CVE-2026-10863 MISP User-controlled order parameter in correlations over-correlation endpoint
An authenticated attacker can manipulate database query ordering in MISP, potentially exposing data or enabling SQL injection via the over-correlation endpoint.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-10863?
CVE-2026-10863 is a medium-severity SQL injection vulnerability in Misp-Project Misp, published on 4 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value was processed by the underlying data access layer, this could allow manipulation of database query ordering and potentially expose the application to unsafe query construction.
The patch removes order from the set of request-controlled parameters and instead sets the ordering server-side to occurrence desc after processing allowed user parameters.
Affected component: app/Controller/CorrelationsController.php, overCorrelations()
Security impact: An authenticated attacker could influence the ordering clause used by the over-correlations query. The direct impact appears limited to query manipulation unless further evidence confirms SQL injection or unauthorized data exposure through the manipulated ordering expression.
Weakness: CWE-20
Which versions are affected by CVE-2026-10863?
It affects 1 product.
Products include Misp-Project Misp.
How do I fix CVE-2026-10863?
No fix has been published for CVE-2026-10863 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-10863 being exploited?
There is no known exploitation of CVE-2026-10863 in the wild and no public exploit code.
Other vulnerabilities in Misp-Project Misp
Sources
Also known as GHSA-cr4f-6g54-5c3c.