CVE-2026-116469

{
  "etk_id": "ETK-2026-2644",
  "cve_id": "CVE-2026-116469",
  "display_id": "CVE-2026-116469",
  "ghsa_id": "GHSA-xwff-xxvq-7fgx",
  "euvd_id": "EUVD-2026-109736",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Case-sensitive policy bypass in MISP misp-guard",
  "summary": "MISP misp-guard evaluates configured tag, attribute-category, and sharing-group restrictions with case-sensitive matching. An attacker able to create or modify MISP events can change letter casing to evade those restrictions and distribute data that operators intended to withhold.",
  "mitigation": "Restrict event creation and modification privileges to trusted users and connected instances, and review outbound events for policy violations before distribution. Until an update is published, normalize relevant policy identifiers and event metadata to a consistent case where your deployment permits it.",
  "vendor": "MISP",
  "product": "misp-guard",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.3"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "misp-guard",
      "purl": null
    }
  ],
  "cwes": [
    178
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 9.809561733333334,
  "t0_at": "2026-10-26T10:35:51.992000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-26T10:35:51.992000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-26T10:35:51.992000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-116469"
    }
  }
}