CVE-2026-10863
published 2026-06-04CVE-2026-10863: A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request…
PriorityP352high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.22%
13.0th percentile
A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value was processed by the underlying data access layer, this could allow manipulation of database query ordering and potentially expose the application to unsafe query construction.
The patch removes order from the set of request-controlled parameters and instead sets the ordering server-side to occurrence desc after processing allowed user parameters.
Affected component:
app/Controller/CorrelationsController.php, overCorrelations()
Security impact:
An authenticated attacker could influence the ordering clause used by the over-correlations query. The direct impact appears limited to query manipulation unless further evidence confirms SQL injection or unauthorized data exposure through the manipulated ordering expression.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| misp-project | misp | < 2.5.39 | 2.5.39 |
| misp | misp | <= 2.5.38 | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
nvdv4.06.4MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
MISP up to 2.5.38 Correlations over-correlation Endpoint CorrelationsController.php overCorrelations input validation
vuldb·2026-06-04·CVSS 6.4
CVE-2026-10863 [MEDIUM] MISP up to 2.5.38 Correlations over-correlation Endpoint CorrelationsController.php overCorrelations input validation
A vulnerability has been found in MISP up to 2.5.38 and classified as critical. This affects the function overCorrelations of the file app/Controller/CorrelationsController.php of the component Correlations over-correlation Endpoint. Performing a manipulation results in improper input validation.
This vulnerability was named CVE-2026-10863. The attack may be initiated remotely. There is no available exploit.
The affected component should be upgraded.
GHSA
A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters.
ghsa_unreviewed·2026-06-04
CVE-2026-10863 [MEDIUM] CWE-20 A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters.
A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value was processed by the underlying data access layer, this could allow manipulation of database query ordering and potentially expose the application to unsafe query construction.
The patch removes order from the set of request-controlled parameters and instead sets the ordering server-side to occurrence desc after processing allowed user parameters.
Affected component:
app/Controller/CorrelationsController.php, overCorrelations()
Security impact:
An authenticated attacker could influence the orde
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-04
Published