Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112180— MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records

Quick assessment

Affected
MISP MISP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MISP 的事件删除逻辑中存在数据完整性缺陷。当用户删除某个事件时，部分关联记录未被从数据库中移除，从而形成孤立条目。受影响的记录类型包括：事件报告标签、事件图谱条目、提案（阴影属性）关联、模糊 ssdeep 关联块以及附件扫描结果。 这些孤立记录可能包含敏感的威胁情报数据，例如关联映射、扫描结果和报告元数据，本应随父事件一并删除。此类记录在预期删除生命周期之外持续存在，可能导致数据被意外保留，并可能通过其他应用程序查询或管理接口被访问，从而引发信息泄露风险。 前置条件： 拥有足够权限删除 MISP 中事件的已认证

CVSS 5.1 · Medium EPSS 0.33% · P25

Affected Version Matrix 1

VendorProduct Version RangeStatus
MISP MISP ≤ 2.5.48 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112180

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records
Source: CVE Program / CVE List V5
Vulnerability Description
MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal (shadow attribute) correlations, fuzzy ssdeep correlation chunks, and attachment scan results. These orphaned records may contain sensitive threat intelligence data such as correlation mappings, scan results, and report metadata that should have been removed along with the parent event. Their persistence beyond the intended deletion lifecycle creates a risk of unintended data retention and potential information exposure if the records are reachable through other application queries or administrative interfaces. Preconditions: - An authenticated user with sufficient privileges to delete events in MISP. - The event must have associated reports, graphs, correlations, ssdeep chunks, or attachment scan results. Impact: - Residual sensitive data persists in the database after the parent event is deleted. - Accumulation of orphaned records over time may contribute to storage bloat. - Orphaned records may be inadvertently exposed through other data-access paths that do not validate the existence of the parent event. Affected versions: <2.5.48
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
清理环节不完整
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MISP MISP 0 ~ 2.5.48 cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-112180

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112180

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-112180 (1)

Same Patch Batch · MISP · 2026-10-19 · 7 CVEs total

CVE-2026-112178 7.1 HIGH MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access C
CVE-2026-112188 7.1 HIGH MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolutio
CVE-2026-112179 5.3 MEDIUM MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances
CVE-2026-112192 5.3 MEDIUM MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Setting
CVE-2026-112184 4.8 MEDIUM MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Lab
CVE-2026-112183 4.8 MEDIUM MISP CSS Injection via Remote Tag Colour in Event Preview

IV. Related Vulnerabilities

Same product: MISP
Same vendor: MISP
Same weakness: CWE-459

V. Comments for CVE-2026-112180

No comments yet

Leave a comment