CVE-2026-103235 MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events
Authenticated attackers can exploit mass assignment in MISP delegation to read arbitrary events and transfer ownership by manipulating event IDs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-103235?
CVE-2026-103235 is a high-severity missing authorization vulnerability in MISP, published on 30 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submitted record, including caller-supplied fields such as the primary key and event_id.
An authenticated attacker could inject a primary key or event_id into the delegation payload to retarget an existing delegation record to any event on the instance. Because a delegation row grants the requesting organisation read access to the event it references, this effectively granted read access to arbitrary events belonging to other organisations. If the target organisation subsequently accepted the delegation, ownership of the event was transferred and the original record was deleted.
Preconditions:
- An authenticated user with the delegation permission (perm_delegate)
- The MISP.delegation server setting must be enabled
Impact:
- Confidentiality: read access to any event on the instance
- Integrity: overwriting existing delegation records and transferring event ownership
Affected versions: MISP < 2.5.48
Which versions are affected by CVE-2026-103235?
How do I fix CVE-2026-103235?
No fix has been published for CVE-2026-103235 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-103235 being exploited?
There is no known exploitation of CVE-2026-103235 in the wild and no public exploit code.
Sources
Also known as GHSA-j2mf-q9c3-gwxw.