CVE Explorer
CVE-2026-10860
A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method. Due to missing parentheses in the delete condition, the expression was evaluated as ($validationError === null && POST) || DELETE, meaning a DELETE request could proceed even when the delete validation callback had rejected the operation. An authenticated attacker with access to an affected delete endpoint could abuse this flaw to delete records that shoul
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"misp","vendor":"misp","versions":[{"lessThanOrEqual":"2.5.38","status":"affected","version":"0","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:cb0ce0f667b0a37b6baedd4b9927dab56c0afa1647c34269a94560c0b86f5759 · sha256:203d1e86e22cefff… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":7.9,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"N…
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:cb0ce0f667b0a37b6baedd4b9927dab56c0afa1647c34269a94560c0b86f5759 · sha256:203d1e86e22cefff… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-863","description":"CWE-863 Incorrect Authorization","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:cb0ce0f667b0a37b6baedd4b9927dab56c0afa1647c34269a94560c0b86f5759 · sha256:203d1e86e22cefff… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"tags":["patch"],"url":"https://github.com/MISP/MISP/commit/a5877559dc88ad7a0c935910a652c130489ae2bd"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:cb0ce0f667b0a37b6baedd4b9927dab56c0afa1647c34269a94560c0b86f5759 · sha256:203d1e86e22cefff… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.