In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report.
As a result:
- All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance.
- When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event.
This issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization.
Affected: <2.5.48.
"}],"value":"In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report.\n\nAs a result:\n\n- All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance.\n\n- When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event.\n\nThis issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization.\n\nAffected: <2.5.48."}],"impacts":[{"capecId":"CAPEC-128","descriptions":[{"lang":"en","value":"CAPEC-128 Leverage Executable Code to Alter Data"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.3,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"SSVC","other":{"content":{"options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"Supplier","timestamp":"2026-10-19T08:52:13Z","version":"2.0.3"},"type":"SSVC"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-19T08:53:57.689Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/MISP/MISP/commit/0be4564a9"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The non-exportable tag filtering is now invoked for each individual event report within the iteration loop, ensuring that restricted tags are removed from every report before it is transmitted to the remote MISP instance. This prevents the leakage of tags that were explicitly marked as non-exportable.
"}],"value":"The non-exportable tag filtering is now invoked for each individual event report within the iteration loop, ensuring that restricted tags are removed from every report before it is transmitted to the remote MISP instance. This prevents the leakage of tags that were explicitly marked as non-exportable."}],"title":"MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"full","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48 with 34 commits after fix), suggesting the fix is included in v2.5.48 and prior versions are affected. No explicit version range is stated in the patch.","PR:L assumes that a non-admin authenticated user with push-to-remote permissions can trigger the sync; if only administrators can initiate sync, PR should be raised to H.","The CAPEC-128 mapping is uncertain; no CAPEC pattern precisely describes a per-item filtering logic error causing data leakage during a legitimate operation.","The security impact is assessed as limited to tag disclosure; the actual sensitivity of 'non-exportable' tags depends on MISP deployment configuration and is not specified in the patch.","The availability impact (null report push causing remote save failure) is considered minor and not reflected in the CVSS vector as the primary concern is information disclosure."],"capecRationale":[{"capecId":"CAPEC-128","rationale":"This is the closest available CAPEC pattern. The vulnerability arises from a code logic error that causes data (non-exportable tags) to be improperly exposed during a legitimate sync operation. The mapping is uncertain because the issue is a logic bug in data filtering rather than a deliberate attacker action; no CAPEC pattern precisely covers 'improper per-item filtering in a loop causing data leakage during a legitimate API operation.'"}],"commit":"0be4564a98f37c568a35aa88c5b2bf598a23328a","confidence":"medium","credits":[{"lang":"en","type":"remediation developer","value":"iglocska"},{"lang":"en","type":"remediation developer","value":"Claude Opus 5.5 (1M context)"},{"lang":"en","type":"reporter","value":"elhoim"}],"cvssRationale":"AV:N: The vulnerability is triggered over the network during MISP-to-MISP synchronization. AC:L: No special conditions are needed beyond a configured sync relationship and an event with multiple reports. AT:N: No attacker interaction is required; the bug triggers on any sync push. PR:L: An authenticated user with permission to push events to a remote server is required. UI:N: No user interaction beyond initiating the sync. VC:L: Non-exportable tags (restricted metadata) are disclosed to the remote instance; the core event data is not exposed. VI:N, VA:N: No integrity or availability impact on the local instance. SC:N, SI:N, SA:N: No impact on the remote instance's confidentiality, integrity, or availability beyond receiving the tags it should not have.","fixSummary":"The non-exportable tag filtering is now invoked for each individual event report within the iteration loop, ensuring that restricted tags are removed from every report before it is transmitted to the remote MISP instance. This prevents the leakage of tags that were explicitly marked as non-exportable.","generatedAt":"2026-10-19T08:52:13.881684Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":11,"assumptionCount":5,"confidence":"medium","model":"qwen3.8:27b","score":7}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"4195b30bddf42380bf30e617b46cdf8e6a5db388a559dc133f98d401f36c35de","patchSummary":"In app/Model/Event.php, the call to __removeNonExportableTags was moved from a single post-loop invocation (which used the last $key value from the foreach) into the else branch of the loop body, so it executes for each non-empty report individually. The post-loop else block that applied the filter to a single report was removed, eliminating both the tag-leakage bug and the null-report push when the last report was empty.","patchTruncated":false,"patches":[{"commit":"0be4564a98f37c568a35aa88c5b2bf598a23328a","date":"Thu, 24 Sep 2026 16:32:31 +0200","patchSha256":"4195b30bddf42380bf30e617b46cdf8e6a5db388a559dc133f98d401f36c35de","source":"https://github.com/MISP/MISP/commit/0be4564a9.patch","sourceUrl":"https://github.com/MISP/MISP/commit/0be4564a9.patch","subject":"fix: [sync] Filter the tags of every event report pushed to a"}],"source":"https://github.com/MISP/MISP/commit/0be4564a9.patch","ssvc":{"options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"Supplier","timestamp":"2026-10-19T08:52:13Z","version":"2.0.3"},"subject":"fix: [sync] Filter the tags of every event report pushed to a","tagVersionBoundary":{"commits_after_fix":34,"repository":"https://github.com/MISP/MISP","tag":"v2.5.48","version":"2.5.48","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-200","rationale":"Tags explicitly marked as non-exportable were not filtered from event reports during synchronization, exposing restricted information to the remote MISP instance. The root cause is a logic error (filter applied once instead of per-item), but the security consequence is information disclosure."}]}},"bcp-05-x-03":{"x_timeline":{"events":[{"description":"Corrective change authored (0be4564a98f37c568a35aa88c5b2bf598a23328a): fix: [sync] Filter the tags of every event report pushed to a","id":"evt-fix-developed-1","references":["https://github.com/MISP/MISP/commit/0be4564a9.patch"],"timestamp":"2026-09-24T14:32:31Z","type":"fix-developed"}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20283"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-112179","datePublished":"2026-10-19T08:53:57.689Z","dateReserved":"2026-10-19T08:53:56.176Z","dateUpdated":"2026-10-19T18:32:29.985Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-19 09:17:08","lastModifiedDate":"2026-10-19 19:17:25","problem_types":["CWE-200","CWE-200 CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","ssvcData":{"timestamp":"2026-10-19T08:52:13Z","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"Supplier","version":"2.0.3"}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-19T18:32:17.990508Z","id":"CVE-2026-112179","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"112179","Ordinal":"1","Title":"MISP Event Synchronization Exposes Non-Exportable Tags on Remote","CVE":"CVE-2026-112179","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"112179","Ordinal":"1","NoteData":"In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report.\n\nAs a result:\n\n- All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance.\n\n- When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event.\n\nThis issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization.\n\nAffected: <2.5.48.","Type":"Description","Title":"MISP Event Synchronization Exposes Non-Exportable Tags on Remote"}]}}}