CVE-2026-112180
Deferred Deferred - Pending Action

Data Integrity Flaw in MISP Leaves Orphaned Records

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: CIRCL

Description
MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal (shadow attribute) correlations, fuzzy ssdeep correlation chunks, and attachment scan results. These orphaned records may contain sensitive threat intelligence data such as correlation mappings, scan results, and report metadata that should have been removed along with the parent event. Their persistence beyond the intended deletion lifecycle creates a risk of unintended data retention and potential information exposure if the records are reachable through other application queries or administrative interfaces. Preconditions: - An authenticated user with sufficient privileges to delete events in MISP. - The event must have associated reports, graphs, correlations, ssdeep chunks, or attachment scan results. Impact: - Residual sensitive data persists in the database after the parent event is deleted. - Accumulation of orphaned records over time may contribute to storage bloat. - Orphaned records may be inadvertently exposed through other data-access paths that do not validate the existence of the parent event. Affected versions: <2.5.48

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112180
EUVD
EUVD-2026-104129

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
MISP MISP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-459 The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MISP has a data integrity flaw where deleting an event does not remove all associated records. This leaves orphaned entries like report tags, graphs, correlations, ssdeep chunks, and scan results in the database. These leftover records may contain sensitive threat intelligence data that should have been deleted, posing a risk of unintended data retention and exposure.

Detection Guidance

To detect orphaned records from this vulnerability, query the MISP database for records that reference non-existent events. Check tables like event_report_tags, event_graphs, shadow_attributes, fuzzy_correlations_ssdeep, and attachment_scan_results for entries where event_id does not exist in the events table. Example SQL: SELECT * FROM event_report_tags WHERE event_id NOT IN (SELECT id FROM events);

For system checks, review database logs for event deletion operations and verify if associated records were removed. Inspect storage usage for unexpected growth in MISP-related database tables.

Impact Analysis

If you use MISP versions before 2.5.48, deleting events may not fully remove sensitive data. This could lead to storage bloat from accumulating orphaned records and potential exposure of threat intelligence data through other application queries or admin interfaces.

Compliance Impact

This vulnerability may violate data retention and privacy requirements in GDPR and HIPAA by failing to properly delete sensitive threat intelligence data. Orphaned records could expose personal or confidential information, leading to compliance violations and potential legal risks.

Mitigation Strategies

Upgrade MISP to version 2.5.48 or later to apply the fix for cascading deletion of orphaned records.

Manually identify and remove existing orphaned records by executing SQL queries to delete entries referencing non-existent events in affected tables.

Monitor database storage and review administrative interfaces for unintended exposure of orphaned data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112180. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart