CVE-2026-104910— MISP 事件列表绕过权限导致信息泄露漏洞
一分钟漏洞结论
影响对象
MISP MISP
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
MISP 在“相关事件列表”功能中存在授权绕过漏洞。当用户请求获取与某一给定事件相关联的事件列表时，系统直接从关联表中检索相关事件的元数据，而未针对每个相关事件重新验证调用者的访问权限。 关联表在创建关联时，会保存该事件的共享级别（distribution level）和共享组（sharing group）的快照，且不包含“已发布”（published）标志位。因此，即使用户无权访问某些事件（例如这些事件尚未发布，或自关联记录创建以来其共享级别或共享组已发生变更），系统仍会返回这些事件的元数据（包括标题、日期及相关
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-104910 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization
来源: CVE Program / CVE List V5
Vulnerability Description
MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved related event metadata directly from the correlation table without re-validating the caller's access rights against each related event.
The correlation table stores a snapshot of the event's distribution level and sharing group at the time the correlation was created, and does not carry the published flag. As a result, events that the caller is not permitted to open—because they are unpublished, or because their distribution or sharing group has changed since the correlation was recorded—were still returned with their metadata (title, date, correlating value counts).
Preconditions:
- An authenticated user with access to at least one event in MISP.
- The existence of correlation entries linking that event to other events the user should not be able to view.
Impact:
- Unauthorized disclosure of event metadata (titles, dates, correlation counts) for events the user has no right to access.
- Potential reconnaissance of threat-intelligence event names and timelines across sharing groups.
Affected: MISP versions prior to the fix commit (2ffa97f05).
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-104910 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-104910 的情报信息
请登录查看更多情报信息。
CVE-2026-104910 补丁与修复 (1)
同批安全公告 · MISP · 2026-10-02 · 共 8 条
| CVE-2026-104908 | 7.1 HIGH | MISP衰减模型导入存在越权覆盖及默认标记漏洞 |
| CVE-2026-104912 | 7.1 HIGH | MISP 关联认证绕过致敏感数据泄露 |
| CVE-2026-104906 | 6.2 MEDIUM | MISP TAXII Object Viewer 存储型跨站脚本漏洞 |
| CVE-2026-104900 | 5.3 MEDIUM | MISP 远程事件预览索引未转义计数字段存储型XSS漏洞 |
| CVE-2026-104914 | 5.3 MEDIUM | MISP 软件被删属性通过搜索和分页视图暴露漏洞 |
| CVE-2026-104901 | 5.1 MEDIUM | MISP ID Translator 远程事件 ID 未转义导致跨站脚本漏洞 |
| CVE-2026-104907 | 4.8 MEDIUM | MISP 事件预览内联处理程序远程标签ID JavaScript注入漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-104910
暂无评论