Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104908— MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging

Quick assessment

Affected
MISP MISP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MISP 在衰减模型（decaying model）导入功能中存在不正确的输入验证漏洞。导入端点本意是创建一个仅属于导入用户所属组织的衰减模型，并将默认标志（default flag）强制设置为关闭状态。 然而，应用程序仅在保存扁平化数据前剥离了顶层的 和 字段，并将外层数组中的 （组织标识）和 （默认标志）固定，但未对嵌套结构进行充分校验。具有衰减模型权限的用户可以提供一个包含其自身主键、组织标识符和默认标志的嵌套模型键（nested model key），从而绕过保存操作中的这些安全限制。 影响： 拥有 权限的

CVSS 7.1 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
MISP MISP < 2.5.48 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104908

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging
Source: CVE Program / CVE List V5
Vulnerability Description
MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging exclusively to the importing user's organisation, with the default flag forced to off. However, the application stripped only the top-level id and uuid fields and pinned org_id and default on the outer array before saving the data flat. A user with decaying-model permissions could supply a nested model key carrying its own primary key, organisation identifier, and default flag, which bypassed those guards during the save operation. Impact: - A user with perm_decaying could overwrite an existing decaying model belonging to another organisation in place, altering its name, formula, parameters, or ownership. - A user could create or modify a model flagged as the organisation default, affecting scoring behaviour for other users. - A user could reassign a model's organisation to an arbitrary value. Preconditions: - Authenticated user with decaying-model permission (perm_decaying). - Network access to the MISP instance. Affected: <2.5.48.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-915
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MISP MISP 0 ~ 2.5.48 cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-104908

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104908

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-104908 (1)

Same Patch Batch · MISP · 2026-10-02 · 8 CVEs total

CVE-2026-104912 7.1 HIGH MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data
CVE-2026-104906 6.2 MEDIUM MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output
CVE-2026-104900 5.3 MEDIUM MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index
CVE-2026-104910 5.3 MEDIUM MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization
CVE-2026-104914 5.3 MEDIUM MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Pa
CVE-2026-104901 5.1 MEDIUM MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Serv
CVE-2026-104907 4.8 MEDIUM MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler

IV. Related Vulnerabilities

Same product: MISP
Same vendor: MISP
Same weakness: CWE-915

V. Comments for CVE-2026-104908

No comments yet

Leave a comment