Is there a patch available for CVE-2026-10863?

Yes, a patch is available for CVE-2026-10863. Update the affected software to the latest version immediately.

MISP CVE-2026-10863

Q: What is the CVSS score of CVE-2026-10863?

CVE-2026-10863 has a CVSS 4.0 base score of 6.4 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-34265 MEDIUM

Improper Input Validation (CWE-20)

2026-06-04 CIRCL

GHSA-cr4f-6g54-5c3c

PHP Information Disclosure SQLi Misp

6.4

CVSS 4.0 · Vendor: CIRCL

Severity by source

Vendor (CIRCL) PRIMARY

6.4 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CIRCL) · only source for this CVE.

CVSS VectorVendor: CIRCL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 04, 2026 - 16:53 vuln.today

Analysis Generated

Jun 04, 2026 - 16:53 vuln.today

CVSS changed

Jun 04, 2026 - 15:22 NVD

6.4 (MEDIUM)

CVE Published

Jun 04, 2026 - 13:44 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value was processed by the underlying data access layer, this could allow manipulation of database query ordering and potentially expose the application to unsafe query construction.

The patch removes order from the set of request-controlled parameters and instead sets the ordering server-side to occurrence desc after processing allowed user parameters.

Affected component: app/Controller/CorrelationsController.php, overCorrelations()

Security impact: An authenticated attacker could influence the ordering clause used by the over-correlations query. The direct impact appears limited to query manipulation unless further evidence confirms SQL injection or unauthorized data exposure through the manipulated ordering expression.

AnalysisAI

Improper input validation in MISP's over-correlations endpoint allows an authenticated high-privileged attacker to inject arbitrary ordering clauses into database queries via the user-controlled order request parameter. All MISP instances running version 2.5.38 and earlier are affected. While direct impact is bounded by query-ordering manipulation, the vulnerability carries SQLi tags and high subsequent system impact scores (SC:H/SI:H/SA:H in CVSS 4.0), suggesting that a successfully crafted ordering expression could escalate to unsafe query construction or unintended data exposure. No public exploit has been identified at time of analysis.

Technical ContextAI

MISP (Malware Information Sharing Platform) is an open-source threat intelligence sharing platform written in PHP using the CakePHP framework. The affected component is app/Controller/CorrelationsController.php, specifically the overCorrelations() method, which queries for attribute values that appear in correlations above a defined threshold. The root cause is CWE-20 (Improper Input Validation): the order parameter was passed directly from user-controlled named request parameters into the data access layer's query construction logic without sanitization or restriction to an allowlist. The fix, visible in commit aa094a335ba2855f8a42a1dc44398f43560fe247, removes order from the user-settable parameter array and instead unconditionally sets $query['order'] = 'occurrence desc' server-side after processing other allowed parameters. CPE: cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* covering all versions up to and including 2.5.38.

RemediationAI

Apply the upstream fix available at https://github.com/MISP/MISP/commit/aa094a335ba2855f8a42a1dc44398f43560fe247, which removes the order key from user-controlled request parameters in overCorrelations() and hard-codes the ordering to occurrence desc server-side. The exact patched release version is not confirmed from available data - operators should update to the latest MISP release beyond 2.5.38 and verify the commit is included. As a compensating control prior to patching, administrators can restrict access to the over-correlations endpoint to the minimum set of trusted high-privilege accounts, since PR:H limits the attack surface to admin-level users; removing unnecessary admin accounts reduces exposure without disabling the feature. If SQL injection via the ordering clause is confirmed as exploitable in a specific environment, temporarily disabling the over-correlations feature via application configuration or web server ACL is a more aggressive but lower-risk mitigation, at the cost of losing over-correlation visibility.