嵌套模型别名绕过消毒跨租户修改漏洞 |
| CVE-2026-103321 | 8.3 HIGH | MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image |
IV. Related Vulnerabilities
V. Comments for CVE-2026-103235
暂无评论