CVE-2026-107175 MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes
Authenticated users can cause stale correlations to persist after changing event distribution, leading to unintended information disclosure to broader sharing groups.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-107175?
CVE-2026-107175 is a medium-severity vulnerability in MISP, published on 7 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified.
When a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted.
Security impact:
- Stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure.
- Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing.
Preconditions:
- An authenticated user with write access to at least one MISP event.
- The user modifies the event's distribution or sharing_group_id field.
Affected versions: <2.5.48
Which versions are affected by CVE-2026-107175?
How do I fix CVE-2026-107175?
No fix has been published for CVE-2026-107175 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-107175 being exploited?
There is no known exploitation of CVE-2026-107175 in the wild and no public exploit code.
Sources
Also known as GHSA-9v45-rw9g-683m.