Which versions of MISP are affected by CVE-2026-10860?

MISP threat intelligence platform deployments are exposed to unauthorized data deletion through a validation control bypass, compromising the integrity of shared threat indicators for organizations…. A patch is available.

How to fix or mitigate CVE-2026-10860?

Within 24 hours: Identify all MISP instances in production and document current versions. Within 7 days: Upgrade all MISP instances to patched version per vendor advisory. Within 30 days: Audit deletion logs for any unauthorized record removals during the vulnerability window.

MISP CVE-2026-10860

Q: What is the CVSS score of CVE-2026-10860?

CVE-2026-10860 has a CVSS 4.0 base score of 7.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34264 HIGH

Incorrect Authorization (CWE-863)

2026-06-04 CIRCL

GHSA-mqm2-jjx4-44gx

Authentication Bypass Misp

7.9

CVSS 4.0 · Vendor: CIRCL

Severity by source

Vendor (CIRCL) PRIMARY

7.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CIRCL) · only source for this CVE.

CVSS VectorVendor: CIRCL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 04, 2026 - 16:51 vuln.today

Analysis Generated

Jun 04, 2026 - 16:51 vuln.today

CVSS changed

Jun 04, 2026 - 15:22 NVD

7.9 (HIGH)

CVE Published

Jun 04, 2026 - 13:34 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method. Due to missing parentheses in the delete condition, the expression was evaluated as ($validationError === null && POST) || DELETE, meaning a DELETE request could proceed even when the delete validation callback had rejected the operation. An authenticated attacker with access to an affected delete endpoint could abuse this flaw to delete records that should have been protected by application-level validation or authorization checks.

AnalysisAI

Authorization bypass in MISP versions through 2.5.38 lets authenticated users delete records via HTTP DELETE requests even after the application's delete-validation callback has rejected the operation. The root cause is an operator-precedence bug in the CRUDComponent::delete() handler where missing parentheses caused validation checks to be skipped for the DELETE method. No public exploit identified at time of analysis, but the upstream fix commit on GitHub publicly discloses the exact one-line vulnerable expression, making weaponization trivial.

Technical ContextAI

MISP (Malware Information Sharing Platform) is a PHP/CakePHP-based threat intelligence sharing platform maintained by CIRCL. The flaw lives in app/Controller/Component/CRUDComponent.php, a shared component invoked by many controllers to handle record deletion. The original guard read if ($validationError = null && $this->Controller->request->is('post') || $this->Controller->request->is('delete')), which due to PHP operator precedence parses as ($validationError = null && POST) || DELETE - so any HTTP DELETE request short-circuits past the validationError check entirely. This is a textbook CWE-863 (Incorrect Authorization) failure: the authorization/validation result is computed but not actually enforced on one code path, leaving model-level callbacks (which often implement object ownership, role checks, or referential-integrity constraints) ineffective against DELETE verbs.

RemediationAI

Upgrade MISP to the first release that contains commit a5877559dc88ad7a0c935910a652c130489ae2bd (the parenthesisation fix in CRUDComponent::delete); per the input data this is an upstream fix available on GitHub, with the released patched version not independently confirmed beyond 'a version newer than 2.5.38'. Operators who cannot upgrade immediately can cherry-pick the one-line patch (wrapping the is('post') || is('delete') clause in parentheses) into their local CRUDComponent.php, since it is a self-contained change with no schema or API impact. As compensating controls until patched, restrict the MISP API and web UI to trusted analyst networks via reverse-proxy ACLs, and consider proxy-level blocking of HTTP DELETE methods to MISP endpoints (side effect: REST clients that rely on DELETE for legitimate record removal will need to switch to POST-based delete routes or be temporarily broken); tightening role/permission assignments so fewer accounts can reach delete endpoints further reduces blast radius. See the vendor commit linked above for the authoritative fix.