In MISP, a flaw in the ORM’s save routine allows an authenticated user to insert a nested key that matches the model alias. During sanitization the outer record’s primary key and event identifiers are removed or pinned, but the ORM instead processes the nested record, which carries an attacker‑chosen id and event_id. This bypass lets a low‑privilege account overwrite, re‑parent, or soft‑delete rows in other organizations or events, compromising data integrity across multiple entity types such as Attribute, Object, and ShadowAttribute.

Vendor MISP, product MISP, affected in all releases prior to 2.5.48. Vulnerable models include Attribute, Object, EventReport, Sighting, AttributeTag, ShadowAttribute. No other vendor versions are impacted.

With a CVSS score of 8.3 the vulnerability is considered high severity; the EPSS score is unavailable, but the lack of a KEV listing suggests it is not yet broadly exploited. An attacker only needs a valid authenticated account with perm_add privileges, which is a low level of access. The exploit is straightforward: submit a crafted request containing the nested alias key; the patch replaces the misuse of set() with a defensive save that refuses to persist such records, and sanitization paths now remove the key before saving. Until the fix is applied, the risk remains high and exploitable.