CVE-2026-10863: MISP Correlations Query Ordering Vulnerability (CVSS 8.1)

Technical summary

CVE-2026-10863 is an improper input validation flaw (CWE-20) in MISP's CorrelationsController.php overCorrelations() method. The endpoint accepted an 'order' query parameter from user-controlled request parameters without validation, allowing authenticated users to inject arbitrary ordering clauses into database queries. The patch removes user control over ordering and enforces server-side ordering as 'occurrence desc' after processing legitimate user parameters. The underlying risk stems from the endpoint's failure to validate and sanitize the order parameter before it reached the data access layer, creating conditions favorable to query manipulation.

Business impact

Organizations deploying MISP for threat intelligence correlation and analysis face exposure to unauthorized information disclosure. An authenticated insider or compromised user account could manipulate query ordering to surface correlations or metadata that should remain hidden, potentially revealing investigation scope, threat actor tracking patterns, or sensitive intelligence relationships. This is particularly damaging in multi-tenant or federated MISP environments where result ordering can expose which organizations or indicators are being correlated. The confidentiality impact is rated high because reordered queries can leak information through side-channel access to result sets.

Affected systems

MISP project's MISP application is affected. Vulnerable versions are those released before the patch that enforces server-side ordering in the overCorrelations() method. Organizations running MISP instances should consult the official MISP advisory to identify the exact patched version number and determine whether their deployed version requires updating.

Exploitability

Exploitation requires valid authentication credentials, making this an insider risk or secondary compromise scenario rather than an unauthenticated attack vector. No CISA KEV entry currently exists, indicating limited evidence of active exploitation in the wild at this time. The attack is trivial once credentials are obtained—a simple HTTP parameter manipulation—requiring no special tools or complex payloads. The barrier to exploitation is authentication; the barrier to execution is minimal.

Remediation

Apply the patch that removes user-controlled ordering from the overCorrelations() endpoint and implements fixed server-side ordering. Verify the patched version in your MISP deployment against the vendor release notes. Additionally, review MISP instance access logs for unusual query patterns from authenticated accounts, particularly those accessing the correlations endpoint with non-standard order parameters. Consider implementing network-layer rate limiting on the endpoint if internal policy permits.

Patch guidance

Consult the MISP project's official security advisory and release notes to identify the specific patched version. Update MISP to the first released version after 2026-06-04 that includes the fix to CorrelationsController.php. Test the update in a non-production environment to verify that legitimate correlation queries and over-correlation functionality operate as expected before deploying to production. The patch is server-side only and requires no client-side changes.

Detection guidance

Monitor authentication logs for access to the /correlations/overCorrelations endpoint. Log and alert on repeated requests to this endpoint from the same user account, especially if accompanied by varied or unusual order parameter values. Search proxy or application logs for GET/POST requests containing 'order=' parameters in the correlations endpoint URI. Review correlation result sets for anomalous ordering patterns or unexpected data exposure. Implement a baseline of normal ordering behavior and flag deviations.

Why prioritize this

The CVSS 3.1 score of 8.1 (HIGH) reflects a high confidentiality and integrity impact, low complexity, and low attack vector due to network-accessible authentication. Although authentication is required, the ease of exploitation, potential for sensitive intelligence exposure, and high impact on confidentiality warrant prompt patching. Organizations should prioritize this update for production MISP instances, particularly those handling sensitive threat intelligence.

Risk score, explained

The score of 8.1 results from: (AV:N) network-accessible attack surface; (AC:L) low complexity once authenticated; (PR:L) authenticated user required, limiting casual exploitation; (UI:N) no user interaction needed; (S:U) scope unchanged; (C:H) confidentiality impact rated high due to potential information disclosure through query reordering; (I:H) integrity concern from unauthorized query construction; (A:N) no availability impact. The authentication requirement prevents this from being critical, but the high-impact confidentiality and integrity outcomes justify the 8.1 severity.

Frequently asked questions