{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107278", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "state": "PUBLISHED", "assignerShortName": "CIRCL", "dateReserved": "2026-10-07T15:42:40.660Z", "datePublished": "2026-10-07T15:42:42.472Z", "dateUpdated": "2026-10-07T15:42:42.472Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["app/Model/MispObject.php"], "product": "MISP", "programFiles": ["app/Model/MispObject.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance's validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data.</p><p>Preconditions:</p><p>- Two or more MISP instances are configured to synchronize objects.</p><p>- A user with object-creation privileges creates an object without supplying a description.</p><p>- The object is subsequently synced to a peer instance.</p><p>Impact:</p><p>- Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline.</p><p>- The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology.</p><p>Affected: &lt;2.5.48.</p>"}], "value": "MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance's validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data.\n\nPreconditions:\n\n- Two or more MISP instances are configured to synchronize objects.\n\n- A user with object-creation privileges creates an object without supplying a description.\n\n- The object is subsequently synced to a peer instance.\n\nImpact:\n\n- Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline.\n\n- The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology.\n\nAffected: <2.5.48."}], "impacts": [{"capecId": "CAPEC-101", "descriptions": [{"lang": "en", "value": "CAPEC-101 Application Level DoS"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "SSVC", "other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-07T15:41:05Z", "version": "2.0.3"}, "type": "SSVC"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-10-07T15:42:42.472Z"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/6b1776f07"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The overly strict validation rule that required a non-empty description on MISP Objects during creation was relaxed to permit an empty description. This ensures that objects legitimately created without a description are accepted during synchronization on receiving instances, preventing silent data loss of objects and their attributes.</p>"}], "value": "The overly strict validation rule that required a non-empty description on MISP Objects during creation was relaxed to permit an empty description. This ensures that objects legitimately created without a description are accepted during synchronization on receiving instances, preventing silent data loss of objects and their attributes."}], "title": "MISP Object Sync Drops Objects and Attributes When Description Is Empty", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48, 36 commits after fix); no explicit 'affected' or 'fixed' version string is provided in the patch.", "The CAPEC-101 mapping is the closest available pattern; the issue is more accurately described as a data-integrity defect during sync rather than a classic DoS, but no CAPEC specifically covers 'over-strict validation causing silent data loss during replication'.", "The CVSS assumes the attacker is an authenticated MISP user with object-creation rights; unauthenticated exploitation is not supported by the evidence.", "The commit message states the issue was 'found during the internal review, not externally reported'; no external finder or reporter is credited.", "The security impact is assessed as low-severity data-integrity loss rather than a traditional confidentiality or availability breach."], "capecRationale": [{"capecId": "CAPEC-101", "rationale": "This is the closest available CAPEC. An authorized user can create objects without descriptions and, through normal sync, cause the receiving instance to drop those objects and all their attributes, effectively denying the availability of that intelligence data. The mapping is uncertain because the primary effect is data-integrity loss rather than a classic DoS, and no external unauthenticated attacker is required; however, CAPEC-101 best captures the 'valid data is silently discarded, degrading the service's usefulness' pattern."}], "commit": "6b1776f072e153a4e2cf3af0c210c7aeadfa0469", "confidence": "medium", "credits": [{"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5.5 (1M context)"}], "cvssRationale": "The vulnerability is reachable over the network (AV:N) via the MISP sync protocol with low complexity (AC:L) and no specific attack target (AT:N). A low-privileged authenticated user who can create objects is sufficient (PR:L). No user interaction is needed (UI:N). There is no confidentiality impact (VC:N). The integrity impact on the victim is low (VI:L) because valid objects and attributes are silently dropped, corrupting the integrity of the receiving instance's data store. There is no direct availability impact on the victim system itself (VA:N). No secondary impacts are identified (SC:N, SI:N, SA:N). Overall severity is Low.", "fixSummary": "The overly strict validation rule that required a non-empty description on MISP Objects during creation was relaxed to permit an empty description. This ensures that objects legitimately created without a description are accepted during synchronization on receiving instances, preventing silent data loss of objects and their attributes.", "generatedAt": "2026-10-07T15:41:05.158252Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 11, "assumptionCount": 5, "confidence": "medium", "model": "qwen3.8:27b", "score": 7}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "17b9854719a40da145be39fc8cf2107bf9d99d02dff2785002fe7a842de88ea1", "patchSummary": "In app/Model/MispObject.php, the validation rule for the 'description' field (stringNotEmpty, applied on create) was modified by adding the key 'allowEmpty' set to true. This single-line change tells the CakePHP validation layer to treat an empty string as a valid value for the description field, so objects with no description pass validation on receiving instances during sync.", "patchTruncated": false, "patches": [{"commit": "6b1776f072e153a4e2cf3af0c210c7aeadfa0469", "date": "Thu, 24 Sep 2026 16:07:34 +0200", "patchSha256": "17b9854719a40da145be39fc8cf2107bf9d99d02dff2785002fe7a842de88ea1", "source": "https://github.com/MISP/MISP/commit/6b1776f07.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/6b1776f07.patch", "subject": "fix: [sync] Accept objects without a description"}], "source": "https://github.com/MISP/MISP/commit/6b1776f07.patch", "ssvc": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "Supplier", "timestamp": "2026-10-07T15:41:05Z", "version": "2.0.3"}, "subject": "fix: [sync] Accept objects without a description", "tagVersionBoundary": {"commits_after_fix": 36, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.48", "version": "2.5.48", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-20", "rationale": "The validation rule stringNotEmpty was applied without accounting for the legitimate case of an empty description, causing valid input (an object with no description) to be rejected. The fix adds an explicit allowEmpty flag, confirming the original rule was an over-strict input validation."}]}}, "bcp-05-x-03": {"x_timeline": {"events": [{"description": "Corrective change authored (6b1776f072e153a4e2cf3af0c210c7aeadfa0469): fix: [sync] Accept objects without a description", "id": "evt-fix-developed-1", "references": ["https://github.com/MISP/MISP/commit/6b1776f07.patch"], "timestamp": "2026-09-24T14:07:34Z", "type": "fix-developed"}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20215"}]}}}

{}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"], "modules": ["app/Model/MispObject.php"], "product": "MISP", "programFiles": ["app/Model/MispObject.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance's validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data.\n\nPreconditions:\n\n- Two or more MISP instances are configured to synchronize objects.\n\n- A user with object-creation privileges creates an object without supplying a description.\n\n- The object is subsequently synced to a peer instance.\n\nImpact:\n\n- Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline.\n\n- The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology.\n\nAffected: <2.5.48."}], "id": "CVE-2026-107278", "lastModified": "2026-10-07T16:17:47.513", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}], "ssvcV203": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "ssvcData": {"options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "Supplier", "timestamp": "2026-10-07T15:41:05Z", "version": "2.0.3"}}]}, "published": "2026-10-07T16:17:47.393", "references": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "url": "https://github.com/MISP/MISP/commit/6b1776f07"}], "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}]}

{}

{}