CVE-2026-10860
Logic Error in MISP CRUD Delete Handler Allows Unauthorized Record Deletion
Publication date: 2026-06-04
Last updated on: 2026-06-04
Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| misp | misp | to a5877559dc88ad7a0c935910a652c130489ae2bd (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a logic error in the MISP application's CRUD component, specifically in the delete handler. Due to missing parentheses in the conditional statement, the validation check for delete requests was bypassed when using the HTTP DELETE method.
The condition was evaluated incorrectly as ($validationError === null && POST) || DELETE, which allowed DELETE requests to proceed even if the delete validation callback rejected the operation.
As a result, an authenticated attacker with access to the delete endpoint could delete records that should have been protected by validation or authorization checks.
How can this vulnerability impact me? :
This vulnerability can allow an authenticated attacker to delete protected records without proper validation or authorization.
Such unauthorized deletions could lead to data loss, compromise of data integrity, and disruption of normal application operations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a logic error in the MISP CRUD component's delete handler that allows bypassing validation on HTTP DELETE requests. Detection would involve monitoring or testing the behavior of DELETE requests to affected endpoints to see if unauthorized deletions are possible.
One approach is to send crafted HTTP DELETE requests to the MISP application's delete endpoints and observe if records that should be protected are deleted despite validation failures.
Example commands using curl to test the vulnerability might include:
- curl -X DELETE -H "Authorization: Bearer <token>" https://<misp-instance>/path/to/delete/endpoint -v
- Check server responses and logs for successful deletions that should have been blocked.
Additionally, reviewing application logs for unexpected DELETE operations or anomalies in delete validation callbacks can help detect exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation is to apply the patch that fixes the logic error in the delete function of the CRUD component in the MISP application.
This patch corrects the conditional statement by adding parentheses to properly group the OR conditions, ensuring that delete validation callbacks are correctly enforced before allowing deletions.
Until the patch is applied, restrict access to the affected delete endpoints to trusted users only and monitor for suspicious DELETE requests.
If possible, disable or limit HTTP DELETE method usage on the affected endpoints as a temporary workaround.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an authenticated attacker to bypass validation and authorization checks when deleting records via the HTTP DELETE method. As a result, records that should be protected by application-level validation can be deleted improperly.
Such unauthorized deletion of protected data could lead to non-compliance with data protection regulations and standards like GDPR and HIPAA, which require strict controls over data access and integrity.