CVE-2026-10860: MISP Delete Validation Bypass – Logic Error in HTTP DELETE Handler

Technical summary

A missing parenthesis in the MISP CRUD delete component creates a precedence error in the validation condition. The expression evaluates as ($validationError === null && POST) || DELETE instead of ($validationError === null && (POST || DELETE)). This means any DELETE request bypasses the validation callback entirely, regardless of rejection status. An authenticated user sending a DELETE request to a protected endpoint will proceed past the authorization layer even if the delete validation callback has explicitly rejected the operation, effectively circumventing both application-level validation and authorization checks tied to that callback.

Business impact

An authenticated insider or compromised account holder can delete business-critical records that should be protected by validation rules or role-based access controls. In MISP environments used for threat intelligence sharing, this could result in loss of collaborative threat data, disruption of incident response workflows, or corruption of shared intelligence artifacts. The integrity of your threat intelligence repository becomes questionable if records can be silently removed by those who should have limited permissions.

Affected systems

MISP (Malware Information Sharing Platform) instances are affected. The specific version range has not been disclosed in public advisories; verify the patch availability status against the MISP project's security advisories and your deployment version. If you operate or depend on a MISP instance for threat intelligence, your deployment should be evaluated for exposure.

Exploitability

Exploitation requires valid authentication credentials and network access to an affected delete endpoint. No authentication bypass is involved. The attack is straightforward once an attacker has legitimate access: they simply send a properly formed DELETE request to an endpoint that normally enforces validation, and the logic flaw allows it to succeed. This is classified as MEDIUM severity (CVSS 6.5) because it requires prior authentication, but the impact on integrity is high given the ability to delete protected records without authorization.

Remediation

Upgrade MISP to the patched version released by the MISP project. Verify the exact patched version against the official MISP security advisory to ensure you apply the correct fix. Organizations should treat this as a timely patch given the straightforward exploitation path for authenticated users and the data integrity risk.

Patch guidance

Contact the MISP project or consult their official security advisories to identify the patched version that addresses this logic error. Apply the patch during a maintenance window after validating in a non-production environment. Test delete operations post-patch to confirm that validation callbacks are now properly enforced and that deletion attempts are blocked when validation rejects them.

Detection guidance

Monitor HTTP DELETE requests to MISP endpoints for patterns that suggest exploitation: repeated DELETE attempts on the same record IDs, deletion of records that should be protected by policy, or DELETE requests originating from users or service accounts with lower privilege levels than would normally have delete permissions. Log and alert on any validation callback failures followed by successful DELETE operations, as this sequence may indicate exploitation. Review audit logs for unexpected record deletions, particularly of high-value threat intelligence or sensitive collaborative data.

Why prioritize this

Although CVSS 6.5 indicates MEDIUM severity, the vulnerability warrants prompt attention because it directly undermines data integrity controls and allows authenticated users to bypass protective validation. In a threat intelligence sharing environment like MISP, data integrity is critical; loss of records or unauthorized deletion can degrade operational effectiveness. Prioritize patching for externally accessible MISP instances or those with untrusted user populations. Internal-only instances with well-controlled user access have lower risk but should still be patched in the next maintenance cycle.

Risk score, explained

CVSS 6.5 reflects a MEDIUM severity rating: the attack vector is network-based (AV:N) and requires low complexity (AC:L), but mandates prior authentication (PR:L). The scope is unchanged (S:U) and there is no confidentiality impact (C:N), but integrity impact is high (I:H) due to the ability to delete protected records. The high integrity impact is offset by the authentication requirement, resulting in a MEDIUM overall score that balances the serious integrity implications against the attacker's need for valid credentials.

Frequently asked questions