CVE-2026-10863
8.1 HIGHA security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlle...
Published: 2026-06-04 · Last updated: 2026-06-08
Severity and scoring
- CVSS
- 8.1 HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- CWE
- CWE-20
Affected products
| Vendor | Product |
|---|---|
| misp | misp |
Description
A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value was processed by the underlying data access layer, this could allow manipulation of database query ordering and potentially expose the application to unsafe query construction. The patch removes order from the set of request-controlled parameters and instead sets the ordering server-side to occurrence desc after processing allowed user parameters. Affected component: app/Controller/CorrelationsController.php, overCorrelations() Security impact: An authenticated attacker could influence the ordering clause used by the over-correlations query. The direct impact appears limited to query manipulation unless further evidence confirms SQL injection or unauthorized data exposure through the manipulated ordering expression.
Source: NVD
References
Related CVEs
Same vendor
- CVE-2026-10864 — A vulnerability in the MISP dashboard widgets allowed an authenticated user to manipulate the fields option and influence which fields we... (4.3 MEDIUM)
- CVE-2026-10860 — A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method (6.5 MEDIUM)
- CVE-2026-10861 — An open redirect vulnerability existed in MISP UsersController::routeafterlogin() because the value stored in the pre_login_requested_url... (6.1 MEDIUM)
- CVE-2026-10856 — A URL validation flaw in the MISP dashboard button widget allowed a crafted relative-looking URL to be accepted as a local path while bei... (6.1 MEDIUM)
- CVE-2026-10855 — An authorization flaw existed in the MISP Event Template Importer overwrite workflow (4.3 MEDIUM)
Same CWE
- CVE-2026-47370 — A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain... (9.9 CRITICAL)
- CVE-2026-47369 — A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain... (9.9 CRITICAL)
- CVE-2026-47367 — A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UID Ent... (9.9 CRITICAL)
- CVE-2026-12034 — Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 149.0.7827.115 allowed a remote at... (8.3 HIGH)
- CVE-2026-12025 — Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromi... (5.3 MEDIUM)