MISP CVE-2026-112180

Requires an authenticated user with sufficient privileges to delete events in MISP (PR:H), and the deleted event must have at least one associated child record of the affected types: event reports (and their tags), event graph entries, shadow-attribute/proposal correlations, fuzzy ssdeep correlation chunks, or attachment/malware-sample scan results. The defect itself is triggered by the normal event-deletion workflow; however, actual information exposure is further gated by a second condition - the orphaned rows must be reachable via some other application query or administrative interface that does not validate parent-event existence. Limiting factors: no low-privilege or unauthenticated path, no remote code execution, no confidentiality/availability impact in the vendor vector, and events with no such child records are unaffected.

This is a low-to-moderate priority issue despite being a 'medium' CVSS 5.1, and the signals are internally consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) requires high privileges (PR:H) - an account already trusted to delete events in MISP - and scores only a low vulnerable-system integrity impact (VI:L) with explicitly no confidentiality (VC:N) and no availability (VA:N) impact. No EPSS score, CISA KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The realistic threat is not remote compromise but data-hygiene failure (CWE-459, Incomplete Cleanup): orphaned records survive event deletion. Note a nuance to verify: the input Tags and the description frame this as 'Information Disclosure,' yet the official vector sets VC:N (no confidentiality impact) and only VI:L - meaning the vendor modeled this as a data-integrity/retention defect, and any actual information exposure is conditional on those orphaned rows being reachable through a separate, unvalidated access path. Treat the 'information disclosure' angle as a potential secondary consequence, not a confirmed primary impact.

A privileged MISP user (e.g. an org admin able to delete events) deletes an event that has associated event reports, graphs, shadow-attribute correlations, ssdeep correlation chunks, or attachment scan results. Those child records are not purged and remain in the database as orphans; if another feature or administrative query later reads them without checking that the parent event still exists, residual threat-intelligence data could be surfaced to users who should no longer see it. No public exploit code exists, and exploitation requires existing high-privilege access rather than a remote unauthenticated vector.